Load processing method, apparatus, and machine-readable storage medium

Abstract

The application discloses a load processing method, device and machine readable storage medium, the method comprising: establishing a network layer protocol security tunnel and obtaining tunnel negotiation information by performing tunnel negotiation with a peer network security device through a control service unit; transmitting the tunnel negotiation information to at least one service unit through the control service unit; obtaining a forward data packet sent by a client through a switching chip; obtaining a forward tunnel packet by encrypting and encapsulating the forward data packet through a service unit, and transmitting the forward tunnel packet to the peer network security device; receiving a reverse tunnel packet through the switching chip, and forwarding the reverse tunnel packet to the service unit; obtaining an inner layer packet by decrypting and decapsulating the reverse tunnel packet through the service unit, and forwarding the inner layer packet to the service unit where the forward tunnel packet is located; and transmitting the inner layer packet to the client through the service unit where the forward tunnel packet is located.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically to a load processing method, apparatus, and machine-readable storage medium. Background Technology

[0002] As businesses expand, access to internal resources is no longer limited to the company network, leading to the development of VPN (Virtual Private Network) technology. A VPN establishes a private, dedicated virtual communication network over a public network, enabling remote users to securely access corporate intranet resources via the internet. IPSEC (Internet Protocol Security) VPN, a type of VPN, is a network layer tunneling encryption technology that provides security services such as confidentiality, integrity, data authentication, and protection against replay attacks for data transmitted over the internet.

[0003] In IPSEC VPN applications in distributed systems, multiple switching chips and multiple service units are typically used to jointly implement the forwarding and encryption / decryption functions of IPSEC data packets. Therefore, ensuring that each service unit handles the IPSEC data packet encryption / decryption business in a load-balanced manner is the key to the distributed implementation of IPSEC tunnels.

[0004] Currently, the technical solutions adopted by various business units for load balancing in processing IPSEC data packet encryption and decryption services are mainly as follows: (1) By configuring access control list rules, this method issues access control list rules based on the source and destination IP (Internet Protocol, network layer protocol) addresses of the packets. When there are a batch of packets with different source and destination IPs that need to be protected through the IPSEC tunnel, the corresponding access control list rules need to be issued separately, which greatly consumes access control list hardware resources; and the packets are redirected to the business unit that matches the security association information. The encryption and decryption processes of the packets are all handled by the same business unit. When the tunnel packets are relatively concentrated, the data processing capabilities of each business unit cannot be fully utilized. (2) By establishing a software prefix table, in addition to maintaining the security association and security policy information generated during the IPSEC tunnel negotiation process, the business unit also adds the maintenance of prefix table information, which increases the complexity of IPSEC tunnel information maintenance; at the same time, the logic of searching for matching prefix tables is required during data packet processing, which increases the burden of data packet processing; and the encryption and decryption processing of the same stream packets are also handled by the same business unit. Summary of the Invention

[0005] The purpose of this application is to provide a load processing method, apparatus, and machine-readable storage medium for implementing load balancing of IPSEC data packet encryption and decryption services in various business units, so as to solve or at least partially solve the above-mentioned problems.

[0006] To achieve the above objectives, the first aspect of this application provides a load processing method applied to a network security device. The network security device includes a switching chip, a control service unit, and a service unit. The load processing method includes:

[0007] By controlling the business unit to negotiate tunnels with the peer network security equipment, a network layer protocol security tunnel is established, and tunnel negotiation information is obtained;

[0008] The tunnel negotiation information is synchronously transmitted to at least one business unit by the control business unit, so that the business unit receives the tunnel negotiation information.

[0009] The positive data packets sent by the client are obtained through the switching chip;

[0010] The business unit encrypts and encapsulates the forward data packets to obtain the forward tunnel packets, and then transmits the forward tunnel packets to the peer network security device using a network layer protocol secure tunnel.

[0011] The switching chip receives reverse tunnel messages and forwards them to the service unit. The reverse tunnel messages are transmitted by the peer network security device through a secure tunnel of the network layer protocol.

[0012] The business unit decrypts and decapsulates the reverse tunnel message based on the tunnel negotiation information to obtain the inner message, and then forwards the inner message to the business unit where the forward tunnel message is located.

[0013] The inner message is sent to the client through the business unit containing the forward tunnel message.

[0014] In this embodiment of the application, a network layer protocol secure tunnel is established by controlling the business unit to negotiate a tunnel with the peer network security device, and tunnel negotiation information is obtained, including:

[0015] Configure access control list rules via a switching chip;

[0016] The control service unit sends a tunnel negotiation message to the switching chip;

[0017] The switching chip matches the tunnel negotiation message with the access control list rules to obtain the matched tunnel negotiation message, and then sends the matched tunnel negotiation message to the control service unit.

[0018] The control business unit processes the matched tunnel negotiation messages, negotiates tunnels with the peer network security equipment, establishes a network layer protocol security tunnel, and obtains tunnel negotiation information generated during the tunnel negotiation process.

[0019] In this embodiment, the tunnel negotiation information includes security policy information. The forward data packets are encrypted and encapsulated by the service unit to obtain the forward tunnel packet, which includes:

[0020] The business unit matches the forward data packets with the security policy information, and when the forward data packets match the security policy information, it encrypts and marks the forward data packets.

[0021] The business unit processes the forward data packets through the firewall, and after the firewall processing is completed, it encrypts and encapsulates the forward data packets according to the encryption markers of the forward data packets to obtain forward tunnel packets.

[0022] In this embodiment of the application, a network layer protocol secure tunnel is used to receive reverse tunnel messages transmitted by the peer network security device through a switching chip, and the reverse tunnel messages are forwarded to the service unit, including:

[0023] The network layer protocol security tunnel is used to receive reverse tunnel messages transmitted by the peer network security device through the switching chip, and to query whether the reverse tunnel message has self-learned access control list rules when it is transmitted in the network layer protocol security tunnel.

[0024] In the absence of self-learned access control list rules for reverse tunnel messages, the reverse tunnel messages are forwarded to the business unit via the switching chip.

[0025] In this embodiment of the application, after querying whether a self-learned access control list rule exists when a reverse tunnel message is transmitted in a network layer protocol secure tunnel, the method further includes:

[0026] When there are self-learned access control list rules in the reverse tunnel message, the preset priority traffic splitting business unit determination logic is adopted to determine the priority traffic splitting business unit.

[0027] The reverse tunnel messages are forwarded to the priority traffic distribution service unit by switching chips.

[0028] In this embodiment of the application, the logic for determining the priority traffic-sharing service unit includes:

[0029] Identify the service unit with the highest inner-layer packet forwarding frequency in the network layer protocol security tunnel within a preset time period, and prioritize the service unit with the highest inner-layer packet forwarding frequency for traffic diversion.

[0030] In this embodiment of the application, the priority routing service unit determination logic further includes:

[0031] Access control list rules are formulated for the network layer protocol security tunnel based on the priority traffic distribution service unit, so that the reverse tunnel packets transmitted in the network layer protocol security tunnel can learn by themselves according to the access control list rules.

[0032] In this embodiment of the application, the load processing method further includes:

[0033] The message splitting logic is adopted to forward the inner message to the business unit where the forward tunnel message is located;

[0034] The message routing logic includes:

[0035] Determine whether inner-layer messages and forward tunnel messages are processed in the same service unit;

[0036] If the inner message and the forward tunnel message are not processed in the same business unit, the inner message will be forwarded to the business unit where the forward tunnel message is located.

[0037] A second aspect of this application provides a load processing apparatus, comprising:

[0038] The memory is configured to store instructions; and

[0039] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the load processing method as described in the first aspect.

[0040] A third aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to perform the load processing method as described in the first aspect.

[0041] The above technical solution establishes a network layer protocol secure tunnel based on the control business unit, reducing the complexity of tunnel negotiation and maintenance. By synchronizing tunnel negotiation information from the control business unit to the non-control business unit, each business unit in the distributed system has the ability to encrypt and decrypt network layer protocol secure data packets. Based on the synchronization of network layer protocol secure information, combined with the inner layer packet forwarding method, the encryption and decryption process of network layer protocol secure forward and reverse tunnel packets is no longer limited to the same business unit. This fully utilizes the data processing capabilities of each business unit in the distributed device and improves the overall performance of the distributed device in network layer protocol secure application scenarios.

[0042] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0043] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0044] Figure 1 The illustration shows a schematic flowchart of a load processing method according to an embodiment of this application;

[0045] Figure 2 A network topology diagram according to an embodiment of this application is illustrated schematically.

[0046] Explanation of reference numerals in the attached figures

[0047] 210 Network security equipment; 211 Control business unit

[0048] 212 Business Unit 213 Switching Chip

[0049] 220 peer network security devices; 230 network layer protocol secure tunnels.

[0050] 240 clients, 250 servers Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0052] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0053] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0054] Figure 1 The schematic diagram illustrates a flow chart of a load processing method according to an embodiment of this application, such as... Figure 1 As shown in the embodiments of this application, a load processing method is provided, which is applied to a network security device. The network security device includes a switching chip, a control service unit, and a service unit. Figure 2 A network topology diagram according to an embodiment of this application is illustrated schematically, such as... Figure 2 As shown, this network topology diagram is a network structure diagram composed of network security device 210, peer network security device 220, network layer protocol security tunnel 230, client 240, and server 250. Different types of lines represent different types of message transmission. Both network security device 210 and peer network security device 220 apply load balancing methods, which include the following steps:

[0055] Step S110: By controlling the business unit to negotiate a tunnel with the peer network security device, establish a network layer protocol security tunnel, and obtain tunnel negotiation information.

[0056] Network layer protocol secure tunneling mode is a network tunneling technology that creates a secure tunnel between the source and destination hosts, encapsulating the original IP data packets within new IP data packets for transmission. During transmission, tunneling mode encrypts, authenticates, and encapsulates the original IP data packets to ensure data security during transmission.

[0057] In network layer protocol secure tunneling mode, a network layer protocol secure tunnel is established between the source and destination hosts. Within this tunnel, all data packets transmitted are protected by network layer security protocols. This tunneling mode provides security protection at both the network and transport layers, and is transparent to upper-layer applications.

[0058] In this embodiment, a network layer protocol security tunnel needs to be established between the network security device and the peer network security device to enable secure transmission of data packets between the client and the server.

[0059] Please see Figure 2 ,like Figure 2 As shown, the control business unit 211 negotiates a tunnel with the peer network security device 220 to establish a network layer protocol secure tunnel 230 and obtain tunnel negotiation information. In a distributed system, there is usually only one control business unit 211. The control business unit 211 is a unit that processes data packets and coordinates the normal operation of other business units in the distributed system. There are multiple business units 212. The business units 212 are units that process data packets in the distributed system. Only the control business unit 211 can establish a network layer protocol secure tunnel 230 with the peer network security device 220. The control business unit 211 is no different from the business unit 212 except for the functions of establishing a network layer protocol secure tunnel 230 with the peer network security device 220 and coordinating and controlling other business units.

[0060] Specifically, step S110 includes the following steps:

[0061] Step S111: Configure access control list rules via the switching chip.

[0062] Understandably, tunnel negotiation messages are categorized into different types. To ensure that tunnel negotiation messages in different scenarios can be redirected to the control service unit for processing, it is necessary to configure corresponding access control list rules through the switching chip based on the characteristics of the tunnel negotiation messages in different scenarios. Access control is implemented through rules, and each rule specifies information such as source, destination, and communication content. This collection of access control rules is called an access control list in a router.

[0063] In this embodiment, access control list rules are issued according to the following: ordinary negotiation messages, negotiation messages under IPSEC NAT (Network Address Translation) traversal, and fragmented negotiation messages under the national cryptographic standard 1.1: access control list rules for ordinary negotiation messages are issued based on source and destination ports and L4 (transport layer) protocol information; access control list rules for negotiation messages under IPSEC NAT traversal are issued based on source and destination ports, L4 protocol, and L4 data portion; access control list rules for fragmented negotiation messages under the national cryptographic standard 1.1 are issued based on source and destination ports, L4 protocol, and fragmented message characteristics.

[0064] By configuring access control list rules through the switching chip, the separation of data packets and tunnel negotiation packets is achieved, while ensuring that tunnel negotiation packets in the same scenario can be redirected to the control business unit for processing.

[0065] Step S112: Send a tunnel negotiation message to the switching chip through the control service unit.

[0066] In this embodiment of the application, in order to establish a network layer protocol security tunnel 230, the control service unit 211 first needs to send a tunnel negotiation message to the switching chip 213.

[0067] Step S113: Match the tunnel negotiation message with the access control list rules through the switching chip to obtain the matched tunnel negotiation message, and send the matched tunnel negotiation message to the control service unit.

[0068] In this embodiment, after the tunnel negotiation message arrives at the switching chip 213, it is matched according to the access control list rules configured in step S111 to obtain the matched tunnel negotiation message. Since only the control service unit 211 can establish a network layer protocol security tunnel with the peer network security device 220, the matched tunnel negotiation message is redirected to the control service unit 211.

[0069] Step S114: The control business unit processes the matched tunnel negotiation message, negotiates with the peer network security device to establish a network layer protocol security tunnel, and obtains the tunnel negotiation information generated during the tunnel negotiation process.

[0070] In this embodiment, the control service unit 211 receives and processes the matched tunnel negotiation message and sends the tunnel negotiation message to the peer network security device 220. The peer network security device 220 also performs a series of processing on the tunnel negotiation message and responds to the control service unit 211 with the tunnel negotiation message, thereby realizing the establishment of a network layer protocol secure tunnel based on the control service unit negotiation. Tunnel negotiation information is generated during the tunnel negotiation process.

[0071] Establishing a network layer protocol secure tunnel based on the control business unit reduces the complexity of tunnel negotiation and maintenance, while avoiding excessive consumption of access control list hardware resources.

[0072] Step S120: The tunnel negotiation information is synchronously transmitted to at least one service unit by the control service unit, so that the service unit receives the tunnel negotiation information.

[0073] Specifically, in this embodiment, the service unit is a unit that processes data packets in a distributed system. The control service unit 211 transmits information through the channel established with each service unit, and synchronizes the tunnel negotiation information generated during the establishment of the network layer protocol secure tunnel to each non-control service unit in real time. The non-control service unit processes the synchronization message, parses out the tunnel negotiation information and saves it locally, and the synchronization ends. From then on, each service unit has the ability to process the encryption and decryption of network layer protocol secure tunnel packets, while ensuring the consistency of tunnel negotiation information among the service units.

[0074] Step S130: Obtain the positive data packet sent by the client through the switching chip.

[0075] After the network layer protocol secure tunnel negotiation is established and the tunnel negotiation information is synchronized, data packets can be processed. For example... Figure 2 As shown, the switching chip 213 receives the forward data packet sent by the client 240. The switching chip 213 performs packet diversion and redirects the forward data packet to one of the control service unit 211 or service unit 212 for processing based on the algorithm. In this embodiment, it is assumed that the source IP of the forward data packet is SIP1 and the destination IP is DIP1. The forward data packet is diverted to service unit a for processing.

[0076] Step S140: The forward data packet is encrypted and encapsulated by the business unit to obtain the forward tunnel packet, and the forward tunnel packet is transmitted to the peer network security device using a network layer protocol secure tunnel.

[0077] In this embodiment, service unit a encrypts and encapsulates the forward data packet to obtain a forward tunnel packet, and transmits the forward tunnel packet to the peer network security device 220 using the network layer protocol security tunnel 230.

[0078] Specifically, the tunnel negotiation information includes security policy information. The forward data packets are encrypted and encapsulated by the business unit to obtain the forward tunnel packet, which includes:

[0079] The business unit matches the forward data packets with the security policy information, and when the forward data packets match the security policy information, it encrypts and marks the forward data packets.

[0080] The business unit processes the forward data packets through the firewall, and after the firewall processing is completed, it encrypts and encapsulates the forward data packets according to the encryption markers of the forward data packets to obtain forward tunnel packets.

[0081] In this embodiment of the application, the tunnel negotiation information generated during the tunnel negotiation process obtained in step S110 includes security policy information. After receiving the forward data packet, service unit a matches the source IP, destination IP and other information of the forward data packet with the security policy information. If the forward data packet matches the security policy information, it marks the forward data packet as needing to be encrypted by the network layer protocol secure tunnel. Otherwise, the forward data packet is processed as an ordinary packet.

[0082] Subsequently, business unit a performs security processing on the forward data packet, namely firewall processing. After the firewall processing is completed, before the forward data packet is sent to server 250, the forward data packet is encrypted and encapsulated according to the encryption mark carried in the forward data packet to obtain a forward tunnel packet. Before encryption and encapsulation, the source IP of the forward data packet is SIP1 and the destination IP is DIP1. After encryption and encapsulation, a forward tunnel packet with source IP is SIP2 and destination IP is DIP2 is obtained. Then, the forward tunnel packet is transmitted to the peer network security device 220 through the network layer protocol security tunnel 230.

[0083] This completes the load balancing of IPSEC data packet encryption across all business units.

[0084] Step S150: Receive the reverse tunnel message through the switching chip and forward the reverse tunnel message to the service unit. The reverse tunnel message is transmitted by the peer network security device through a secure tunnel of the network layer protocol.

[0085] The forward tunnel message reaches the peer network security device 220 via the network layer protocol security tunnel 230. After processing the forward tunnel message, the peer network security device 220 transmits the processed data packet to the server 250. After receiving the data packet, the server 250 responds to the received data packet and sends the response data packet to the peer network security device 220. The peer network security device 220 performs the same encryption processing on the response data packet from the server 250 to obtain a reverse tunnel message with source IP as DIP2 and destination IP as SIP2. The network security device 210 receives the reverse tunnel message through the switching chip 213 and forwards the reverse tunnel message to the service unit. The reverse tunnel message is transmitted by the peer network security device 220 through the network layer protocol security tunnel 230.

[0086] Specifically, step S150 includes the following steps:

[0087] Step S151: Utilize the network layer protocol security tunnel to receive the reverse tunnel message transmitted by the peer network security device through the switching chip, and query whether the reverse tunnel message has self-learned generated access control list rules when it is transmitted in the network layer protocol security tunnel.

[0088] In this embodiment of the application, after the network security device 210 receives the reverse tunnel message transmitted by the peer network security device 220 through the switching chip 213 via the network layer protocol security tunnel 230, the switching chip 213 first queries whether there are self-learned access control list rules when the reverse tunnel message is transmitted in the network layer protocol security tunnel 230.

[0089] Step S152: If there are no self-learned access control list rules in the reverse tunnel message, forward the reverse tunnel message to the service unit through the switching chip.

[0090] If there are no self-learned access control list rules when the reverse tunnel message is transmitted in the network layer protocol security tunnel 230, then the message is split according to the splitting algorithm, and the reverse tunnel message is split to one of the control service unit 211 or service unit 212 for processing. In this embodiment, it is assumed that if there are no self-learned access control list rules for the reverse tunnel message, the reverse tunnel message is split to service unit b for processing.

[0091] In addition to querying whether self-learned access control list rules exist when reverse tunnel packets are transmitted in network layer protocol secure tunnels, the process also includes:

[0092] When there are self-learned access control list rules in the reverse tunnel message, the preset priority traffic splitting business unit determination logic is adopted to determine the priority traffic splitting business unit.

[0093] The reverse tunnel messages are forwarded to the priority traffic distribution service unit by switching chips.

[0094] If a self-learned access control list rule exists when a reverse tunnel message is transmitted in the network layer protocol security tunnel 230, then the priority traffic-splitting service unit is selected and prioritized according to the access control list rule.

[0095] Specifically, the logic for determining the priority traffic diversion business units includes:

[0096] Identify the service unit with the highest inner-layer packet forwarding frequency in the network layer protocol security tunnel within a preset time period, and prioritize the service unit with the highest inner-layer packet forwarding frequency for traffic diversion.

[0097] In this embodiment, it is assumed that the switching chip 213 forwards the reverse tunnel message to the service unit b. The service unit b will also process the reverse tunnel message to obtain the inner message and forward the inner message to the service unit a that processes the forward data message corresponding to the inner message. That is to say, the service unit a is the destination service unit.

[0098] Record the destination service unit for each inner layer packet forwarding, and after recording for a period of time, analyze the service unit with the highest proportion among these destination service units. The service unit with the highest proportion among the destination service units is the service unit with the highest inner layer packet forwarding frequency. Assuming that the service unit with the highest proportion among the destination service units is service unit c, and predicting that service unit c will still be the service unit with the highest proportion of inner layer packet forwarding for the current tunnel packets in the future, then service unit c is taken as the priority traffic offloading service unit for the current tunnel.

[0099] Preferably, the logic for determining the priority traffic diversion service unit further includes:

[0100] Access control list rules are formulated for the network layer protocol security tunnel based on the priority traffic distribution service unit, so that the reverse tunnel packets transmitted in the network layer protocol security tunnel can learn by themselves according to the access control list rules.

[0101] In this embodiment of the application, according to the priority traffic splitting service unit, i.e., service unit c, access control list rules are formulated for the network layer protocol security tunnel 230 so that the reverse tunnel packets transmitted in the network layer protocol security tunnel 230 can perform self-learning according to the access control list rules. After that, when the switching chip 213 forwards the reverse tunnel packets, it will prioritize forwarding the reverse tunnel packets to service unit c.

[0102] By learning the self-splitting of secure tunnel packets in the network layer protocol, the performance overhead caused by frequent inner-layer packet forwarding is reduced, further improving the overall performance of distributed devices in network layer protocol security application scenarios.

[0103] Step S160: The business unit decrypts and decapsulates the reverse tunnel message according to the tunnel negotiation information to obtain the inner message, and forwards the inner message to the business unit where the forward tunnel message is located.

[0104] In step S150, regardless of whether the switching chip 213 distributes the reverse tunnel message to service unit b for processing according to the flow distribution algorithm or distributes the reverse tunnel message to service unit c for processing using the priority flow distribution service unit determination logic, it is necessary to decrypt and decapsulate the reverse tunnel message according to the tunnel negotiation information to obtain the inner message, and then forward the inner message to the service unit that processes its forward tunnel message.

[0105] Specifically, the load processing methods also include:

[0106] The message splitting logic is adopted to forward the inner message to the business unit where the forward tunnel message is located;

[0107] The message routing logic includes:

[0108] Determine whether inner-layer messages and forward tunnel messages are processed in the same service unit;

[0109] If the inner message and the forward tunnel message are not processed in the same business unit, the inner message will be forwarded to the business unit where the forward tunnel message is located.

[0110] It is understandable that inner packets need to be processed by the firewall within the same service unit as their corresponding forward tunnel packets. In other words, the inner packets are processed by the firewall in the same service unit as the forward tunnel packets. In this embodiment, according to step S140, the service unit processing the forward tunnel packets corresponding to the inner packets is service unit a. Since the inner packets and forward tunnel packets are not processed in the same service unit, the inner packets need to be forwarded to service unit a where the forward tunnel packets reside.

[0111] Based on the synchronization of network layer protocol security information, combined with the inner layer message forwarding method, the encryption and decryption process of network layer protocol security forward and reverse tunnel messages is no longer limited to the same business unit. It makes full use of the data processing capabilities of each business unit of the distributed device and improves the overall performance of the distributed device in network layer protocol security application scenarios.

[0112] This completes the load balancing and IPSEC data packet decryption service for each business unit.

[0113] Step S170: Send the inner message to the client through the service unit where the forward tunnel message is located.

[0114] Finally, the inner message is sent to the client 240 through business unit a. This completes the message exchange process in the distributed system, in which the client 240 accesses the resources of the server 250 through the network layer protocol security tunnel 230.

[0115] The load processing method provided in this application establishes a network layer protocol secure tunnel based on the control business unit, reducing the complexity of tunnel negotiation and maintenance. By synchronizing tunnel negotiation information from the control business unit to the non-control business unit, it enables each business unit in the distributed system to have the ability to encrypt and decrypt network layer protocol secure data packets. Based on the synchronization of network layer protocol secure information, combined with the inner layer packet forwarding method, the encryption and decryption process of network layer protocol secure forward and reverse tunnel packets is no longer limited to the same business unit, making full use of the data processing capabilities of each business unit of the distributed device and improving the overall performance of the distributed device in network layer protocol secure application scenarios.

[0116] Corresponding to the above method embodiments, this application provides a load processing apparatus, including:

[0117] The memory is configured to store instructions; and

[0118] The processor is configured to retrieve instructions from memory and to perform the aforementioned load processing methods when executing instructions.

[0119] The load processing apparatus provided in this application embodiment can implement each process of the load processing method in the method embodiment and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0120] This application also provides a machine-readable storage medium storing instructions that cause a machine to perform the load processing method described above.

[0121] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0123] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0124] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0125] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0126] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0127] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0129] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A load processing method, characterized in that, Applied to network security devices, the network security devices including switching chips, control service units, and service units, the method includes: The control business unit negotiates a tunnel with the peer network security device to establish a network layer protocol security tunnel and obtain tunnel negotiation information. The control service unit synchronously transmits the tunnel negotiation information to at least one service unit so that the service unit receives the tunnel negotiation information. The positive data packets sent by the client are obtained through the switching chip; The business unit encrypts and encapsulates the forward data packet to obtain a forward tunnel packet, and then transmits the forward tunnel packet to the peer network security device using the network layer protocol secure tunnel. The switching chip receives reverse tunnel messages and forwards them to the service unit. The reverse tunnel messages are transmitted by the peer network security device through the network layer protocol secure tunnel. The service unit decrypts and decapsulates the reverse tunnel message according to the tunnel negotiation information to obtain the inner message, and forwards the inner message to the service unit where the forward tunnel message is located. The inner message is sent to the client through the service unit containing the forward tunnel message.

2. The load processing method according to claim 1, characterized in that, The step of negotiating a tunnel with the peer network security device through the control service unit to establish a network layer protocol security tunnel and obtain tunnel negotiation information includes: Configure access control list rules using the switching chip; The control service unit sends a tunnel negotiation message to the switching chip. The switching chip matches the tunnel negotiation message with the access control list rules to obtain a matched tunnel negotiation message, and then sends the matched tunnel negotiation message to the control service unit. The control service unit processes the matched tunnel negotiation message, negotiates with the peer network security device to establish the network layer protocol security tunnel, and obtains the tunnel negotiation information generated during the tunnel negotiation process.

3. The load processing method according to claim 1, characterized in that, The tunnel negotiation information includes security policy information. The encryption and encapsulation of the forward data packet by the service unit to obtain the forward tunnel packet includes: The business unit matches the forward data packet with the security policy information, and when the forward data packet matches the security policy information, it encrypts and marks the forward data packet. The service unit performs firewall processing on the forward data packet, and after the firewall processing is completed, it encrypts and encapsulates the forward data packet according to the encryption tag of the forward data packet to obtain a forward tunnel packet.

4. The load processing method according to claim 1, characterized in that, The step of receiving reverse tunnel messages transmitted by the peer network security device through the switching chip using the network layer protocol security tunnel, and forwarding the reverse tunnel messages to the service unit, includes: The network layer protocol security tunnel is used to receive the reverse tunnel message transmitted by the peer network security device through the switching chip, and to query whether the reverse tunnel message has a self-learned access control list rule when it is transmitted in the network layer protocol security tunnel. If the reverse tunnel message does not contain the access control list rules generated by the self-learning, the reverse tunnel message is forwarded to the service unit through the switching chip.

5. The load processing method according to claim 4, characterized in that, After querying whether the reverse tunnel message exists as a self-learned access control list rule during transmission in the network layer protocol secure tunnel, the method further includes: If the self-learned access control list rules exist in the reverse tunnel message, the preset priority traffic splitting service unit determination logic is used to determine the priority traffic splitting service unit. The reverse tunnel message is forwarded to the priority traffic distribution service unit via the switching chip.

6. The load processing method according to claim 5, characterized in that, The logic for determining the priority traffic routing service unit includes: Identify the service unit with the highest inner-layer packet forwarding frequency in the network layer protocol security tunnel within a preset time period, and designate the service unit with the highest inner-layer packet forwarding frequency as the priority traffic-sharing service unit.

7. The load processing method according to claim 6, characterized in that, The priority traffic routing service unit determination logic also includes: The priority traffic splitting service unit formulates access control list rules for the network layer protocol security tunnel, so that the reverse tunnel packets transmitted in the network layer protocol security tunnel can perform self-learning according to the access control list rules.

8. The load processing method according to claim 1, characterized in that, The method further includes: The inner message is forwarded to the service unit where the forward tunnel message is located using message splitting logic. The message splitting logic includes: Determine whether the inner layer message and the forward tunnel message are both processed in the same service unit; If the inner message and the forward tunnel message are not processed in the same service unit, the inner message is forwarded to the service unit where the forward tunnel message is located.

9. A load processing device, comprising: The memory is configured to store instructions; as well as A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the load processing method according to any one of claims 1 to 8.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the load processing method according to any one of claims 1 to 8.

Images