Method and apparatus for matching virtual services

Abstract

The application relates to a virtual service matching method and device. The method comprises the following steps: obtaining an access request message from a client; parsing the access request message to obtain a protocol version number of the message; parsing an extension field in the access request message to obtain field content; determining a target virtual service SSL configuration according to the protocol version number and the field content; and providing virtual service for the client based on the target virtual service SSL configuration. The virtual service matching method and device can automatically match a corresponding service strategy for an access request message, ensure stable operation of virtual service, improve access speed and connection success rate, and improve user experience.

Description

Technical Field

[0001] This application relates to the field of computer information processing, and more specifically, to a method and apparatus for matching virtual services. Background Technology

[0002] SSL (Secure Sockets Layer) is an encryption protocol developed by NetScape in 1994. SSL 1.0 was never publicly released; SSL 2.0, released in 1994, was abandoned due to serious security vulnerabilities; SSL 3.0, released in 1995, was a completely redesigned protocol and gradually evolved into the standard for web communication.

[0003] In 1996, the IETF took over SSL and renamed it TLS (Transport Layer Security). In 1999, the IETF released TLS 1.0, also known as SSL 3.1. In 2006, the IETF released TLS 1.1, adding the AES symmetric cryptographic algorithm and a solution to CBC attacks. In 2008, the IETF released TLS 1.2, which is currently the mainstream TLS version. It added authentication encryption such as GCM and CCM, added the Message Authentication Code (HMAC)-SHA256, and removed encryption algorithms such as IDEA and DES. It also changed the PRF pseudo-random number function to be based on SHA-256. In 2018, the IETF released TLS 1.3. Therefore, the latest version of the TLS protocol for SSL certificates is currently TLS 1.3, while the mainstream version is TLS 1.2. Both TLS 1.2 and TLS 1.3 are widely used.

[0004] The application services provided by the application delivery device are called virtual services. When a virtual service request is received, it performs policy matching according to certain standards, and then provides services to customers based on the matched policy. The current matching scheme generally sorts the virtual services according to the order of the SSL policies they reference, selecting the last one in the configuration for matching, regardless of the protocol version of the sent message.

[0005] The current matching scheme cannot flexibly match protocols, and when a suitable SSL protocol cannot be matched, the connection of the virtual service will fail to be established, which greatly affects the task processing speed and customer satisfaction.

[0006] Therefore, a new method and device for matching virtual services is needed.

[0007] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0008] In view of this, this application provides a method and apparatus for matching virtual services, which can automatically match the corresponding service policy for access request messages, ensure the stable operation of virtual services, improve access speed and connection success rate, and enhance user experience.

[0009] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0010] According to one aspect of this application, a method for matching virtual services is proposed, the method comprising: obtaining an access request message from a client; parsing the access request message to obtain the protocol version number of the message; parsing extended fields in the access request message to obtain field content; determining the target virtual service SSL configuration based on the protocol version number and the field content; and providing a virtual service to the client based on the target virtual service SSL configuration.

[0011] In one exemplary embodiment of this application, the method further includes: setting multiple default SSL configurations for virtual services that match existing multiple protocol version numbers; and generating a pre-stored configuration strategy through the multiple default SSL configurations for virtual services.

[0012] In one exemplary embodiment of this application, parsing the extended fields in the access request message to obtain field content includes: parsing the extended fields in the access request message to obtain the servername field; and parsing the extended fields in the access request message to obtain the supported versions field.

[0013] In one exemplary embodiment of this application, determining the target virtual service SSL configuration based on the protocol version number and the field content includes: matching the protocol version number with a pre-stored configuration policy to determine the default SSL configuration of the virtual service; and updating the default SSL configuration of the virtual service based on the content in the extended field to generate the target virtual service SSL configuration.

[0014] In one exemplary embodiment of this application, matching the protocol version number with a pre-stored configuration policy to determine the default SSL configuration of the virtual service includes: matching the protocol version number with a pre-stored configuration policy; and extracting the last configured default SSL configuration of the virtual service that is consistent with the protocol version number.

[0015] In one exemplary embodiment of this application, updating the virtual service default SSL configuration according to the content in the extended field to generate the target virtual service SSL configuration includes: extracting the servername field from the extended field; extracting the last configured virtual service default SSL configuration that is consistent with the servername field; and using the virtual service default SSL configuration as the target virtual service SSL configuration.

[0016] In one exemplary embodiment of this application, updating the virtual service default SSL configuration according to the content in the extended field to generate the target virtual service SSL configuration further includes: extracting the supportedversions field from the extended field; extracting the last configured virtual service default SSL configuration that is consistent with the servername field; and using the virtual service default SSL configuration as the target virtual service SSL configuration.

[0017] In one exemplary embodiment of this application, determining the target virtual service SSL configuration based on the protocol version number and the field content further includes: when no target virtual service SSL configuration is matched based on the protocol version number and the field content, extracting the last configured virtual service default SSL configuration that is lower than the protocol version number; and using the virtual service default SSL configuration as the target virtual service SSL configuration.

[0018] In one exemplary embodiment of this application, providing virtual services to the client based on the target virtual service SSL configuration includes: extracting a delivery policy based on the target virtual service SSL configuration; and distributing the access request to a backend server according to the delivery policy.

[0019] According to one aspect of this application, a virtual service matching apparatus is proposed, the apparatus comprising: a message module for acquiring an access request message from a client; a version module for parsing the access request message to obtain the protocol version number of the message; a field module for parsing extended fields in the access request message to obtain field content; a configuration module for determining the SSL configuration of a target virtual service based on the protocol version number and the field content; and a service module for providing a virtual service to the client based on the SSL configuration of the target virtual service.

[0020] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0021] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0022] According to the virtual service matching method and apparatus of this application, by obtaining an access request message from a client; parsing the access request message to obtain the protocol version number of the message; parsing the extended fields in the access request message to obtain the field content; determining the target virtual service SSL configuration based on the protocol version number and the field content; and providing virtual services to the client based on the target virtual service SSL configuration, the method can automatically match the corresponding service policy for the access request message, ensure the stable operation of the virtual service, improve access speed and connection success rate, and enhance user experience.

[0023] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0024] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0025] Figure 1 This is a system block diagram illustrating a virtual service matching method and apparatus according to an exemplary embodiment.

[0026] Figure 2 This is a flowchart illustrating a virtual service matching method according to an exemplary embodiment.

[0027] Figure 3 This is a flowchart illustrating a method for matching virtual services according to another exemplary embodiment.

[0028] Figure 4 This is a flowchart illustrating a method for matching virtual services according to another exemplary embodiment.

[0029] Figure 5 This is a block diagram illustrating a virtual service matching device according to an exemplary embodiment.

[0030] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0031] Figure 7 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0032] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0033] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0034] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0035] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0036] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0037] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0038] The technical abbreviations used in this application are explained as follows:

[0039] Virtual services are application services provided externally by the application delivery device. These virtual services are configured on the application delivery device and uniquely identified by their IP address, protocol, and port number. When a client's access request arrives at the application delivery device via the network, it matches the virtual service based on these identifiers and then distributes it to the actual service according to the configured delivery policy.

[0040] Load balancing is the process of evenly distributing business traffic across backend servers. Based on different business environments and server conditions, load balancing uses pre-selected scheduling algorithms to rationally allocate business traffic to backend servers, ensuring their normal, stable, and efficient operation.

[0041] SSL / TLS, Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL), is a security protocol designed to provide security and data integrity for internet communications. Netscape introduced HTTPS with SSL encryption when it launched its first web browser, Netscape Navigator, in 1994; this is the origin of SSL. The IETF standardized SSL, publishing the first TLS standard document in 1999. Subsequent publications included RFC 5246 (August 2008) and RFC 6176 (March 2011). This protocol is widely supported in applications such as browsers, email, instant messaging, VoIP, and internet fax. Major websites, such as Google and Facebook, also use this protocol to create secure connections and send data. It has become the industry standard for secure communication on the internet.

[0042] SSL comprises a Record Layer and a Transport Layer. The Record Layer protocol determines the encapsulation format of the transport layer data. The Transport Layer security protocol uses X.509 authentication, followed by asymmetric encryption to authenticate the communicating parties, and then exchanges a symmetric key as a session key. This session key is used to encrypt the data exchanged between the two parties, ensuring the confidentiality and reliability of communication between the two applications and preventing attackers from eavesdropping on the communication between the client and server applications.

[0043] After studying the existing technology, the applicant found that the existing virtual service matching method cannot flexibly respond to the corresponding protocol messages according to the sent messages. It requires manual adjustment of the order of SSL policies to ensure that the reply messages match the sent messages. On the other hand, if the protocol version of the bottom SSL policy is higher than that of the received message, and an SSL policy with a version higher than that of the received message is configured, the virtual service connection will fail to be established due to the mismatch of policy versions.

[0044] In view of the technical deficiencies in the prior art, this application provides a matching method for virtual services. When multiple SSL policies are configured for a virtual service, the matching method of the SSL policy for that protocol version is automatically matched according to the protocol version number in the received message. Therefore, the access to the virtual service can be achieved better without manually changing the order of the SSL policies.

[0045] The content of this application will be described in detail below with reference to specific embodiments.

[0046] Figure 1 This is a system block diagram illustrating a virtual service matching method and apparatus according to an exemplary embodiment.

[0047] like Figure 1 As shown, system architecture 10 may include terminal devices 101, 102, and 103, network 104, application delivery server 105, and backend servers 106, 107, and 108. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and application delivery server 105, and between application delivery server 105 and backend servers 106, 107, and 108. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0048] Users can use terminal devices 101, 102, and 103 to interact with backend servers 106, 107, and 108 through application delivery server 105 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software.

[0049] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0050] Backend servers 106, 107, and 108 can be servers providing various services, such as backend management servers supporting shopping websites browsed by users using terminal devices 101, 102, and 103. Application delivery server 105 forwards access requests from terminal devices 101, 102, and 103 to backend servers 106, 107, or 108. Backend servers 106, 107, and 108 can analyze and process the received product information query requests and other data, and then feed the processing results back to the terminal devices.

[0051] Application delivery server 105 may, for example, obtain access request messages from terminal devices 101, 102, and 103; application delivery server 105 may, for example, parse the access request messages to obtain the protocol version number of the messages; application delivery server 105 may, for example, parse the extended fields in the access request messages to obtain the field content; application delivery server 105 may, for example, determine the target virtual service SSL configuration based on the protocol version number and the field content; application delivery server 105 may, for example, forward the access request to backend servers 106, 107, and 108 based on the target virtual service SSL configuration to provide virtual services to the client.

[0052] The application delivery server 105 can also, for example, set multiple default SSL configurations for virtual services that match existing protocol version numbers; and generate a pre-stored configuration strategy through the multiple default SSL configurations for virtual services.

[0053] The application delivery server 105 can be a single physical server, or it can consist of multiple servers. It should be noted that the virtual service matching method provided in this embodiment can be executed by the application delivery server 105, and correspondingly, the virtual service matching device can be located in the application delivery server 105. The web page for browsing products and the request terminal for querying merchants are generally located in terminal devices 101, 102, and 103.

[0054] Figure 2 This is a flowchart illustrating a virtual service matching method according to an exemplary embodiment. The virtual service matching method 20 includes at least steps S202 to S210.

[0055] like Figure 2 As shown, in S202, an access request message from the client is obtained. In one embodiment, the method further includes: setting multiple default SSL configurations for virtual services that match existing protocol version numbers; and generating a pre-stored configuration policy through the multiple default SSL configurations for virtual services.

[0056] In S204, the access request message is parsed to obtain the protocol version number of the message. The protocol version number in the received message is parsed and recorded for subsequent comparison.

[0057] In S206, the extended fields in the access request message are parsed to obtain the field content. For example, the extended fields in the access request message can be parsed to obtain the servername field; alternatively, the extended fields in the access request message can be parsed to obtain the supported versions field.

[0058] It is worth mentioning that in this application, the protocol version number of the access request can be parsed first, and then the content of the extended fields can be interpreted to finally match and determine the SSL configuration of the target virtual service. Alternatively, the protocol version number of the access request can be parsed first, followed by protocol version number matching. After a suitable protocol version number is matched, the content of the extended fields can be parsed to match the SSL policy version. That is, the extended field parsing step can be performed before or after the protocol version number matching, and this application is not limited to this.

[0059] In S208, the target virtual service SSL configuration is determined based on the protocol version number and the field content. The protocol version number is matched with the pre-stored configuration policy to determine the default SSL configuration of the virtual service; the default SSL configuration of the virtual service is updated according to the content in the extended field to generate the target virtual service SSL configuration.

[0060] The process of matching the protocol version number with the pre-stored configuration policy to determine the default SSL configuration of the virtual service includes: matching the protocol version number with the pre-stored configuration policy; and extracting the last configured default SSL configuration of the virtual service that is consistent with the protocol version number.

[0061] More specifically, the servername field in the extended fields can be extracted; the last configured virtual service default SSL configuration that matches the servername field can be extracted; and the virtual service default SSL configuration can be used as the target virtual service SSL configuration.

[0062] More specifically, the supported versions field can be extracted from the extended fields; the last configured default SSL configuration of the virtual service that matches the servername field can be extracted; and the default SSL configuration of the virtual service can be used as the target virtual service SSL configuration.

[0063] In one embodiment, the method further includes: when no target virtual service SSL configuration is matched based on the protocol version number and the field content, extracting the last configured virtual service default SSL configuration that is lower than the protocol version number; and using the virtual service default SSL configuration as the target virtual service SSL configuration.

[0064] In S210, a virtual service is provided to the client based on the target virtual service SSL configuration. A delivery policy can be extracted based on the target virtual service SSL configuration; the access request is then distributed to the backend server according to the delivery policy.

[0065] This application primarily involves parsing received messages to obtain the TLS protocol version number. This version number is then compared with the protocol version numbers of the SSL policies configured in the virtual service. The last configured SSL policy containing the received protocol version number is selected. If no SSL policy contains the received protocol version number, the last configured policy containing a lower version number is selected for the response packet. The success of the virtual service depends on whether the client supports the lower version.

[0066] According to the virtual service matching method of this application, the following steps are taken: obtaining access request messages from clients; parsing the access request messages to obtain the protocol version number of the messages; parsing the extended fields in the access request messages to obtain the field content; determining the target virtual service SSL configuration based on the protocol version number and the field content; and providing virtual services to clients based on the target virtual service SSL configuration. This method can automatically match corresponding service policies for access request messages, ensuring the stable operation of virtual services, improving access speed and connection success rate, and enhancing user experience.

[0067] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0068] Figure 3 This is a flowchart illustrating a method for matching virtual services according to another exemplary embodiment. Figure 3 The process shown in step 30 is... Figure 2 The process shown includes a detailed description of step S208, "Determine the target virtual service SSL configuration based on the protocol version number and the field content".

[0069] like Figure 3As shown, in S302, the protocol version number and the pre-stored configuration policy are matched to determine the default SSL configuration for the virtual service. This can be achieved by matching the protocol version number and the pre-stored configuration policy; then, the last configured default SSL configuration for the virtual service that matches the protocol version number is extracted.

[0070] This allows you to set multiple default policies for virtual services. The parsed protocol version number is compared with the SSL policies configured for each virtual service, and the last configured SSL policy that matches the recorded protocol version number is selected.

[0071] In S304, the servername field in the extended field is parsed.

[0072] In S306, extract the last configured virtual service default SSL configuration that matches the servername field.

[0073] In the SSL policy configuration of the virtual service, select the bottom SSL policy that has the same protocol version number and server name as the recorded one. If no matching policy is found, do not change the original default policy.

[0074] In S308, the supported versions field in the extended field is parsed.

[0075] In S310, extract the last configured virtual service default SSL configuration that matches the servername field. After parsing, check if there is a supported versions field. If so, consider TLS 1.3 separately (TLS 1.3 also fills in TLS 1.2 at the record layer of received messages).

[0076] Based on the "supported versions" field, reconsider and select the last configured SSL policy according to the recorded version protocol number and server name. If no matching policy is found, leave the original default policy unchanged.

[0077] Figure 4 This is a flowchart illustrating a method for matching virtual services according to another exemplary embodiment. Figure 4 The process shown in step 40 is... Figure 2 A detailed description of the process shown.

[0078] like Figure 4 As shown, in S402, the protocol version number of the message is parsed. The protocol version number in the received message is parsed and recorded for later comparison.

[0079] In S404, the default SSL policy is matched based on the protocol version number. To set the default policy for a virtual service, the recorded protocol version numbers are compared one by one with the SSL policies configured for that virtual service, and the last configured SSL policy with the same recorded protocol version number is selected.

[0080] In S406, it checks whether a servername is configured. It parses the extended fields in the message to see if a servername field exists and records the server name.

[0081] In S408, the SSL policy is reselected based on protocol matching and server name. In the virtual service configuration's SSL policy list, select the bottom-most SSL policy that matches both the recorded protocol version number and server name. If no matching policy is found, the initial default policy remains unchanged.

[0082] In S410, it checks whether "supported versions" exists. It parses the message extension fields to see if the "supported versions" field is present.

[0083] In S412, the `supported versions` field is parsed. Based on the `supported versions` field, the last configured SSL policy is reconsidered and selected according to the recorded version protocol number and server name. If no matching policy is found, the initial default policy remains unchanged.

[0084] In S414, TLS 1.3 is considered separately, thus allowing for a reselection of the SSL strategy.

[0085] In S416, virtual services are provided based on the matched SSL policy. If no SSL policy can be selected after the above selections, the last configured SSL policy for the virtual service with a protocol version number lower than the protocol version number of the received message is selected. Whether the client can successfully access the virtual service depends on whether it supports the lower version.

[0086] In one embodiment, if none of the above SSL policies are selected, the virtual service will not work.

[0087] According to the virtual service matching method of this application, when selecting an SSL policy for a virtual service, it is associated with the protocol version number in the received message, which can more flexibly and intelligently make the application's protocol version more consistent with the desired protocol version, making network connections more intelligent, secure, and practical.

[0088] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0089] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0090] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0091] Figure 5 This is a block diagram illustrating a virtual service matching apparatus according to an exemplary embodiment. Figure 5 As shown, the virtual service matching device 50 includes: message module 502, version module 504, field module 506, configuration module 508, and service module 510.

[0092] Message module 502 is used to obtain access request messages from clients;

[0093] Version module 504 is used to parse the access request message to obtain the protocol version number of the message;

[0094] Field module 506 is used to parse the extended fields in the access request message to obtain the field content; field module 506 is also used to parse the extended fields in the access request message to obtain the servername field; and to parse the extended fields in the access request message to obtain the supported versions field.

[0095] The configuration module 508 is used to determine the target virtual service SSL configuration based on the protocol version number and the field content; the configuration module 508 is also used to match the protocol version number with the pre-stored configuration policy to determine the default SSL configuration of the virtual service; and update the default SSL configuration of the virtual service according to the content in the extended field to generate the target virtual service SSL configuration.

[0096] Service module 510 is used to provide virtual services to the client based on the target virtual service SSL configuration. Service module 510 is also used to extract a delivery policy based on the target virtual service SSL configuration and distribute the access request to the backend server according to the delivery policy.

[0097] The virtual service matching device according to this application obtains access request messages from clients; parses the access request messages to obtain the protocol version number of the messages; parses the extended fields in the access request messages to obtain the field content; determines the target virtual service SSL configuration based on the protocol version number and the field content; and provides virtual services to clients based on the target virtual service SSL configuration. This method can automatically match corresponding service policies for access request messages, ensure the stable operation of virtual services, improve access speed and connection success rate, and enhance user experience.

[0098] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0099] The following reference Figure 6 To describe an electronic device 600 according to this embodiment of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0100] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0101] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 610 can perform actions such as... Figure 2 , Figure 3 , Figure 4 The steps are shown in the figure.

[0102] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0103] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0104] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0105] Electronic device 600 can also communicate with one or more external devices 600' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 600, and / or any device that allows electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0106] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 7 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0107] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0108] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0109] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0110] The aforementioned computer-readable medium carries one or more programs, which, when executed by a device, cause the computer-readable medium to perform the following functions: acquire an access request message from a client; parse the access request message to obtain the protocol version number of the message; parse the extended fields in the access request message to obtain the field content; determine the target virtual service SSL configuration based on the protocol version number and the field content; and provide a virtual service to the client based on the target virtual service SSL configuration.

[0111] The computer-readable medium can also perform the following functions: set a default SSL configuration for multiple virtual services that match the existing multiple protocol version numbers; and generate a pre-stored configuration strategy through the multiple default SSL configurations of the virtual services.

[0112] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified to be uniquely different from one or more devices in this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0113] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0114] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A method for matching virtual services, characterized in that, include: Obtain access request messages from clients; Parse the access request message to obtain the protocol version number of the message; Parse the extended fields in the access request message to obtain the field content; Determine the target virtual service SSL configuration based on the protocol version number and the field content; Providing virtual services to the client based on the target virtual service SSL configuration includes: extracting a delivery policy based on the target virtual service SSL configuration, and distributing the access request to a backend server according to the delivery policy.

2. The method as described in claim 1, characterized in that, Also includes: Set the default SSL configuration for multiple virtual services that match the existing protocol version numbers; Pre-stored configuration strategies are generated using the default SSL configurations of the aforementioned virtual services.

3. The method as described in claim 1, characterized in that, Parsing the extended fields in the access request message to obtain the field content includes: Parse the extended fields in the access request message to obtain the servername field; Parse the extended fields in the access request message to obtain the supported versions field.

4. The method as described in claim 1, characterized in that, The target virtual service SSL configuration is determined based on the protocol version number and the field content, including: Match the protocol version number with the pre-stored configuration policy to determine the default SSL configuration for the virtual service; Update the default SSL configuration of the virtual service according to the content in the extended field to generate the SSL configuration of the target virtual service.

5. The method as described in claim 4, characterized in that, The protocol version number and the pre-stored configuration policy are matched to determine the default SSL configuration for the virtual service, including: Match the protocol version number with the pre-stored configuration strategy; Extract the last configured default SSL configuration for the virtual service that matches the protocol version number.

6. The method as described in claim 4, characterized in that, Update the default SSL configuration of the virtual service according to the content in the extended field to generate the SSL configuration of the target virtual service, including: Extract the servername field from the extended fields; Extract the last configured default SSL configuration for the virtual service that matches the servername field; Use the default SSL configuration of the virtual service as the SSL configuration of the target virtual service.

7. The method as described in claim 6, characterized in that, The method further includes updating the default SSL configuration of the virtual service based on the content in the extended field to generate the SSL configuration of the target virtual service, and also includes: Extract the "supported versions" field from the extended fields; Extract the last configured default SSL configuration for the virtual service that matches the servername field; Use the default SSL configuration of the virtual service as the SSL configuration of the target virtual service.

8. The method as described in claim 1, characterized in that, Determining the target virtual service SSL configuration based on the protocol version number and the field content also includes: When no target virtual service SSL configuration is matched based on the protocol version number and the field content, extract the last configured virtual service default SSL configuration that is lower than the protocol version number. Use the default SSL configuration of the virtual service as the SSL configuration of the target virtual service.

9. A matching device for virtual services, characterized in that, include: The message module is used to obtain access request messages from clients; The version module is used to parse the access request message to obtain the protocol version number of the message; The field module is used to parse the extended fields in the access request message to obtain the field content; The configuration module is used to determine the target virtual service SSL configuration based on the protocol version number and the field content; The service module is used to provide virtual services to the client based on the target virtual service SSL configuration, including: extracting a delivery policy based on the target virtual service SSL configuration, and distributing the access request to the backend server according to the delivery policy.

Images