A session processing method, device, apparatus and load balancing system

Abstract

A session processing method, apparatus, device, and load balancing system are disclosed. The method is applied to a load balancing system comprising a first network layer and a second network layer. The first network layer includes a first node, and the second network layer includes at least one Slow Processing Group (SPG). The method includes: the first node sending a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes a forward flow 5-tuple of an external first original message; receiving a second tunnel message from the master node based on the forward flow 5-tuple; parsing the second tunnel message to obtain a reverse flow 5-tuple and the first original message; searching for the session and its reverse flow 5-tuple based on the first original message; and performing address translation processing on the first original message using the completed reverse flow 5-tuple to generate and send the second original message. This method is not limited by traditional single-layer networks and can support linear growth in the number of sessions with the number of nodes under high session availability.

Description

Technical Field

[0001] This disclosure relates to the field of network access technology, and in particular to a session processing method, apparatus, device and load balancing system. Background Technology

[0002] Access gateways (GWs), also known as load balancers, are typically deployed in a top-of-rack (ToR) network cluster. High availability (HA) in access gateways uses a "full-cluster session synchronization scheme," meaning that for each session within a GW cluster, every node except the primary node (e.g., the node that created the session) has a backup session. However, with the advent of 5G and the Internet of Things (IoT), the number of sessions for individual services such as Virtual IPs (VIPs) or Virtual Ports (VPORTs) will increase significantly. As the number of sessions in the entire cluster grows, the current "full-cluster session synchronization scheme" can no longer meet the demands.

[0003] In addition, the limited memory capacity of a single GW will also affect the containerized deployment of session high availability features. Summary of the Invention

[0004] This disclosure proposes a session processing method, apparatus, device, and load balancing system to address the problem that the number of sessions increases linearly with the number of nodes under conditions supporting high availability of sessions. Specifically, the following technical solutions are disclosed:

[0005] In a first aspect, this disclosure provides a session processing method applied to a load balancing system. The system includes a first network layer and a second network layer, which are tunneled together. The first network layer includes a first node, and the second network layer includes at least one Slow Processing Group (SPG). The method includes:

[0006] The first node sends a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes the forward flow 5-tuple of the first original message from the outside. The first node receives the second tunnel message fed back by the master node based on the forward flow 5-tuple. The first node parses the second tunnel message to obtain the reverse flow 5-tuple and the first original message. The first node looks up the session based on the first original message and completes the reverse flow 5-tuple of the found session. The first node performs address translation processing on the first original message using the completed reverse flow 5-tuple to generate the second original message and sends the second original message.

[0007] In conjunction with the first aspect, in one possible implementation of the first aspect, before the first node sends the first tunnel message to the master node in the first SPG, the method further includes: the first node receiving a first raw message from an external source, searching for a local session based on the content of the first raw message; if no matching session is found, creating a new session, and selecting the first SPG in at least one SPG of the second network layer; and constructing a first User Datagram Protocol (UDP) message, and encapsulating the first UDP message into a first tunnel message.

[0008] In conjunction with the first aspect, in another possible implementation of the first aspect, selecting a first SPG from at least one SPG in the second network layer includes: the first node selecting the first SPG from at least one SPG based on the quintuple hash value of the first original message.

[0009] In conjunction with the first aspect, in another possible implementation of the first aspect, the second tunnel message is generated by the master node in the first SPG after searching the session locally, encapsulating the found reverse flow 5-tuple and the first original message; or, the second tunnel message is generated by the master node in the first SPG based on the reverse flow 5-tuple fed back by the master node of the second SPG, and encapsulating it in conjunction with the first original message.

[0010] In conjunction with the first aspect, in another possible implementation of the first aspect, the process of finding a session based on the first original message further includes: when the first node does not find a matching session based on the first original message, determining a second SPG in at least one SPG in the second network layer; the first node sending a third tunnel message to the master node of the second SPG; and receiving a fourth tunnel message sent by the master node of the first SPG, the fourth tunnel message including the first original message and a reverse flow 5-tuple, the reverse flow 5-tuple being used to complete the 5-tuple information of the session.

[0011] Secondly, this disclosure also discloses another session processing method, which is applied to a master node of the second network layer in a load balancing system, such as the master node of the first slow processing group (SPG). The method includes:

[0012] The master node in the first SPG receives the first tunnel message sent by the first node, decapsulates the first tunnel message to obtain the first original message, which includes a forward flow quintuple.

[0013] The master node in the first SPG searches for a matching session in its local session list based on the forward flow 5-tuple; it encapsulates the reverse flow 5-tuple of the matched session with the first original message to generate a second tunnel message; or, it encapsulates the reverse flow 5-tuple of a session that was not found but received from the master node of the second SPG with the first original message to generate a second tunnel message, and sends the second tunnel message to the first node.

[0014] In conjunction with the second aspect, in one possible implementation of the second aspect, receiving the reverse flow 5-tuple of the session from the master node of the second SPG, and encapsulating it with the first original message to generate a second tunnel message, includes: the master node in the first SPG establishing a new session and determining the second SPG based on the hash calculation of the 5-tuple of the new session; sending a first User Datagram Protocol (UDP) message to the master node of the second SPG, the first UDP message carrying the forward flow 5-tuple; and receiving a second UDP message fed back by the master node of the second SPG, the second UDP message including the reverse flow 5-tuple of the new session.

[0015] The master node in the first SPG encapsulates the reverse flow 5-tuple of the newly created session with the first original message to generate the second tunnel message.

[0016] In conjunction with the second aspect, in another possible implementation of the second aspect, after the master node in the first SPG receives the second UDP message fed back by the master node of the second SPG, it further includes: the master node in the first SPG sending a first session message to the slave node in the first SPG, the first session message being used to instruct the slave node in the first SPG to back up the session.

[0017] In conjunction with the second aspect, in another possible implementation of the second aspect, the method further includes: after receiving a tunnel message from the outside or inside, the master node in the first SPG decapsulates the tunnel message and updates the local session information; and sends an update message containing the updated local session information to the slave node in the first SPG.

[0018] In conjunction with the second aspect, in another possible implementation of the second aspect, the method further includes: the master node in the first SPG sending a first heartbeat message to the slave node in the first SPG, and / or sending a second heartbeat message to the master node in the second SPG; wherein the first heartbeat message is used to keep the session between the master node and the slave node in the first SPG active, and the second heartbeat message is used to keep the session between the master node in the first SPG and the master node in the second SPG active.

[0019] Thirdly, this disclosure also discloses a session processing method applied to another slow processing group (SPG) node in the second network layer of a load balancing system, such as the master node in the second SPG. The method includes:

[0020] The master node in the second SPG receives a first User Datagram Protocol (UDP) message sent by the master node in the first SPG. The first UDP message includes a forward flow 5-tuple. The master node then establishes a new session based on the forward flow 5-tuple, obtains the reverse flow 5-tuple of the new session, generates a second UDP message, which includes the reverse flow 5-tuple of the new session, and sends the second UDP message to the master node in the first SPG.

[0021] In conjunction with the third aspect, in one possible implementation of the third aspect, the method further includes: the master node in the second SPG sending a second session message to the slave node in the second SPG, the second session message being used to instruct the slave node in the second SPG to back up the newly created session.

[0022] In conjunction with the third aspect, in another possible implementation of the third aspect, the method further includes: the master node in the second SPG receiving the third tunnel message sent by the first node; decapsulating the third tunnel message and searching for a local session based on the 5-tuple of the parsed first original message; if found, sending the reverse flow 5-tuple of the found session to the master node of the first SPG, so that the master node of the first SPG generates a fourth tunnel message based on the reverse flow 5-tuple and the first original message.

[0023] In conjunction with the third aspect, in another possible implementation of the third aspect, the method further includes: the master node in the second SPG receiving a second heartbeat message sent from the master node in the first SPG, the second heartbeat message being used to keep the session between the master node in the first SPG and the master node in the second SPG active; the master node in the second SPG sending a third heartbeat message to the slave node in the second SPG, the third heartbeat message being used to keep the session between the master node in the second SPG and the slave node in the second SPG active.

[0024] Fourthly, embodiments of this disclosure also disclose a session processing apparatus, the apparatus comprising:

[0025] The first sending module is used to send a first tunnel message to the master node in the first slow processing group (SPG) of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside.

[0026] The first receiving module is used to receive the second tunnel message fed back by the master node based on the positive flow 5-tuple;

[0027] The first processing module parses the second tunnel packet to obtain the reverse flow 5-tuple and the first original packet. It then locates the session based on the first original packet and completes the reverse flow 5-tuple for the found session. Finally, it performs address translation on the first original packet using the completed reverse flow 5-tuple to generate the second original packet.

[0028] The first sending module is also used to send the second raw message.

[0029] Fifthly, embodiments of this disclosure also disclose a session processing apparatus, the apparatus comprising:

[0030] The second receiving module is used to receive the first tunnel message sent by the first node in the first layer network;

[0031] The second processing module is used to decapsulate the first tunnel packet to obtain the first original packet, which includes a forward flow 5-tuple; search for a matching session in the local session list based on the forward flow 5-tuple; and encapsulate the reverse flow 5-tuple of the matched session with the first original packet to generate the second tunnel packet; or, encapsulate the reverse flow 5-tuple of a session that was not found but received from the master node of the second SPG with the first original packet to generate the second tunnel packet.

[0032] The second sending module is also used to send a second tunnel message to the first node.

[0033] Sixthly, embodiments of this disclosure also disclose a session processing apparatus, characterized in that the apparatus includes:

[0034] The third receiving module is used to receive the first User Datagram Protocol (UDP) message sent by the master node in the first Slow Processing Group (SPG). The first UDP message includes a forward flow 5-tuple.

[0035] The third processing module is used to create a new session based on the forward flow 5-tuple, obtain the reverse flow 5-tuple of the new session, and generate a second UDP packet, which includes the reverse flow 5-tuple of the new session.

[0036] The third sending module is used to send the second UDP packet to the master node in the first SPG.

[0037] In a seventh aspect, embodiments of this disclosure also disclose an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform a session processing method as described in any of the embodiments of the first to third aspects.

[0038] In addition, this disclosure also discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a session processing method as described in any of the first to third aspects.

[0039] Eighthly, this disclosure also discloses a load balancing system, the system including a first network layer and a second network layer, the first network layer and the second network layer being tunneled together, the first network layer including a first node, and the second network layer including at least one slow processing group (SPG), wherein...

[0040] The first node sends a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside.

[0041] The master node in the first SPG receives the first tunnel message sent by the first node, decapsulates the first tunnel message to obtain the first original message, which includes a forward flow 5-tuple; searches for a matching session in the local session list based on the forward flow 5-tuple; encapsulates the reverse flow 5-tuple of the matching session with the first original message to generate a second tunnel message; and combines the first original message with the encapsulated second tunnel message to generate the second tunnel message, and sends the second tunnel message to the first node.

[0042] The first node receives and parses the second tunnel message, obtaining the reverse flow 5-tuple and the first original message. It then searches for the session based on the first original message, completes the reverse flow 5-tuple for the found session, and uses the completed reverse flow 5-tuple to perform address translation on the first original message to generate the second original message, which is then sent.

[0043] The method, apparatus, device, and system provided in this embodiment are designed with a two-layer network structure. The first network layer is responsible for packet processing tasks, and the second network layer is responsible for session management and backup. Compared with the existing method that performs packet processing and session management / backup on one layer, this method is not limited by the traditional single-layer network, that is, it is not limited by the number of sessions originally deployed in a cluster and the memory size of a single node. Therefore, this method includes multiple SPGs in the second network layer, which supports the number of sessions under high availability to increase linearly with the number of nodes.

[0044] Furthermore, compared to the original single-layer network structure, it is impossible to containerize the deployment of access gateways (GWs) to support session high availability because each GW container has less memory available after containerizing a single GW node. The method of this disclosure allows for containerized GW deployment that supports session high availability. Simultaneously, the number of new connections per second also supports linear growth with the number of nodes. Attached Figure Description

[0045] Figure 1 A schematic diagram of a load balancing cluster provided in an embodiment of this disclosure;

[0046] Figure 2 A schematic diagram of another load balancing cluster provided in an embodiment of this disclosure;

[0047] Figure 3 A flowchart of a session processing method provided in an embodiment of this disclosure;

[0048] Figure 4 A signaling flowchart for forward message processing is provided as an embodiment of this disclosure;

[0049] Figure 5 A signaling flowchart for reverse message processing provided in this embodiment of the disclosure;

[0050] Figure 6 A signaling flowchart for session keep-alive provided in an embodiment of this disclosure;

[0051] Figure 7 Another signaling flowchart for session keep-alive provided in this embodiment of the disclosure;

[0052] Figure 8 This is a structural block diagram of a session processing apparatus provided in an embodiment of the present disclosure;

[0053] Figure 9 A structural block diagram of another session processing apparatus provided in an embodiment of this disclosure;

[0054] Figure 10 A structural block diagram of another session processing apparatus provided in the embodiments of this disclosure;

[0055] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0056] The technical solutions of this disclosure will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0057] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0058] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment". Furthermore, it should be noted that the modifications of "one" and "a plurality of" as used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless explicitly indicated in the context, they should be understood as "one or more".

[0059] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0060] In the following embodiments, each embodiment provides optional features and examples. The various features described in the embodiments can be combined to form multiple optional solutions. Each numbered embodiment should not be regarded as only one technical solution. Furthermore, unless otherwise specified, the embodiments and features in the embodiments of this disclosure can be combined with each other.

[0061] First, the application scenarios of the technical solution disclosed herein will be introduced.

[0062] Figure 1 This diagram illustrates a load balancing cluster provided in an embodiment of this disclosure. The Layer 4 load balancer access gateway (GW) serves as the entry point for Layer 4 access and is deployed in a cluster within a ToR (Top of Rack). Considering high availability (HA), a separate cluster can be deployed under each ToR. For example... Figure 1 As shown, node A0 and node A1 form cluster A, which is deployed under ToR A; node B0 and node B1 form cluster B, which is deployed under ToR B.

[0063] In practical applications, a cluster typically contains at least two nodes. Furthermore, the same Virtual Internet Protocol (VIP) based on Border Gateway Protocol (BGP) is deployed across two clusters, A and B, meaning nodes A0, A1, B0, and B1 are all deployed on the same VIP. Each node's internal network side deploys a Local Internet Protocol (LIP) interface for the load balancer, dedicated to transmitting messages for establishing and closing sessions, as well as negotiation messages. For example, node A0 deploys LIP0, and node A1 deploys LIP1. Clusters A and B constitute a cross-ToR cluster, and are connected to the same cluster of business servers.

[0064] The upstream ToR of the access gateway (GW) distributes packets to each GW based on the packet's five-tuple hash, ensuring that packets from the same session are always distributed to the same GW node. However, this "full cluster synchronization" scheme has a drawback: as the number of sessions increases linearly, the number of sessions in a cluster is limited by the memory size of a single node. Figure 1 There is only one gateway layer, so it cannot meet the requirement of increasing the number of sessions for the following reasons:

[0065] Adding a pair of Gateway nodes (GW) to the cluster, such as GW-C0 / 1, will inevitably cause the upstream ToR to distribute packets from some existing sessions on GW-A0 / 1 and GW-B0 / 1 to GW-C0 / 1. These packets may not find a session on GW-C0 / 1, be dropped (e.g., to prevent TCP SYN packets from creating new sessions), or be distributed to the wrong backend service server (Real Server, RS). For example, when the GW is scaled up, the RS is also scaling up. Even if TCP SYN packets allow new sessions and the GW uses the Maglev algorithm to select the backend RS, the packets may still be distributed to a different RS than the one associated with the original session. Therefore, to ensure lossless service traffic, it is necessary to calculate which existing sessions on GW-A0 / 1 and GW-B0 / 1 should be backed up before GW-C0 / 1 receives traffic. However, this cannot be done because the algorithm used by the upstream ToR to distribute packets is unknown. Furthermore, considering the different ToR vendors, a packet distribution layer needs to be added to shield the packet distribution details of this ToR layer.

[0066] Therefore, in the application scenario of the disclosed technical solution, a "fast message processing layer" (aka. FP Layer, FPL) is introduced between the physical ToR and GW. The GW layer is responsible for the high availability management of the session and the allocation, backup and reclamation of the resources (LIP / LPORT) used by the session. The GW layer can also be regarded as a "slow message processing layer" (aka. SP Layer, SPL).

[0067] like Figure 2 The diagram shown is a schematic of a load balancing cluster provided in an embodiment of this disclosure. For example, a load balancing system includes a first network layer and a second network layer, which are tunneled together. The first network layer is a Fast Packet Processing Layer (FPL), and the second network layer is a Slow Packet Processing Layer (SPL).

[0068] For ease of discussion, each pair (or group) of Gateways is considered a Slow Processing Group (SPG). Optionally, an SPG may contain two Service Provider (SP) nodes, or a pair of SP nodes, with each Gateway considered an SP node, such as... Figure 2As shown, the Slow Packet Processing Layer (SPL) includes a first SPG and a second SPG, such as SPG-A and SPG-B. SPG-A includes two nodes, SP-A0 and SP-A1, one of which is the master node and the other is the slave node. Similarly, SPG-B includes two nodes, SP-B0 and SP-B1. It should be understood that the SPL layer may include more or fewer SPGs; this embodiment does not impose any limitations on this.

[0069] The FPL (Fast Processing Layer) includes at least one node, such as FP-A0, FP-A1, FP-A2, and FP-A3.

[0070] like Figure 2 In the example, the second network layer SPL is deployed under two ToRs. For instance, if one ToR-A loses power, the traffic can be taken over by the other ToR-B, thus ensuring no loss of service and improving system reliability.

[0071] In this embodiment, the two SP nodes of an SPG can be deployed under two ToRs respectively. For example, SP-A0 of SPG-A is deployed under ToR-A, and SP-A1 of SPG-A is deployed under ToR-B. The FP calculates the hash value of the 5-tuple of the received packet, A = hash(5-tuple of the packet) mod N, and distributes the packet to the master node of SPG-A, such as SPG-A0. If SPG-A0 fails, the packet is distributed to the slave node of SPG-A, such as SPG-A1.

[0072] Example 1

[0073] Figure 3 This is a flowchart illustrating a session processing method provided in an embodiment of the present disclosure. This method is applicable to the aforementioned... Figure 2 The load balancing system shown. This method can be executed by a first node in a first network, such as FP-A0, wherein the first node can be implemented by software and / or hardware, and the first node includes, but is not limited to, an access gateway or a load balancer.

[0074] The method includes:

[0075] Step 101: The first node sends a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes the forward flow quintuple of the first original message from the outside.

[0076] The first external original packet can originate from the router. After passing through the ToR-A, the first external original packet first reaches the first node FP-A0. FP-A0 encapsulates the first external original packet into a first tunnel packet, such as an IPTunnel or VXLAN (Virtual eXtensible Local Area Network) packet, and then sends the first tunnel packet to the master node in SPG-A, such as SP-A0. The SP-A0 is selected based on the forward flow 5-tuple carried in the first original packet.

[0077] Step 102: The first node receives the second tunnel message fed back by the master node based on the positive flow 5-tuple.

[0078] After receiving the first tunnel message, the master node SP-A0 in SPG-A decapsulates it, then creates a new master-slave session based on the forward flow 5-tuple of the original first original message, allocates and backs up the LPORT, and encapsulates the original first original message along with the reverse flow 5-tuple of the newly created session in a tunnel message to generate a second tunnel message, which is then sent back to the first node FP-A0. Correspondingly, FP-A0 receives the second tunnel message fed back by SP-A0.

[0079] LPORT corresponds to the local port allocated by GW LIP, and its port range is 1025 to 65535.

[0080] Step 103: The first node parses the second tunnel message to obtain the reverse flow 5-tuple and the first original message, searches for the session based on the first original message, and completes the reverse flow 5-tuple of the found session.

[0081] After receiving the second tunnel message, the first node FP-A0 decapsulates it to obtain the reverse flow quintuple and the first original message. Based on the first original message, it finds the session and completes the reverse flow quintuple of the found session.

[0082] Step 104: The first node uses the padded reverse flow 5-tuple to perform address translation on the first original message, generates the second original message, and sends the second original message.

[0083] Address translation processing specifically refers to Full-NAT (FNAT) processing. FNAT is one of the deployment methods for Gateway (GW), which performs both SNAT and DNAT processing on packets. Specifically, SNAT refers to source address / source port translation for packets; DNAT refers to destination address / destination port translation for packets.

[0084] The first node FP-A0 uses the padded reverse flow 5-tuple to perform FNAT on the first original packet, generates the second original packet, and then sends the second original packet back to the backend business server RS ​​or the client CLIENT.

[0085] It should be noted that in this embodiment, each FP's internal network interface is configured with one or more LIPs (local IPs configured on the GW's internal network interface), and these LIPs do not overlap with those configured on other FPs. For example, FP-A0 is configured with LIP0 to ensure that reverse flow packets of sessions on FP-A0 are only routed to FP-A0.

[0086] In addition, each FP in the FPL processes messages quickly. Upon receiving an external message, it decapsulates it to obtain the five-tuple information of the message inside, and searches the local session table (finding the target session in the local session table based on the five-tuple information). If the target session is found, it performs FNAT or reverse FNAT on the message based on the found session, and then sends the message to the RS or CLIENT. Otherwise, it encapsulates the message in a tunnel message and sends the tunnel message to the master node of a selected SPG.

[0087] The method provided in this embodiment designs a two-layer network structure, in which the first network layer is responsible for packet processing tasks and the second network layer is responsible for session management and backup. Compared with the existing method that performs packet processing and session management / backup on one layer, this method is not limited by the traditional single-layer network, that is, it is not limited by the number of sessions originally deployed in a cluster and the memory size of a single node. Therefore, this method includes multiple SPGs in the second network layer, which supports the number of sessions under high availability to increase linearly with the number of nodes.

[0088] Furthermore, compared to the original single-layer network structure, containerized deployment of the Gateway (GW) cannot support session high availability because each GW container has less memory available after containerizing a single GW node. The method of this disclosure allows for containerized GW deployment that supports session high availability. Simultaneously, the number of new connections per second (CPS) also supports linear growth with the number of nodes.

[0089] In the second network layer, an SPL contains at least one SPG, and each SPG can contain two SPs; for example, SPG-A contains two nodes, SP-A0 and SP-A1.

[0090] Each SP in an SPL has the same LIP Pool (the local IP pool configured on the GW internal network interface), such as LIPPool1, which contains LIP0 to 3. However, the LPORT range allocated to each LIP by each SPG does not overlap. For example, the port range allocated to LIP0 on SP-A{0|1} is 10001 to 20000, and the port range allocated to LIP0 on SP-B{0|1} is 20001 to 30000.

[0091] For ease of discussion, let's assume each SPG operates in "primary-secondary mode." FP (Flying Processor) always distributes messages to the primary node of an SPG. If the primary node fails, FP distributes messages to the secondary node of that SPG. Within the same SPG, the primary node is responsible for creating new sessions and backing them up to the secondary nodes. The primary node is also responsible for keeping the primary-secondary sessions and bidirectional master-slave flows alive. The secondary nodes, on the other hand, are responsible for creating new secondary sessions and bidirectional slave flows.

[0092] Similarly, SPGs can also operate in "primary-primary mode," where port resources are evenly distributed within an SPG. For example, if SPG-A allocates ports 10001 to 20000 to LIP0, then ports 10001 to 15000 on SP-A0 are used for establishing new sessions, while ports 15001 to 20000 are used to back up ports for establishing new sessions on SP-A1. Likewise, ports 10001 to 15000 on SP-A1 are used to back up ports for establishing new sessions on SP-A0, while ports 15001 to 20000 are used for establishing new sessions. FPs can distribute packets to a single node within an SPG based on the packet hash value.

[0093] In addition, both FP and SP are deployed in containers, and the management platform is used to orchestrate FP and SP.

[0094] Example 2

[0095] This embodiment provides a detailed description of the method in Embodiment 1 above. The GW packet processing includes packet processing flows in two directions. For generalization, FNAT is used as an example. FNAT includes SNAT+DNAT, where SNAT (Source Network Address Translation, performs source address or source port translation on the packet) and DNAT (Destination Network Address Translation, performs destination address or destination port translation on the packet).

[0096] Furthermore, Source Bi-Directional Flows, also known as the forward and reverse flows of the main session, are simply referred to as the main forward flow and the main reverse flow. The main forward flow (Source Forward Flow) refers to the forward flow of the main session, and the main reverse flow (Source Reverse Flow) refers to the reverse flow of the main session. For FNAT, the specific process of establishing and backing up sessions at the SP in the second network layer is as follows:

[0097] Forward flow: CIP / CPORT->VIP / VPORT; Reverse flow: RIP / RPORT->LIP / LPORT.

[0098] In this context, CIP represents the external client IP address, CPORT represents the client port used to initiate the session, VIP represents the virtual service IP address, and VPORT represents the virtual service port. The "->" symbol indicates a pointing arrow. Similarly, in the reverse flow, RIP represents the internal server IP address, RPORT represents the internal server port; LIP (Local IP) represents the load balancer's internal IP address, i.e., the local IP address configured on the GW's internal network port; and LPORT (Local Port) represents the load balancer's internal port number, i.e., the local port assigned by the GW's LIP, typically ranging from 1025 to 65535.

[0099] Before sending a message, the message format between each layer must be defined according to the following rules for sending and receiving:

[0100] 1. Messages between FPL and SPL are always tunnel messages (IP tunnel or VXLAN messages).

[0101] 2. Messages between SPs are ordinary UDP (User Datagram Protocol) messages, but they contain the original message and session metadata (e.g., the entry point of the original message). The "HASession Creation Message" and "HA Flow Creation Message" between SPs are also ordinary UDP messages, containing only session information or reverse flow information.

[0102] 3. The reverse flow messages sent directly from the backend business server RS ​​to FPL are always ordinary (underlay) messages, and their headers are (Protocol, RIP / RPORT->LIP / LPORT).

[0103] Furthermore, FP and SP use the same hash algorithm, such as Maglev. FP is used to select SP to create or resume a session, and SP is used to select the master node for the reverse flow. The following is a detailed process of how a forward flow message establishes a session and the corresponding reverse flow.

[0104] First, the forward packet processing flow.

[0105] Before sending forward message processing, the management platform first sends SPG global configuration information to each FP node or SP node. After the global configuration information is sent, the forward message processing flow is executed. In this embodiment, the first node is FP-A0 of the first network layer, the master node in the first SPG is SP-A0 of the second network layer, and the slave node is SP-A1. The master node in the second SPG is SP-B0 of the second network layer, and the slave node is SP-B1.

[0106] Specifically, such as Figure 4 As shown, the method includes the following steps:

[0107] Step 201: The first node FP-A0 receives the first original message sent by the client. The first original message is also called the original message and includes a 5-tuple of the forward flow.

[0108] Step 202: The first node FP-A0 searches for the local session based on the content of the first original message.

[0109] Specifically, the first node FP-A0 searches for a local session based on the forward flow 5-tuple in the first original packet. If a session is found, it performs FNAT processing on the first original packet locally and then sends the processed packet to the RS. If no session matching the local session list is found, the first node FP-A0 creates a new session, which includes the forward flow 5-tuple. Specifically, the new session created by the first node FP-A0 contains the following information: the forward flow 5-tuple: Protocol, CIP / CPORT, VIP / VPORT. Additionally, the master node of the session in the second network layer is determined. Assuming the master node is determined to be the SP-A0 IP of SPG-A, step 203 is executed.

[0110] Step 203: The first node FP-A0 constructs the first UDP packet and encapsulates the first UDP packet into a first tunnel packet, such as a VXLAN packet.

[0111] The first UDP packet contains the following information: the newly created node of the main session: SP-A0 IP, the five-tuple of the reverse flow: Protocol, RIP / RPORT->LIP0 / LPORT0, and the first original packet. In this embodiment, the first UDP packet includes: the entry point of the first original packet: FP-A0 IP, LIP Pool ID: FP-A0 configures a LIP Pool containing LIP0 to 3, and the first original packet, the header of which is (Protocol, CIP / CPORT->VIP / VPORT).

[0112] Step 204: The first node FP-A0 sends the first tunnel message to the master node SP-A0 of the second network layer SPG-A.

[0113] Step 205: SP-A0 receives the first tunnel message and decapsulates the first tunnel message to obtain the first original message, which includes a forward flow quintuple.

[0114] Step 206: SP-A0 searches for a matching session in the local session list based on the forward flow 5-tuple contained in the first original message; and determines whether a matching session exists.

[0115] If a matching session exists, SP-A0 retrieves the reverse flow quintuple from the found session, encapsulates the reverse flow quintuple along with the original first original message in a tunnel message, and sends it back to the first node FP-A0. If no matching session exists, proceed to step 207.

[0116] Step 207: If no matching session is found, SP-A0 searches for a matching session with the master node SP-B0 of SPG-B. SP-B0 searches for a matching session in its local session list and obtains the reverse flow quintuple from the found session. SP-B0 then sends the reverse flow quintuple of the session to SP-A0.

[0117] Specifically, SP-A0 selects a LIP and allocates a LPORT from the corresponding LIP Pool in RR mode according to the LIP Pool ID of the constructed message, such as LIP0 / LPORT0; and selects RS / RPORT according to the load balancing scheduling algorithm, and finally creates a new session and obtains the quintuple of the reverse flow from the searched session.

[0118] The newly created session in SP-A0 includes the following information: the bidirectional stream 5-tuple of the newly created session, such as:

[0119] -Protocol,CIP / CPORT->VIP / VPORT, Protocol,RIP / RPORT->LIP / LPORT;

[0120] - Entry point for session-related messages: FP-A0 IP;

[0121] - The main node for the reverse flow of the session: SP-B0 IP, etc.

[0122] Then, SP-A0 forwards this construct message to the master node of SPG-B, that is, sends it to SP-B0, so as to obtain reverse flow information from SP-B0.

[0123] For example, SP-A0 determines SP-B0 based on the five-tuple information of the newly established second session, and encapsulates the second original message into a first UDP message. SP-A0 then sends the first UDP message to SP-B0. After receiving the first UDP message, SP-B0 establishes the reverse flow of the second session and sends the second original message to SP-A0 via the second UDP message.

[0124] In step 208, SP-A0 receives the reverse flow quintuple found by SP-B0, or, in the determination in step 206, directly obtains the reverse flow quintuple and encapsulates the reverse flow quintuple and the first original message to generate the second tunnel message.

[0125] Specifically, after SP-A0 receives the second UDP packet, it parses the second UDP packet and encapsulates it into a second tunnel packet.

[0126] Step 209: SP-A0 sends the second tunnel message to the first node FP-A0.

[0127] Step 210: After receiving the second tunnel message, the first node FP-A0 parses the second tunnel message to obtain the reverse flow quintuple and the external first original message. The first node FP-A0 then searches for the session based on the first original message and completes the reverse flow quintuple of the found session.

[0128] Step 211: The first node FP-A0 performs FNAT processing on the original first original packet based on the five-tuple of the padded reverse flow to generate the second original packet.

[0129] Specifically, after the first node FP-A0 receives the second tunnel message, it decapsulates it to obtain the constructed message inside. Based on the first original message contained therein, it searches for the session and completes the reverse flow information of the found session. Then, it extracts the first original message from the constructed message and performs FNAT processing on the original first original message based on the five-tuple of the reverse flow to generate the second original message. The header of the second original message is Protocol,LIP0 / LPORT0->RIP / RPORT.

[0130] Step 212: The first node FP-A0 sends the second raw message to RS.

[0131] In this embodiment, the session on the master node SP-A0 of the first SPG in the SPL layer has no reverse flow 5-tuple due to long-term disuse or aging. The reverse flow 5-tuple is stored on the master node SP-B0 of the second SPG after being searched. Therefore, step 207 sends a request to SP-B0 to obtain the reverse flow 5-tuple of the session.

[0132] In one specific implementation of this embodiment, step 202 further includes: the first node FP-A0 selecting a first SPG from at least one SPG in the second network layer. Specifically, the first node FP-A0 selects the first SPG from at least one SPG based on the 5-tuple hash value of the first original packet. One implementation for determining the first SPG is that the first node FP-A0 calculates the hash of the 5-tuple of the first original packet, for example, A = hash(5-tuple of the packet) mod N, and selects the first SPG from N SPGs, where N ≥ 1 and is a positive integer, and then determines the master node in the first SPG, for example, determining the first SPG as SPG-A and the master node as SP-A0.

[0133] In another embodiment of this example, step 207 above further includes: after receiving the construction message sent by the master node SP-B0 of the first SPG, the master node SP-B0 in the second SPG establishes a reverse flow for this session, and then sends the message back to SP-A0.

[0134] Simultaneously, the master node SP-B0 in the second SPG sends an "HA Flow CreateMessage" to the slave node SP-B1 in the second SPG. This HA Flow CreateMessage contains only the reverse flow 5-tuple information, and its purpose is to instruct the slave node SP-B1 to back up the reverse flow 5-tuple of this session. Correspondingly, after receiving the HA Flow CreateMessage from the master node SP-B0, the slave node SP-B1 backs up the reverse flow 5-tuple of the newly created session locally. At this time, only the reverse flow 5-tuple information of the session is backed up on the slave node SP-B1 side.

[0135] The reverse flow information created by the master node SP-B0 of the second SPG includes the following: the five-tuple of the reverse flow: Protocol, RIP / RPORT->LIP0 / LPORT0; the master node of the session: SP-A0 IP.

[0136] The UDP packet constructed by SP-B0 contains the following information: the five-tuple of the reverse flow: Protocol, RIP / RPORT->LIP0 / LPORT0; the original packet, i.e. the first original packet in step 201 above.

[0137] In step 208 above, after the master node SP-A0 of the first SPG receives the construction message from SP-B0, it encapsulates it in a tunnel message to generate the second tunnel message and sends it to the first node FP-A0.

[0138] Simultaneously, the master node SP-A0 of the first SPG sends a first session message to the slave node SP-A1 of the first SPG. The first session message is an HA Session Create Message, used to instruct the slave node SP-A1 to back up this session. After receiving the HA Session Create Message from the master node SP-A0, the slave node SP-A1 backs up the bidirectional 5-tuple of the first original packet.

[0139] In this embodiment, during the forward message processing, such as Figure 4 As shown, the first message transmission path of the session from the first original message from the outside is: first node FP-A0→SP-A0→SP-B0→SP-A0→FP-A0, which goes through 4 hops.

[0140] The method provided in this embodiment designs a two-layer network structure. Node FP-A0 in the first network layer is responsible for packet / message processing, while nodes SP-A0 / SP-A1 and SP-B0 / SP-B1 in the second network layer are responsible for session management and backup. The slave node SP-A1 or SP-B1 in the second network layer backs up the master node's newly created session information, avoiding the creation and backup of new sessions on the same network layer. This method supports linear growth in the number of sessions with the number of nodes under high session availability, and is not limited by traditional single-layer networks. Furthermore, the technical solution provided in this embodiment also supports high session availability when containerizing and deploying the Gateway.

[0141] Example 3

[0142] Compared to Embodiment 2, this embodiment mainly describes the reverse processing flow of the message, that is, the process of sending a reverse message (Reverse packet) from RS.

[0143] In the above embodiment 2, when the first node FP-A0 searches for a session based on the first original message, it further includes: when the first node FP-A0 does not find a matching session based on the first original message, it determines a second SPG in at least one SPG in the second network layer and sends a third tunnel message to the master node of the second SPG, wherein the third tunnel message carries the content of the first original message.

[0144] The master node in the second SPG receives the third tunnel message sent by the first node FP-A0, decapsulates the third tunnel message, and searches for the local session based on the five-tuple of the parsed first original message. If found, it sends the reverse flow five-tuple of the found session to the master node of the first SPG, so that the master node of the first SPG can generate a fourth tunnel message based on the reverse flow five-tuple and the first original message, and send the fourth tunnel message to the first node FP-A0.

[0145] The first node FP-A0 receives the fourth tunnel message sent by the master node of the first SPG. The fourth tunnel message includes the first original message and the reverse flow 5-tuple. The reverse flow 5-tuple is used to complete the 5-tuple information of the session.

[0146] Specifically, in one example, by Figure 5 As shown, the reverse message processing flow includes:

[0147] Step 301: The RS sends a reverse message, which carries the following five-tuple information: Protocol, RIP / RPOT->LIP0 / LPORT0;

[0148] Furthermore, the message is sent directly to the first network layer (FPL) without passing through the second network layer (SPL). The switch routes the message to the first node (FP-A0) based on the destination address (LIP0).

[0149] Step 302: After receiving the message, the first node FP-A0 searches for the previously established session locally based on the reverse message.

[0150] If a session can be found, this message is processed using reverse FNAT to generate a new message, such as a third message. The header of this third message becomes (Protcol,VIP / VPORT->CIP / CPORT), and then the third message is sent to the client.

[0151] If no session is found, the process is as follows: If a corresponding session still exists on the second network layer (SPL), the session is restored on FP-A0; otherwise, the packet is discarded on the SPL. The specific processing flow is as follows:

[0152] RS sends a message to the first node FP-A0. This message contains a 5-tuple of information (Protcol, RIP / RPORT->LIP0 / LPORT0). After receiving the message, FP-A0 searches for the local session. If no session is found, it calculates the hash of the 5-tuple of the message, B = hash(5-tuple of the packet) mod N, selects the master node SP-B0 in SPG-B, and constructs a UDP message.

[0153] Step 303: The first node FP-A0 encapsulates the constructed UDP packet in a tunnel packet to form a third tunnel packet, and then sends the third tunnel packet to the master node of SPG-B, i.e., SP-B0.

[0154] The UDP packet constructed by FP-A0 contains the following information:

[0155] The entry point for the first original message: FP-A0 IP;

[0156] The first original message has the header (Protocol, RIP / RPORT->LIP / LPORT).

[0157] Step 304: After receiving the third tunnel message, the master node SP-B0 decapsulates it to obtain the 5-tuple of the first original message inside. It then searches for the local session based on the 5-tuple of the first original message. If the session is found, the reverse flow 5-tuple is obtained. If not found, the message is discarded.

[0158] Step 305: Master node SP-B0 constructs a UDP packet containing the five-tuple of the reverse flow and forwards the constructed packet to the owner of the reverse flow's corresponding session, master node SP-A0 of SPG-A.

[0159] Step 306: After receiving the UDP packet constructed by SP-B0, the master node SP-A0 of SPG-A decapsulates it and searches the local session table based on the five-tuple of the first original packet. If a session is found, a UDP packet is constructed and encapsulated in a tunnel packet to generate the fourth tunnel packet.

[0160] The UDP packet constructed by SP-A0 contains the following information:

[0161] - The quintuple for the flow: (Protocol, CIP / CPORT -> VIP / VPORT);

[0162] - First original message.

[0163] Additionally, if no matching session is found for SP-A0 during this step, the message is discarded.

[0164] Step 307: SP-A0 sends the fourth tunnel message to the first node FP-A0.

[0165] Step 308: After receiving the fourth tunnel message, the first node FP-A0 decapsulates it, extracts the original message (such as the first original message), restores the session information corresponding to this message, and then performs reverse FNAT processing on the original message. After processing, the message header of the generated message becomes (VIP / VPORT->CIP / CPORT).

[0166] Step 309: The first node FP-A0 sends the message processed in step 308 to the client.

[0167] This embodiment provides a reverse message processing flow. In this reverse message processing, when the reverse flow 5-tuple is found in the master node SP-B0 of an SPG in the SPL layer, the reverse flow 5-tuple is sent to the owner of the session corresponding to the reverse flow, namely SP-A0, so that the reverse flow information is supplemented on SP-A0. Finally, the constructed UDP packet is encapsulated into a tunnel packet and forwarded to the first node FP-A0 to complete the reverse message processing.

[0168] Example 4

[0169] This embodiment also provides a method for session keep-alive, which is used to maintain the sessions of nodes in each SPG group in the second network layer, so as to keep the sessions and reverse flows alive.

[0170] Specifically, taking the master-slave node in the aforementioned embodiment as an example, the method includes:

[0171] The master node SP-A0 in the first SPG sends a first heartbeat message to the slave node SP-A1 in the first SPG, and / or, the master node SP-A0 in the first SPG sends a second heartbeat message to the master node SP-B0 in the second SPG. The first heartbeat message is used to keep the session between the master node SP-A0 and the slave node SP-A1 in the first SPG active, and the second heartbeat message is used to keep the session between the master node SP-A0 in the first SPG and the master node SP-B0 in the second SPG active.

[0172] In addition, the method further includes: the master node SP-B0 in the second SPG receiving a second heartbeat message sent from the master node SP-A0 in the first SPG, and / or, the master node SP-B0 in the second SPG sending a third heartbeat message to the slave node SP-B1 in the second SPG, the third heartbeat message being used to keep the session between the master node SP-B0 in the second SPG and the slave node SP-B1 in the second SPG active.

[0173] In a specific example, each session on the first node FP-A0 periodically sends an "update message," which is encapsulated in a tunnel message and sent to the master node of SPG-A, i.e., SP-A0. This "update message" is used to update the corresponding master session on SP-A0. Furthermore, the purpose of reporting the "update message" is to keep the master session on SP-A0 active.

[0174] Specifically, such as Figure 6 As shown, the method includes:

[0175] Step 1: FP-A0 updates the statistics of the master session, such as the number of inbound and outbound packets and PPS, and sends an update packet to SP-A0.

[0176] Specifically, FP-A0 encapsulates the update message in a tunnel message and sends it to SP-A0 through the tunnel message.

[0177] Step 2: After receiving a tunnel message from an external or internal source, SP-A0 decapsulates the tunnel message and updates its local session information. If no corresponding session is found on SP-A0, the session can be restored using this "update message". The restoration can be partial because LRU is used at the FPL layer, and not all sessions on SP-A0 are backed up on the FPL.

[0178] Step 3: After receiving the tunnel message sent by FP-A0, SP-A0 decapsulates it to obtain the five-tuple of the session, and uses the five-tuple to update the local session information (source session update), and then sends the update message inside to the slave node SP-A1 in the same group.

[0179] Step 4: After receiving the update message sent by the master node SP-A0, the slave node SP-A1 updates the replica session on it. This backup is used to prevent the master node SP-A0 from crashing. Since the slave node SP-A1 has the statistical data of the backup session, the session can still be maintained through the backup data of the slave node SP-A1 when the master node SP-A0 crashes / fails.

[0180] This embodiment is a session backup for two nodes within the same SPG group, initiated by FP-A0. The session update for slave node SP-A1 is initiated by the master node SP-A0 of its group.

[0181] Additionally, session backup and keep-alive can be initiated within different SPG groups, such as... Figure 7 As shown, the method includes the following:

[0182] Each master session is the source of heartbeat messages, so the master node of the SPG group, such as SP-A0, actively updates the master session by sending timed heartbeat messages to other SPG groups within the group and to update the reverse flow between the slave session and the master-slave session.

[0183] For example, the master node SP-A0 sends a heartbeat message, such as the first heartbeat message, to the slave node SP-A1 in its group. After receiving the first heartbeat message, SP-A1 updates the replica session. Here, "source" represents the master and "replica" represents the slave.

[0184] In addition, master node SP-A0 also sends another heartbeat message, such as a second heartbeat message, to master node SP-B0 in group SPG-B. After receiving the second heartbeat message, SP-B0 refreshes the source reverseflow of the master session on it.

[0185] The first heartbeat message sent from SP-A0 to SP-A1 can be an "HA Session creation message"; the second heartbeat message sent from SP-A0 to SP-B0 can be an "HA Flow creation message".

[0186] In this embodiment, the method further includes: after the master node SP-B0 of SPG-B refreshes the master session reverse flow, it also sends a heartbeat message, such as a third heartbeat message, to the slave node SP-B1 in its group. After the slave node SP-B1 receives the third heartbeat message, it refreshes the slave session reverse flow.

[0187] Among them, the third heartbeat message sent by SP-B0 to SP-B1 can be "HA Flow New Creation Message".

[0188] Since the master and slave nodes within each SPG need to know each other's health status, when the master node SP-A0 goes down, the heartbeat source changes to the slave node SP-A1; when SP-A0 comes back online, after a cold synchronization between the master node SP-A0 and the slave node SP-A1, SP-A0 becomes the master node of SPG-A again and resumes being the heartbeat source for the session.

[0189] The message keep-alive method provided in this embodiment realizes session refresh and synchronization through heartbeat messages, which not only keeps the session and reverse flow alive, but also restores the session or reverse flow.

[0190] Example 5

[0191] This disclosure also discloses a session processing apparatus, such as... Figure 8 As shown, the device is used to implement the session processing method in the foregoing embodiments. The device includes a first receiving module 510, a first processing module 520, and a first sending module 530. In addition, the device may include other more or fewer units or structures, which are not limited in this embodiment.

[0192] The first sending module 530 is used to send a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside.

[0193] The first receiving module 510 is used to receive the second tunnel message fed back by the master node based on the forward flow quintuple.

[0194] The first processing module 520 is used to parse the second tunnel message, obtain the reverse flow 5-tuple and the first original message, find the session based on the first original message, and complete the reverse flow 5-tuple of the found session; use the completed reverse flow 5-tuple to perform address translation processing on the first original message to generate the second original message.

[0195] The first sending module 530 is also used to send the second raw message.

[0196] Optionally, in one specific implementation of this embodiment, the first receiving module 510 is further configured to receive a first original message from an external source; the first processing module 520 is further configured to search for a local session based on the content of the first original message; if no matching session is found, a new session is created, and a first SPG is selected from at least one SPG in the second network layer, and a first UDP message is constructed and encapsulated into a first tunnel message.

[0197] Optionally, in another specific implementation of this embodiment, the first processing module 520 is further configured to select a first SPG from at least one SPG based on the quintuple hash value of the first original message.

[0198] Specifically, the second tunnel message is generated by the master node in the first SPG after searching for the session locally, encapsulating the found reverse flow 5-tuple and the first original message; or, the second tunnel message is generated by the master node in the first SPG based on the reverse flow 5-tuple fed back by the master node of the second SPG, and combined with the first original message.

[0199] Optionally, in another specific embodiment of this example, the first processing module 520 is further configured to determine a second SPG in at least one SPG in the second network layer when no matching session is found based on the first original message.

[0200] The first sending module 530 is also used to send a third tunnel message to the master node of the second SPG.

[0201] The first receiving module 510 is also used to receive the fourth tunnel message sent by the master node of the first SPG. The fourth tunnel message includes the first original message and the reverse flow 5-tuple. The reverse flow 5-tuple is used to complete the 5-tuple information of the session.

[0202] In addition, this embodiment also provides another session processing device, such as... Figure 9 As shown, the device is used to implement the session processing method in the foregoing embodiments. The device includes a second receiving module 610, a second processing module 620, and a second sending module 630. In addition, the device may include other more or fewer units or structures, which are not limited in this embodiment.

[0203] The second receiving module 610 is used to receive the first tunnel message sent by the first node in the first layer network.

[0204] The second processing module 620 is used to decapsulate the first tunnel message to obtain the first original message, which includes a forward flow 5-tuple; search for a matching session in the local session list based on the forward flow 5-tuple; and encapsulate the reverse flow 5-tuple of the matched session with the first original message to generate a second tunnel message; or, encapsulate the reverse flow 5-tuple of the session that was not found and received from the master node of the second SPG with the first original message to generate a second tunnel message.

[0205] The second sending module 630 is also used to send a second tunnel message to the first node.

[0206] Optionally, in one specific implementation of this embodiment, the second processing module 620 is specifically used to create a new session and determine the second SPG based on the 5-tuple hash calculation of the new session.

[0207] The second sending module 630 is also used to send a first UDP packet to the master node of the second SPG, the first UDP packet carrying a forward flow quintuple.

[0208] The second receiving module 610 is also used to receive a second UDP packet fed back by the master node of the second SPG, the second UDP packet including the reverse flow quintuple of the newly established session.

[0209] The second processing module 620 is also used to encapsulate the reverse flow 5-tuple of the newly created session and the first original message to generate a second tunnel message.

[0210] Optionally, in another specific embodiment of this example, the second sending module 630 is further configured to send a first session message to the slave node in the first SPG, the first session message being used to instruct the slave node in the first SPG to back up the session.

[0211] Optionally, in another specific embodiment of this example, the second processing module 620 is further configured to decapsulate the tunnel message and update the local session information after receiving the tunnel message from the outside or inside. The second sending module 630 is further configured to send an update message containing updated local session information to the slave node in the first SPG.

[0212] Optionally, in another specific embodiment of this example, the second sending module 630 is further configured to send a first heartbeat message to the slave node in the first SPG, and / or send a second heartbeat message to the master node in the second SPG.

[0213] The first heartbeat message is used to keep the session between the master node and the slave node in the first SPG alive, and the second heartbeat message is used to keep the session between the master node in the first SPG alive and the master node in the second SPG alive.

[0214] Furthermore, this embodiment also provides a session processing device, such as... Figure 10 As shown, the device is used to implement the session processing method in the foregoing embodiments. The device includes a third receiving module 710, a third processing module 720, and a third sending module 730. In addition, the device may include other more or fewer units or structures, which are not limited in this embodiment.

[0215] The third receiving module 710 is used to receive the first UDP packet sent by the master node in the first SPG. The first UDP packet includes a forward flow quintuple.

[0216] The third processing module 720 is used to create a new session based on the forward flow 5-tuple, obtain the reverse flow 5-tuple of the new session, and generate a second UDP packet, which includes the reverse flow 5-tuple of the new session.

[0217] The third sending module 730 is used to send the second UDP packet to the master node in the first SPG.

[0218] Optionally, in one specific implementation of this embodiment, the third sending module 730 is further configured to send a second session message to the slave node in the second SPG, the second session message being used to instruct the slave node in the second SPG to back up the newly created session.

[0219] Optionally, in another specific embodiment of this example, the third receiving module 710 is further configured to receive the third tunnel message sent by the first node.

[0220] The third processing module 720 is also used to decapsulate the third tunnel message and search for the local session based on the five-tuple of the first original message obtained after parsing. If found, the third sending module 730 sends the reverse flow five-tuple of the found session to the master node of the first SPG so that the master node of the first SPG can generate the fourth tunnel message based on the reverse flow five-tuple and the first original message.

[0221] Optionally, in another specific embodiment of this example, the third receiving module 710 is further configured to receive a second heartbeat message sent from the master node of the first SPG, the second heartbeat message being used to keep the session between the master node in the first SPG and the master node in the second SPG active.

[0222] The third sending module 730 is also used to send a third heartbeat message to the slave node in the second SPG. The third heartbeat message is used to keep the session between the master node in the second SPG and the slave node in the second SPG active.

[0223] It should be noted that, in this embodiment, as Figures 8 to 10 The apparatus shown is also used to implement other method flows in the above method embodiments. For details, please refer to the foregoing method embodiments. This embodiment will not elaborate further.

[0224] The device provided in this embodiment is designed with a two-layer network structure. The first network layer is responsible for packet processing tasks, and the second network layer is responsible for session management and backup. Compared with the existing method of performing packet processing and session management / backup on one layer, this solution is not limited by the traditional single-layer network, that is, it is not limited by the number of sessions originally deployed in a cluster and the memory size of a single node. Therefore, this method includes multiple SPGs in the second network layer, which supports the number of sessions under high availability to increase linearly with the number of nodes.

[0225] Furthermore, compared to the original single-layer network structure, containerized deployment of the Gateway (GW) cannot support session high availability because each GW container has less memory available after containerization. The session processing apparatus of this disclosure, however, supports session high availability by containerizing the GW. Simultaneously, the number of new connections per second (CPS) also supports linear growth with the number of nodes.

[0226] Example 6

[0227] In addition, embodiments of this disclosure also provide an electronic device, such as... Figure 11As shown, the electronic device may include a processor 110 and a memory 120, wherein the processor 110 and the memory 120 may be connected via a bus or other means. Figure 11 For example, the connection is via a bus. Furthermore, the electronic device also includes at least one interface 130, which can be a communication interface or other interface; this embodiment does not impose any limitations on this.

[0228] The processor 110 can be a central processing unit (CPU). The processor 110 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0229] The memory 120, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the session processing method and session keep-alive method in the embodiments of this disclosure. The processor 110 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 120, that is, implementing the session processing method and session keep-alive method in the above method embodiments.

[0230] The memory 120 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor 110, etc. Furthermore, the memory 120 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 120 may optionally include memory remotely located relative to the processor 110, and these remote memories may be connected to the processor 110 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0231] In addition, at least one interface 130 is used for communication between the electronic device and external devices, such as communication with a server. Optionally, at least one interface 130 can also be used to connect peripheral input / output devices, such as a keyboard or display screen.

[0232] The one or more modules are stored in the memory 120, and when executed by the processor 110, they perform actions such as... Figures 3 to 7 The session processing method and session keep-alive method in the illustrated embodiments.

[0233] Furthermore, embodiments of this disclosure also provide a load balancing system, the structure of which can be as described above. Figure 2 The structure shown includes a first network layer, a second network layer, and many other nodes. In this system, the first network layer includes a first node FP-A0, the second network layer includes a master node SP-A0 and a slave node SP-A1 in the first SPG, and a master node SP-B0 and a slave node SP-B1 in the second SPG, etc.

[0234] Optionally, the FP-A0 may be or contain the following: Figure 8 The device shown, SP-A0 may be or contains, as follows: Figure 9 The device shown, SP-B0 may be or contain, as such Figure 10 The apparatus shown.

[0235] Furthermore, the structure of the aforementioned device can be similar to that of... Figure 11 The electronic devices shown may have the same or different structures, and this embodiment does not impose any restrictions on this.

[0236] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0237] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A session processing method, characterized in that, The method is applied to a load balancing system, the system comprising a first network layer and a second network layer, the first network layer and the second network layer being tunneled together, the first network layer comprising a first node, and the second network layer comprising at least one Slow Processing Group (SPG), the method comprising: The first node sends a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside. The first node receives the second tunnel message fed back by the master node based on the positive flow 5-tuple; The first node parses the second tunnel message to obtain the reverse flow 5-tuple and the first original message, and searches for the session based on the first original message, and completes the reverse flow 5-tuple of the found session; The first node performs address translation on the first original message using the padded reverse flow 5-tuple, generates a second original message, and sends the second original message.

2. The method according to claim 1, characterized in that, Before the first node sends the first tunnel message to the master node in the first SPG, the process also includes: The first node receives the first original message from an external source; The first node searches for its local session based on the content of the first original message; If no matching session is found, a new session is created, and the first SPG is selected from at least one SPG in the second network layer; The first node constructs a first User Datagram Protocol (UDP) packet and encapsulates the first UDP packet into the first tunnel packet.

3. The method according to claim 2, characterized in that, Selecting the first SPG from at least one SPG in the second network layer includes: The first node selects the first SPG from the at least one SPG based on the five-tuple hash value of the first original message.

4. The method according to claim 1, characterized in that, The second tunnel message is generated by the master node in the first SPG after it searches for the session locally, and then encapsulates the found reverse flow 5-tuple and the first original message. Alternatively, the second tunnel message is generated by the master node in the first SPG based on the reverse flow quintuple fed back by the master node of the second SPG, and combined with the first original message.

5. The method according to any one of claims 1-4, characterized in that, The step of searching for a session based on the first original message further includes: When the first node does not find a matching session based on the first original message, it determines the second SPG in at least one SPG of the second network layer; The first node sends a third tunnel message to the master node of the second SPG; The first node receives a fourth tunnel message sent by the master node of the first SPG. The fourth tunnel message includes the first original message and a reverse flow 5-tuple. The reverse flow 5-tuple is used to complete the 5-tuple information of the session.

6. A session processing method, characterized in that, The method is applied to a load balancing system, the system comprising a first network layer and a second network layer, the first network layer and the second network layer being tunneled together, the first network layer comprising a first node, and the second network layer comprising a first Slow Processing Group (SPG) and a second SPG, the method comprising: The master node in the first SPG receives the first tunnel message sent by the first node; The master node in the first SPG decapsulates the first tunnel message to obtain the first original message, which includes a forward flow quintuple. The master node in the first SPG searches for a matching session in the local session list based on the positive flow quintuple; The reverse flow 5-tuple of the found matching session is encapsulated with the first original message to generate a second tunnel message; or, The reverse flow 5-tuple of the session that was not found and received from the master node of the second SPG is combined with the first original message to encapsulate and generate the second tunnel message; The master node in the first SPG sends the second tunnel message to the first node.

7. The method according to claim 6, characterized in that, The step of receiving the reverse flow 5-tuple of the session from the master node of the second SPG, and combining it with the first original message for encapsulation to generate a second tunnel message includes: The master node in the first SPG creates a new session and determines the second SPG based on the 5-tuple hash of the new session; The master node in the first SPG sends a first User Datagram Protocol (UDP) message to the master node of the second SPG, and the first UDP message carries the forward flow quintuple. The master node in the first SPG receives a second UDP packet from the master node of the second SPG, and the second UDP packet includes the reverse flow 5-tuple of the newly established session; The master node in the first SPG encapsulates the reverse flow 5-tuple of the newly created session and the first original message to generate the second tunnel message.

8. The method according to claim 7, characterized in that, After the master node in the first SPG receives the second UDP packet fed back by the master node of the second SPG, it also includes: The master node in the first SPG sends a first session message to the slave node in the first SPG. The first session message is used to instruct the slave node in the first SPG to back up the session.

9. The method according to any one of claims 6-8, characterized in that, The method further includes: After receiving a tunnel message from an external or internal source, the master node in the first SPG decapsulates the tunnel message and updates the local session information. The master node in the first SPG sends an update message containing the updated local session information to the slave node in the first SPG.

10. The method according to claim 9, characterized in that, The method further includes: The master node in the first SPG sends a first heartbeat message to the slave node in the first SPG, and / or, The master node in the first SPG sends a second heartbeat message to the master node in the second SPG; The first heartbeat message is used to keep the session between the master node and the slave node in the first SPG active, and the second heartbeat message is used to keep the session between the master node in the first SPG and the master node in the second SPG active.

11. A session processing method, characterized in that, The method is applied to a load balancing system, the system comprising a first network layer and a second network layer, the first network layer and the second network layer being tunneled together, the first network layer comprising a first node, and the second network layer comprising a first Slow Processing Group (SPG) and a second SPG, the method comprising: The master node in the second SPG receives a first User Datagram Protocol (UDP) message sent by the master node in the first SPG. The first UDP message includes a forward flow 5-tuple. The master node in the second SPG creates a new session based on the forward flow quintuple and obtains the reverse flow quintuple of the new session; The master node in the second SPG generates a second UDP packet, which includes the reverse flow 5-tuple of the newly established session. The master node in the second SPG sends the second UDP packet to the master node in the first SPG.

12. The method according to claim 11, characterized in that, The method further includes: The master node in the second SPG sends a second session message to the slave node in the second SPG. The second session message is used to instruct the slave node in the second SPG to back up the newly created session.

13. The method according to claim 11, characterized in that, The method further includes: The master node in the second SPG receives the third tunnel message sent by the first node; The master node in the second SPG decapsulates the third tunnel message and searches for the local session based on the five-tuple of the parsed first original message. If found, the reverse flow 5-tuple of the found session is sent to the master node of the first SPG, so that the master node of the first SPG can generate a fourth tunnel message based on the reverse flow 5-tuple and the first original message.

14. The method according to any one of claims 11-13, characterized in that, The method further includes: The master node in the second SPG receives a second heartbeat message sent from the master node in the first SPG. The second heartbeat message is used to keep the session between the master node in the first SPG and the master node in the second SPG active. The master node in the second SPG sends a third heartbeat message to the slave node in the second SPG. The third heartbeat message is used to keep the session between the master node in the second SPG and the slave node in the second SPG active.

15. A session processing apparatus, characterized in that, The device includes: The first sending module is used to send a first tunnel message to the master node in the first slow processing group (SPG) of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside. The first receiving module is used to receive the second tunnel message fed back by the master node based on the positive flow 5-tuple; The first processing module is used to parse the second tunnel packet to obtain the reverse flow 5-tuple and the first original packet, find the session based on the first original packet, and complete the reverse flow 5-tuple of the found session; and use the completed reverse flow 5-tuple to perform address translation processing on the first original packet to generate the second original packet. The first sending module is also used to send the second original message.

16. A session processing apparatus, characterized in that, The device includes: The second receiving module is used to receive the first tunnel message sent by the first node in the first layer network; The second processing module is used to decapsulate the first tunnel packet to obtain a first original packet, the first original packet including a forward flow 5-tuple; search for a matching session in the local session list based on the forward flow 5-tuple; and, Encapsulate the reverse flow 5-tuple of the matched session with the first original message to generate a second tunnel message; or, encapsulate the reverse flow 5-tuple of the session that was not found and received from the master node of the second slow processing group (SPG) with the first original message to generate a second tunnel message. The second sending module is also used to send the second tunnel message to the first node.

17. A session processing apparatus, characterized in that, The device includes: The third receiving module is used to receive the first User Datagram Protocol (UDP) message sent by the master node in the first Slow Processing Group (SPG). The first UDP message includes a forward flow 5-tuple. The third processing module is used to create a new session based on the forward flow 5-tuple and obtain the reverse flow 5-tuple of the new session; and to generate a second UDP packet, wherein the second UDP packet includes the reverse flow 5-tuple of the new session. The third sending module is used to send the second UDP packet to the master node in the first SPG.

18. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory is coupled to the processor; The memory stores computer-readable program instructions that, when executed by the processor, implement the session processing method as described in any one of claims 1 to 5, 6 to 10, or 11 to 14.

19. A load balancing system, characterized in that, The system includes a first network layer and a second network layer, which are tunneled together. The first network layer includes a first node, and the second network layer includes at least one Slow Processing Group (SPG). The first node sends a first tunnel message to the master node in the first SPG of the second network layer. The first tunnel message includes a positive flow quintuple of the first original message from the outside. The master node in the first SPG receives the first tunnel message sent by the first node, decapsulates the first tunnel message to obtain the first original message, which includes a forward flow 5-tuple; searches for a matching session in the local session list based on the forward flow 5-tuple; encapsulates the reverse flow 5-tuple of the found matching session with the first original message to generate a second tunnel message; and combines the first original message with the encapsulated second tunnel message to generate the second tunnel message, and sends the second tunnel message to the first node. The first node receives and parses the second tunnel message to obtain the reverse flow 5-tuple and the first original message. It then searches for the session based on the first original message, completes the reverse flow 5-tuple for the found session, and performs address translation on the first original message using the completed reverse flow 5-tuple to generate the second original message and send it.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the session processing method as described in any one of claims 1 to 5, 6 to 10, or 11 to 14.

Images