Multilink load balancing method, system and equipment based on concurrent authentication and medium

Abstract

The invention discloses a multilink load balancing method, system and device based on concurrent authentication and a medium. The method comprises the steps that a client initiates an authentication request to a gateway device; the gateway equipment receives the authentication request, performs load balancing on the authentication request by adopting a polling mechanism, determines a final link for transmitting the authentication request, and distributes the authentication request to a corresponding authentication server through the final link; the authentication server receives the authentication request and calls user data in a local database based on the user ID; and comparing the user data in the received authentication request message with the user data called by the local database, verifying the user data, and sending an authentication success message to the client after the verification is successful. Different user authentication requests are distributed to different authentication servers by adopting a polling mechanism, and meanwhile, when a fault of a single authentication server is detected, the authentication server can be automatically switched to other authentication servers, so that the capability of processing network authentication concurrent requests is improved, and the continuity of authentication services is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of load balancing technology, and in particular to a multi-link load balancing method, system, device and medium based on concurrent authentication. Background Art

[0002] With the rapid iteration of Internet technology, digitalization, informatization and intelligence have become the keywords for the development of enterprise parks. Especially in the current data-driven era, the demand for network access has exploded, whether it is large enterprises or innovation parks. Especially in large network environments, a large number of concurrent users need to perform network authentication at the same time to obtain services. This high-concurrency scenario poses a severe challenge to traditional network authentication systems.

[0003] However, although the traditional network authentication system meets the basic network access needs to a certain extent, its limitations gradually become apparent when facing high-traffic concurrent Internet authentication, and performance bottlenecks often occur. For example, the load capacity of the authentication server is limited. When a large number of users initiate authentication requests at the same time, the amount of data that the server needs to process increases sharply, which can easily lead to server overload. The overloaded server then affects its response speed and processing capacity. Secondly, in high-concurrency scenarios, due to the transmission of a large number of data packets, the utilization rate of network bandwidth increases rapidly, and network links may become congested, which not only increases the risk of user authentication failure, but may also cause authentication delays or timeouts, seriously affecting user experience and network service quality. Summary of the invention

[0004] The main purpose of this application is to overcome the shortcomings and deficiencies of the prior art, and to provide a multi-link load balancing method, system, device and medium based on concurrent authentication, which uses a polling mechanism to load balance authentication requests, determines the final link for transmitting authentication requests, and distributes the client's authentication requests to the corresponding authentication server through the final link, thereby achieving load balancing; at the same time, when a single authentication server failure is detected, it can automatically switch to other authentication servers, thereby improving the ability to handle concurrent network authentication requests and ensuring business continuity.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a multi-link load balancing method based on concurrent authentication, comprising the following steps:

[0007] The client initiates an authentication request to the gateway device;

[0008] The gateway device receives the authentication request, and uses a polling mechanism to load balance the authentication request, determines a final link for transmitting the authentication request, and distributes the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server;

[0009] The authentication server receives the authentication request and retrieves user data from a local database based on the user ID;

[0010] The user data in the received authentication request message is compared with the user data retrieved from the local database, the user data is verified, and an authentication success message is sent to the client after the verification is successful.

[0011] As a preferred technical solution, the authentication request includes user information;

[0012] The user information includes: user name, password, and time of initiating the authentication request.

[0013] As a preferred technical solution, the method of load balancing the authentication requests by using a polling mechanism, determining a final link, and distributing the authentication request of the client to the authentication server through the final link includes:

[0014] When the gateway device receives the authentication request, it extracts the user name and the time when the authentication request is initiated from the authentication request;

[0015] Hash the user name and the time when the authentication request was initiated to obtain a hash value;

[0016] According to the different hash values, a polling mechanism is used to distribute the authentication request to different authentication servers through different links in turn. If all authentication servers have been distributed, it starts from the beginning.

[0017] As a preferred technical solution, during the authentication process, if a failure of the authentication server is detected, subsequent authentication requests are switched to other normally operating authentication servers for authentication processing.

[0018] As a preferred technical solution, if a failure of the authentication server is detected, the subsequent authentication request is switched to another normally operating authentication server for authentication processing, including:

[0019] When the authentication server processes the authentication request, it sends the authentication result to the gateway device;

[0020] The gateway device determines the status of the authentication server based on the authentication result;

[0021] If the authentication result of the authentication server is received normally, the status of the authentication server is set to normal;

[0022] If no authentication result is received within the preset time, the authentication server status is set to a faulty status, and the faulty authentication server is removed, and subsequent authentication requests will not be distributed to the faulty authentication server.

[0023] As a preferred technical solution, the authentication request is transmitted in an encrypted manner.

[0024] In a second aspect, the present application provides a multi-link load balancing system based on concurrent authentication, which is applied to the multi-link load balancing method based on concurrent authentication, including a sending authentication request module, an authentication request distribution module, a data retrieval module and an authentication verification module;

[0025] The authentication request sending module is used for the client to initiate an authentication request to the gateway device;

[0026] The authentication request distribution module is used for the gateway device to receive the authentication request, and use the polling mechanism to load balance the authentication request, determine the final link for transmitting the authentication request, and distribute the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server;

[0027] The data retrieval module is used for the authentication server to receive the authentication request and retrieve the user data from the local database based on the user ID;

[0028] The authentication verification module is used to compare the user data in the received authentication request message with the user data retrieved from the local database, verify the user data, and send an authentication success message to the client after the verification is successful.

[0029] As a preferred technical solution, it also includes a user information module;

[0030] The user information module includes user name, password, and time of initiating authentication request.

[0031] As a preferred technical solution, the authentication request distribution module is further specifically used for:

[0032] When the gateway device receives the authentication request, it extracts the user name and the time when the authentication request is initiated from the authentication request;

[0033] Hash the user name and the time when the authentication request was initiated to obtain a hash value;

[0034] According to the different hash values, the authentication request is distributed to different authentication servers through different links in turn. If all authentication servers have been distributed, it starts from the beginning.

[0035] As a preferred technical solution, during the authentication process, if a failure of the authentication server is detected, subsequent authentication requests are switched to other normally operating authentication servers for authentication processing.

[0036] As a preferred technical solution, if a failure of the authentication server is detected, subsequent authentication requests will be switched to other normally operating authentication servers for authentication processing, including: when the authentication server processes the authentication request, it will send the authentication result to the gateway device; the gateway device determines the status of the authentication server based on the authentication result; if the authentication result of the authentication server is received normally, the status of the authentication server is set to normal; if the authentication result is not received within a preset time, the status of the authentication server is set to a faulty status, and the faulty authentication server is removed, and subsequent authentication requests will not be distributed to the faulty authentication server.

[0037] In a third aspect, the present application provides an electronic device, the electronic device comprising:

[0038] at least one processor; and,

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the multi-link load balancing method based on concurrent authentication.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the multi-link load balancing method based on concurrent authentication.

[0042] In summary, compared with the prior art, the effective effects brought about by the technical solution provided by this application include at least:

[0043] The present application proposes a multi-link load balancing method based on concurrent authentication, wherein a client initiates an authentication request to a gateway device; the gateway device receives the authentication request, and adopts a polling mechanism to load balance the authentication request, determines a final link for transmitting the authentication request, and distributes the client's authentication request to a corresponding authentication server through the final link; wherein each link corresponds to an authentication server; the authentication server receives the authentication request, and retrieves user data from a local database based on a user ID; compares the user data in the received authentication request message with the user data retrieved from the local database, verifies the user data, and sends an authentication success message to the client after the verification is successful. The present application load balances the authentication requests by adopting a polling mechanism, determines the final link for transmitting the authentication requests, and distributes the authentication requests of the client to the corresponding authentication server through the final link, that is, distributes different user authentication requests to different authentication servers, so that the pressure originally concentrated on one server is dispersed to multiple servers, thereby greatly improving the system's ability to handle concurrent network authentication requests, avoiding link congestion and high authentication server load; at the same time, when a single authentication server failure is detected, the authentication request originally sent to the failed authentication server can be quickly and automatically switched to other normal authentication servers; the automated fault switching mechanism can ensure that the user's authentication request is not affected even in the face of emergencies such as hardware failures, thereby ensuring the continuity and stability of the campus network service. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of a multi-link load balancing method based on concurrent authentication provided by an embodiment of the present application;

[0046] Figure 2 A flowchart of distributing authentication requests to different authentication servers using a polling mechanism provided for an embodiment of the present application;

[0047] Figure 3 A flowchart for detecting whether an authentication server fails is provided in one embodiment of the present application;

[0048] Figure 4 A block diagram of a multi-link load balancing system based on concurrent authentication provided by an embodiment of the present application;

[0049] Figure 5 A structural diagram of an electronic device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0051] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0052] In today's era of rapid information technology development, large campus networks, as important infrastructure for enterprise operations, carry the daily office and communication needs of thousands or even tens of thousands of users. Especially during the time when users are concentrated at get off work and going to and from work, the number of concurrent network access requests will show explosive growth, which poses a severe challenge to the processing capacity of the network authentication system.

[0053] Traditional network authentication systems usually use a single link and a single authentication server, which has limited ability to handle concurrent requests. The single link and single authentication server approach may barely cope with daily low-concurrency scenarios, but once it encounters peak hours when users access the network in large numbers, the limitations of the system are exposed. However, when a large number of users try to access the network in the same time period, the system will face huge pressure from authentication requests, resulting in link congestion and a surge in authentication server load. This "network authentication request storm problem" will not only cause authentication timeout failures or delays, seriously affecting the user's network access experience, but may also pose a threat to the stability and security of the network system.

[0054] In order to solve the "network authentication request storm problem" in a large campus network environment, and reduce the time for user access network authentication, and improve the user's network experience, in the embodiment of this specification, when the gateway device receives the authentication request, the user name and the time of initiating the authentication request are extracted from the authentication request, and then the user name and the time of initiating the authentication request are hashed, and the uniqueness of the hash algorithm is used to load balance the authentication request using a polling mechanism, determine the final link for transmitting the authentication request, and distribute the client's authentication request to the corresponding authentication server through the final link, so that the pressure originally concentrated on one server is dispersed to multiple servers, thereby greatly improving the system's ability to handle concurrent network authentication requests, and also avoiding link congestion and authentication server load surges. In addition, the method of the present application also includes authentication server fault detection. When a single authentication server fault is detected, the authentication request originally sent to the faulty authentication server can be quickly and automatically switched to other normal authentication servers; the automated fault switching mechanism can ensure that the user's authentication request is not affected even in the face of emergencies such as hardware failures, thereby ensuring the continuity and stability of campus network services.

[0055] In the scenario of multi-link load balancing of concurrent authentication requests, the main purpose of the load balancing in this application is to evenly distribute a large number of authentication requests from the client to multiple links, and transmit the authentication requests to multiple authentication servers through the links to fully utilize link and server resources and improve the overall performance and reliability of the system.

[0056] The link in this embodiment refers to the communication path between the client and the authentication server, which can be wired (such as optical fiber, cable) or wireless (such as Wi-Fi, cellular network, etc.) to ensure that data can be transmitted efficiently and stably between the client and the authentication server.

[0057] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0058] See also Figure 1 In one embodiment of the present application, a multi-link load balancing method based on concurrent authentication is provided, comprising the following steps:

[0059] S1. The client initiates an authentication request to the gateway device.

[0060] Furthermore, as the subject of accessing the network, the user needs to use a mobile phone or computer as a device to access the network. In order to successfully complete the authentication, the user needs to pre-install the authentication client on the mobile phone or computer (or the mobile phone or system can come with an 802.1x client). After installing the authentication client, the user can initiate an authentication request on the client, where the authentication request includes user information, which specifically includes: user name, password, and the time of initiating the authentication request; the user name, password, and the time of initiating the authentication request are the key to verifying the user's identity. Only after passing the verification of this information can the user successfully access the network.

[0061] In this embodiment, when initiating an authentication request, the authentication request supports multiple authentication methods to meet the needs of different users, including but not limited to username and password authentication and enterprise WeChat QR code scanning authentication; for example: the user can choose a username and password authentication method. In this case, the client will package the username, password and request time into an authentication request and send it to the gateway device. Subsequently, the user information therein will be compared with the information in the local database to verify the user's identity.

[0062] Users may forget their passwords, or some users want to use a faster authentication method. Therefore, this embodiment also introduces a more convenient enterprise WeChat scanning QR code authentication method. When the user chooses enterprise WeChat scanning QR code authentication, at this time, the user needs to open the enterprise WeChat application on the mobile phone or computer and scan the QR code generated by the gateway device. After the scan is successful, enterprise WeChat will send the authentication request to the gateway device with the corresponding user information. The enterprise WeChat scanning QR code authentication method simplifies the authentication process. Users only need to use their mobile phones to scan the QR code generated by the gateway device to complete the identity authentication without entering cumbersome usernames and passwords.

[0063] This implementation supports multiple authentication methods so that users can choose the appropriate authentication method according to their preferences and usage habits, greatly improving the user experience.

[0064] S2. The gateway device receives the authentication request, and uses a polling mechanism to load balance the authentication request, determines a final link for transmitting the authentication request, and distributes the client's authentication request to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server.

[0065] In this embodiment, the authentication server is a key device for verifying user identity and authorizing resource access.

[0066] For further information, see Figure 2, and load balancing the authentication request using a polling mechanism, determining a final link for transmitting the authentication request, and distributing the authentication request of the client to the corresponding authentication server through the final link, the steps comprising:

[0067] S21, when the gateway device receives the authentication request, it extracts the user name and the time when the authentication request was initiated from the authentication request;

[0068] Furthermore, the gateway device, as the entry point of the campus network, is responsible for receiving authentication requests from the client; when the gateway device receives the authentication request, it first extracts the user name and the time when the authentication request was initiated from the authentication request.

[0069] Specifically, when the gateway device receives and processes the authentication request, the extraction of the user name and the time of initiating the authentication request is usually achieved by parsing the data structure in the authentication request, using protocol parsing technology.

[0070] Extracting the username and initiating an authentication request, the specific steps include:

[0071] S21.1. Listening and receiving: The gateway device continuously listens to a specific network port or interface, waiting for the authentication request sent by the client. When a user in the park, such as an employee named Xiao Li, tries to access network resources at 15:00, an authentication request will be generated. The authentication request will be formatted according to a certain network communication protocol (such as HTTP, RADIUS, EAP, etc.) and then sent to the gateway device. By listening to a specific network port or interface, the gateway device can capture and receive requests sent by the client in real time.

[0072] S21.2, Data parsing: Once the authentication request is received, the gateway device will parse the data according to the protocol specification used by the authentication request to ensure that the extracted information is accurate. The process of this step is like a translator, converting the authentication request sent by the client as binary data or text data into a data structure that the gateway device can understand and operate, such as a dictionary, object or structure.

[0073] S21.3, Extracting Username: In the parsed data structure, the gateway device will look for a field or attribute containing the username. This field usually has a predefined name or identifier, such as "username", "User-Name" or similar names. Once this field is found, the gateway device will read the data in it, which is the username used by the client when trying to access network resources.

[0074] Take user Xiao Li as an example. If Xiao Li enters the user name "Xiaoli" on a client to initiate an authentication request, when the gateway device receives this request and parses the data, it will find the field containing the user name and read the data "Xiaoli". In this way, the gateway device knows that the user who initiated the authentication request is Xiao Li.

[0075] S21.4. Extract the time when the authentication request was initiated: Similarly, the gateway device will search for a field containing a timestamp or initiation time in the parsed data structure. This field also has a predefined field name, such as "timestamp", "Time-Stamp" or "Authentication-Time". The gateway device will search for this field in the parsed data structure and read the value of this field, and the gateway device can obtain the time when the authentication request was initiated.

[0076] S22, performing hash calculation on the user name and the time when the authentication request was initiated to obtain a hash value;

[0077] Furthermore, the hash algorithm is a mathematical function that can transform input data of any length into an output of fixed length through the hash algorithm. This conversion is a compression mapping, that is, the space of hash values ​​is usually much smaller than the space of input.

[0078] The principle of hash algorithm mainly includes operating the input data according to certain rules to obtain an output of fixed length. Different hash algorithms have different operation rules, but they usually include the following steps:

[0079] First, the hash algorithm divides the input data (user name and the time when the authentication request was initiated) according to a predetermined rule to form several data blocks of equal or unequal length. Each data block is called a message block. This process is similar to dividing an article into several paragraphs or sentences for subsequent sentence-by-sentence analysis.

[0080] Then, a series of mathematical operations such as bit operations, shift operations, modulo operations, and XOR operations are performed on each message block. The purpose of these operations is to convert the information in the original data into a specific format or encoding for subsequent unified processing, thereby obtaining an intermediate result, which is called a message digest;

[0081] All message digests are combined or re-calculated to obtain the final output, which is called a hash value.

[0082] In this embodiment, the user name and the time when the authentication request was initiated are hashed to generate a unique hash value, which is unique and deterministic; different inputs (i.e. different combinations of user names and the time when the authentication request was initiated) produce different hash values; even if there is only a slight difference in the input (for example, a character in the user name or a number in the timestamp), the hash algorithm should be able to generate completely different outputs. This feature ensures that the hash value can uniquely identify each authentication request.

[0083] Specifically, assume a hash algorithm function that accepts a string (here, a combination of a username and a timestamp) as input and outputs an 8-digit hexadecimal number as a hash value. When the client sends an authentication request containing the username "Xiaoli" and the time "2023-10-23 15:00:00" when the authentication request was initiated to the gateway device, the gateway device combines these two fields into a string, such as "Xiaoli_2023-10-23_15:00:00", and then inputs it into the hash algorithm function. The hash algorithm function performs a series of complex operations on this string and ultimately generates an 8-digit hexadecimal number as a hash value, such as "ABCDEF12". This hash value will be used as the basis for subsequent distribution of authentication requests.

[0084] S23, the gateway device distributes the user's authentication request to different authentication servers through different links in turn using a polling mechanism algorithm according to the calculated hash value. If all authentication servers have been distributed, it starts from the beginning;

[0085] For example, suppose three links are configured, link 1, link 2, and link 3; each link corresponds to an authentication server, that is, link 1 corresponds to authentication server Server1, link 2 corresponds to authentication server Server2, and link 3 corresponds to authentication server Server3; then when the gateway device receives the authentication request for the first time, it will distribute the authentication request to link 1 and transmit it to authentication server Server1 according to the hash value; when it receives the request for the second time, it will distribute the authentication request to link 2 and transmit it to authentication server Server2; when it receives the request for the third time, it will distribute the authentication request to link 3 and transmit it to authentication server Server3. In this way, each authentication server will receive the authentication request from the gateway device through each link in turn. When all authentication servers have been distributed requests, the gateway device will restart a new round of distribution, that is, when it receives the request for the fourth time, it will distribute the authentication request to link 1 again and transmit it to authentication server Server1, and then distribute it to authentication servers Server2 and Server3 in the previous order. This cyclic distribution method ensures that each authentication server can receive authentication requests evenly.

[0086] The polling mechanism adopted in this embodiment ensures that each authentication server can receive authentication requests evenly through the corresponding link, avoiding the situation where some authentication servers are overloaded while other servers are idle; in the traditional distribution strategy, if a certain authentication server has high performance or good network conditions, it may receive a large number of authentication requests, resulting in a decrease in processing speed or even crash. The polling mechanism algorithm in this embodiment ensures that each authentication server can receive authentication requests evenly, thereby making full use of the processing capacity of each server.

[0087] Secondly, each link corresponds to a server, and different links may differ due to factors such as physical distance, bandwidth limitation, and network equipment performance. If some links are too congested, it may cause delays or even losses in authentication requests. Therefore, the load balancing strategy adopted in this embodiment distributes authentication requests evenly to different links in turn through a polling mechanism algorithm, so that each link is fully utilized and the problem of a certain link being too congested is avoided, thereby achieving load balancing, improving the efficiency and stability of the entire authentication system, and further providing a strong guarantee for the network security and resource access management of the park.

[0088] S3. The authentication server receives the authentication request and retrieves user data from a local database based on the user ID.

[0089] S4. Compare the user data in the received authentication request message with the user data retrieved from the local database, verify the user data, and send an authentication success message to the client after the verification is successful.

[0090] Furthermore, after receiving the user authentication request, the authentication server will immediately start the user authentication verification process. First, after receiving the authentication request from the gateway device, the authentication server will parse the authentication request and extract the key information of the user ID from it. The user ID is the user's unique identifier in the campus network. The user ID is the basis of the subsequent authentication process and is also the key to ensuring the accuracy of the user's identity.

[0091] After extracting the user ID, the authentication server will turn to its local database and start looking for user data that matches the user ID. The local database is the core component of the authentication server to store user information, which contains key data such as basic information, permission settings, and access records of all registered users in the park.

[0092] The local database can be an internal AD (Active Directory) server, OA (Office Automation) system or other form of user information storage system of the enterprise. Before starting the authentication verification, the authentication server will first parse the user information in the request and extract the user name and password. Then, it will search and compare in the database based on this information. Among them, the local database is updated in real time and accurately to ensure the validity of the user identity. If the username and password find a match in the database and the password is verified, the authentication server will consider the user identity to be legal, that is, the authentication verification is successful; at this time, the authentication server will generate an authentication success message and send the message to the gateway device. After receiving this message, the gateway device will further forward it to the client to inform the user that the authentication is successful.

[0093] However, in the actual authentication process, some abnormal situations may occur. For example, if the authentication server encounters a problem when accessing the local database of accounts and passwords stored in the backend, or the username and password cannot find a match in the database, the authentication server will consider the user identity to be illegal, that is, the authentication verification fails. At this time, the authentication server will generate an authentication failure message and send it to the gateway device. After receiving this message, the gateway device will further forward it to the client to inform the user that the authentication failed.

[0094] The stability of the authentication server is crucial to ensure the normal operation of the entire system. When an authentication server fails, if it is not discovered and handled in time, it may cause serious consequences such as users being unable to log in to the system and service interruption. Therefore, it is a necessary task to perform health detection and troubleshooting on the authentication server. Therefore, during the authentication process of this embodiment, if a single authentication server failure is detected, subsequent authentication requests will be switched to other normally operating authentication servers for processing to avoid the failure affecting the authentication.

[0095] See also Figure 3 , detect whether the authentication server fails, the specific steps include:

[0096] S41, when the authentication server processes the authentication request, it sends the authentication result to the gateway device;

[0097] After receiving the request, the authentication server will perform a series of identity authentication operations, such as verifying the matching of the username and password, checking the user's access rights, etc. Once these verification operations are completed, the authentication server will send the authentication result (such as authentication success or failure) to the gateway device through the link.

[0098] S42, the gateway device determines the status of the authentication server according to the authentication result;

[0099] S43, if the authentication result of the authentication server is received normally, setting the status of the authentication server to normal;

[0100] S44: If no authentication result is received within a preset time, the authentication server status is set to a faulty status, and the faulty authentication server is removed, and subsequent authentication requests will not be forwarded to the faulty authentication server.

[0101] Furthermore, subsequent authentication requests will not be forwarded to the failed authentication server, but will be automatically switched to other normally operating authentication servers for authentication processing to ensure the continuity of authentication services.

[0102] Furthermore, the preset time in step S44 can be preset according to demand, such as 3 seconds.

[0103] Specifically, assume that three authentication servers Server 1, Server 2, and Server 3 are configured. During peak hours, a large number of users initiate authentication requests at the same time. The gateway device forwards the authentication requests to authentication servers Server 1, Server 2, and Server 3 through different links in turn according to the polling mechanism in this embodiment.

[0104] If both authentication servers Server 1 and Server 2 process authentication requests normally and return authentication results, but authentication server Server 3 fails to respond in time due to a fault. After sending a request to authentication server Server 3, the gateway device fails to receive any response within the preset time (such as 3 seconds), so it marks authentication server Server 3 as a faulty state and removes the faulty authentication server. Subsequent authentication requests are automatically switched to authentication servers Server 1 and Server 2 for processing, avoiding the risk of user authentication failure, delay or timeout, while ensuring the continuity and efficiency of authentication services.

[0105] In addition to the above-mentioned fault detection based on response time, the running status of the authentication server can also be monitored in real time through the heartbeat detection mechanism, where the heartbeat detection mechanism is used to check the availability of the server; specifically:

[0106] The authentication server sends heartbeat packets regularly: The authentication server sends heartbeat packets to the gateway device at a preset frequency (such as once per second) to indicate that it is in normal operation.

[0107] The gateway device receives and processes the heartbeat packet: The gateway device monitors the heartbeat packet from the authentication server and updates the corresponding authentication server status to normal after receiving the heartbeat packet.

[0108] Heartbeat timeout is considered a fault: If the gateway device does not receive a heartbeat packet from the authentication server within multiple consecutive heartbeat cycles (such as three consecutive heartbeat timeouts), it will set the corresponding authentication server status to fault and remove the faulty authentication server.

[0109] In addition, you can also analyze and monitor the authentication server logs in real time to promptly discover potential problems and failures. Specifically, you can:

[0110] The authentication server generates various logs during operation, including operation logs, error logs, etc. These logs record the server's operating status, user operations, abnormal situations, etc.

[0111] The gateway device or a dedicated log collection system can collect logs from the authentication server regularly and analyze these logs. By analyzing the error information and abnormal behavior in the logs, potential problems and failures can be discovered;

[0112] If the log analysis finds potential problems or failures in the authentication server, the administrator can take appropriate measures to repair or replace the server. At the same time, the administrator can also optimize the configuration and performance of the server based on the results of the log analysis to improve the stability and reliability of the system.

[0113] It can be seen that in this embodiment, when an authentication server fails, the system can quickly detect and respond to the failure, thereby ensuring the continuity of the authentication service. Even if an authentication server fails, it will not affect the normal operation of the entire system and the normal access of users. At the same time, since the authentication request will be automatically switched to other normally operating servers for processing, the user's authentication experience will not be greatly affected.

[0114] In today's growing network environment, data security and privacy protection have become particularly important. Especially in the process of transmitting authentication requests between the client and the gateway device, the security of data needs to be strictly guaranteed; in network communications, authentication requests often contain sensitive information of users, such as user names, passwords or other authentication credentials. If this information is intercepted or tampered with during transmission, it will bring serious security risks to users. Therefore, in this application, the authentication request is transmitted in an encrypted manner to ensure the integrity and security of the data, thereby effectively preventing data leakage and illegal access.

[0115] The core idea of ​​encrypted transmission is to convert the original authentication request data through a specific encryption algorithm to generate a ciphertext that cannot be directly read. Even if this ciphertext is intercepted during transmission, it cannot be directly read or parsed out by unauthorized personnel to obtain the original data, thus achieving the purpose of protecting data.

[0116] Specifically, when a client initiates an authentication request to a gateway device, the request is first encrypted. The encryption process uses a variety of encryption algorithms, such as symmetric encryption algorithms (such as AES) or asymmetric encryption algorithms (such as RSA). These algorithms use complex mathematical operations and key management to convert raw data into a form that is difficult for unauthorized persons to interpret.

[0117] Among them, a symmetric encryption algorithm is an algorithm that uses a single key for encryption and decryption, which means that both the sender and the receiver must know the same key for secure communication. The encryption and decryption steps of a symmetric encryption algorithm include:

[0118] (1) Key generation: First, a key needs to be generated; this key can be randomly generated or negotiated through a certain protocol or algorithm.

[0119] (2) Encryption process: The sender uses a key and an encryption algorithm (such as AES) to encrypt the plaintext to generate ciphertext. This encryption process usually converts the plaintext into binary data, and then performs a series of mathematical operations according to the encryption algorithm to finally generate the ciphertext.

[0120] (3) Transmitting ciphertext: The encrypted ciphertext is transmitted to the recipient through an insecure network.

[0121] (4) Decryption process: After receiving the ciphertext, the receiver uses the same key and encryption algorithm (such as AES) to decrypt the ciphertext and restore the plaintext.

[0122] The decryption process is the opposite of the encryption process. It is to perform the inverse operation of the encryption process and finally obtain the original plaintext.

[0123] Asymmetric encryption algorithms (such as RSA) use a pair of keys for encryption and decryption, namely a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data. The public key is public and anyone can obtain it and use it to encrypt, but only the holder of the private key can decrypt the data.

[0124] The steps of the encryption and decryption algorithm of the asymmetric encryption algorithm include:

[0125] (1) Key generation: Generate a pair of public and private keys; this process is usually based on complex mathematical operations, such as prime factorization of large numbers.

[0126] Furthermore, the public key can be made public, while the private key must be kept securely.

[0127] (2) Encryption process: The sender uses the receiver's public key to encrypt the plaintext to generate ciphertext. This encryption process converts the plaintext into binary data, and then uses the public key to perform a series of mathematical operations to ultimately generate the ciphertext.

[0128] (3) Transmitting ciphertext: The encrypted ciphertext is transmitted to the recipient through an insecure network.

[0129] (4) Decryption process: After receiving the ciphertext, the receiver uses his or her own private key to decrypt the ciphertext and restore the plaintext.

[0130] The decryption process is also based on complex mathematical operations, and only the holder of the private key can decrypt it.

[0131] In addition, in the encryption process, the key is an indispensable element in the encryption and decryption process, and its security is directly related to the security of the encrypted data. Therefore, a variety of means can be used to protect the key, such as key distribution, key storage, and key update. Even if the encrypted authentication request is intercepted during the transmission process, it cannot be interpreted by unauthorized persons. This is because the decryption process requires the correct key and algorithm, and unauthorized persons often cannot obtain these key information. In addition, a secure communication channel can be established between the gateway device and the authentication server to ensure the security of encrypted data transmission. This secure communication channel adopts a variety of security measures, such as SSL / TLS protocol, VPN technology, etc. These technologies can ensure that the data is not tampered with or intercepted during the transmission process, and only authorized users can access it.

[0132] In summary, this application ensures the security and integrity of the authentication request during transmission by using encryption technology. This encryption processing method can not only effectively prevent data leakage and illegal access, but also improve the security and reliability of the system.

[0133] In summary, this application proposes a multi-link load balancing method based on concurrent authentication, which brings changes to the large-scale campus network authentication system. The method introduces a polling mechanism, which load balances the authentication request of the client by adopting the polling mechanism, determines the final link for transmitting the authentication request, and distributes the authentication request of the client to the corresponding authentication server through the determined final link, so as to achieve efficient load balancing. By adopting the polling mechanism to reasonably distribute and load balance the authentication request, each authentication server can evenly process the authentication request. Since each server can process the request in time, the user can complete the authentication faster, and the user no longer needs to worry about the long authentication waiting time, which reduces the waiting time for the user to access the network authentication, speeds up the authentication process, and the quick response and stable service of the authentication process improve the user's satisfaction and experience of using the campus network. At the same time, when a single authentication server fails, the authentication request originally sent to the failed authentication server can be automatically switched to other normal servers to continue to process the authentication request, ensuring the continuity and stability of the campus network service.

[0134] It should be noted that, for the sake of convenience of description, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously.

[0135] Based on the same idea as the multi-link load balancing method based on concurrent authentication in the above-mentioned embodiment, the present application also provides a multi-link load balancing system based on concurrent authentication, which can be used to execute the multi-link load balancing method based on concurrent authentication. For ease of explanation, the structural diagram of the embodiment of the multi-link load balancing system based on concurrent authentication only shows the parts related to the embodiment of the present application. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the system, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0136] See also Figure 4 In another embodiment of the present application, a multi-link load balancing system based on concurrent authentication is provided, the system comprising an authentication request sending module 101, an authentication request distribution module 102, a data retrieval module 103 and an authentication verification module 104;

[0137] The sending authentication request module 101 is used for the client to initiate an authentication request to the gateway device;

[0138] The authentication request distribution module 102 is used for the gateway device to receive the authentication request, and use the polling mechanism to load balance the authentication request, determine the final link for transmitting the authentication request, and distribute the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server;

[0139] The data retrieval module 103 is used for the authentication server to receive the authentication request and retrieve the user data from the local database based on the user ID;

[0140] The authentication verification module 104 is used to compare the user data in the received authentication request message with the user data retrieved from the local database, verify the user data, and send an authentication success message to the client after the verification is successful.

[0141] As a preferred technical solution, it also includes a user information module;

[0142] The user information module includes user name, password, and time of initiating authentication request.

[0143] As a preferred technical solution, the authentication request distribution module 102 is further used to:

[0144] When the gateway device receives the authentication request, it extracts the user name and the time when the authentication request is initiated from the authentication request;

[0145] Hash the user name and the time when the authentication request was initiated to obtain a hash value;

[0146] According to the different hash values, a polling mechanism is used to distribute the authentication request to different authentication servers through different links in turn. If all authentication servers have been distributed, it starts from the beginning.

[0147] As a preferred technical solution, during the authentication process, if a failure of the authentication server is detected, subsequent authentication requests are switched to other normally operating authentication servers for authentication processing.

[0148] As a preferred technical solution, if a failure of the authentication server is detected, subsequent authentication requests will be switched to other normally operating authentication servers for authentication processing, including: when the authentication server processes the authentication request, it will send the authentication result to the gateway device; the gateway device determines the status of the authentication server based on the authentication result; if the authentication result of the authentication server is received normally, the status of the authentication server is set to normal; if the authentication result is not received within a preset time, the status of the authentication server is set to a faulty status, and the faulty authentication server is removed, and subsequent authentication requests will not be distributed to the faulty authentication server.

[0149] As a preferred technical solution, the authentication request is transmitted in an encrypted manner.

[0150] It should be noted that the multi-link load balancing system based on concurrent authentication of the present application corresponds one-to-one to the multi-link load balancing method based on concurrent authentication of the present application. The technical features and beneficial effects described in the above-mentioned embodiment of the multi-link load balancing method based on concurrent authentication are applicable to the embodiment of the multi-link load balancing system based on concurrent authentication. For specific contents, please refer to the description in the embodiment of the method of the present application. It will not be repeated here. This is hereby declared.

[0151] In addition, in the implementation of the multi-link load balancing system based on concurrent authentication in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the multi-link load balancing system based on concurrent authentication is divided into different program modules to complete all or part of the functions described above.

[0152] See also Figure 5 In another embodiment, an electronic device for implementing a multi-link load balancing method is provided. The electronic device may include a processor, a memory, and a bus, and may also include a computer program stored in the memory and executable on the processor, such as a multi-link load balancing program.

[0153] Exemplarily, in this embodiment, the computer program may be divided into one or more modules, and the one or more modules are stored in the memory and executed by the processor to complete the present application. The one or more module elements may be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the device;

[0154] The device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The device may include, but is not limited to, a processor, a memory;

[0155] In some embodiments, the processor may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center (Control Unit) of the device, and uses various interfaces and lines to connect the various components of the entire device; by running or executing the program or module stored in the memory, and calling the data stored in the memory, the various functions of the electronic device and the processing data are executed.

[0156] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; in addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0157] Wherein, the memory may be an internal storage unit of an electronic device in some embodiments, such as a mobile hard disk of the electronic device. The memory may also be an external storage device of an electronic device in other embodiments, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Furthermore, the memory may also include both an internal storage unit of the electronic device and an external storage device. The memory may be used not only to store application software and various types of data installed in the electronic device, such as the code of a multi-link load balancing program based on concurrent authentication, but also to temporarily store data that has been output or is to be output.

[0158] Figure 5 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 5 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0159] The multi-link load balancing program based on concurrent authentication stored in the memory of the electronic device is a combination of multiple instructions, and when running in the processor, it can achieve:

[0160] The client initiates an authentication request to the gateway device;

[0161] The gateway device receives the authentication request, and uses a polling mechanism to load balance the authentication request, determines a final link for transmitting the authentication request, and distributes the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server;

[0162] The authentication server receives the authentication request and retrieves user data from a local database based on the user ID;

[0163] The user data in the received authentication request message is compared with the user data retrieved from the local database, the user data is verified, and an authentication success message is sent to the client after the verification is successful.

[0164] Accordingly, the present application also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the multi-link load balancing method based on concurrent authentication as described in any one of the above embodiments.

[0165] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), flash memory, mobile hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc.

[0166] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0167] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The above embodiments are preferred implementation modes of the present application, but the implementation modes of the present application are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present application should be equivalent replacement methods and are included in the protection scope of the present application.

Claims

1. A multi-link load balancing method based on concurrent authentication, It is characterized in that The steps include: The client initiates an authentication request to the gateway device; The gateway device receives the authentication request, and uses a polling mechanism to load balance the authentication request, determines a final link for transmitting the authentication request, and distributes the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server; The authentication server receives the authentication request and retrieves user data from a local database based on the user ID; The user data in the received authentication request message is compared with the user data retrieved from the local database, the user data is verified, and an authentication success message is sent to the client after the verification is successful.

2. According to the multi-link load balancing method based on concurrent authentication according to claim 1, It is characterized in that The authentication request includes user information; The user information includes: user name, password, and time of initiating the authentication request.

3. According to the multi-link load balancing method based on concurrent authentication according to claim 2, It is characterized in that The method of load balancing the authentication request by using a polling mechanism, determining a final link, and distributing the authentication request of the client to the authentication server through the final link includes: When the gateway device receives the authentication request, it extracts the user name and the time when the authentication request is initiated from the authentication request; Hash the user name and the time when the authentication request was initiated to obtain a hash value; According to the different hash values, a polling mechanism is used to distribute the authentication request to different authentication servers through different links in turn. If all authentication servers have been distributed, it starts from the beginning.

4. According to the multi-link load balancing method based on concurrent authentication according to claim 1, It is characterized in that During the authentication process, if a failure of the authentication server is detected, subsequent authentication requests will be switched to other normally operating authentication servers for authentication processing.

5. According to the multi-link load balancing method based on concurrent authentication according to claim 4, It is characterized in that If a failure of the authentication server is detected, the subsequent authentication request is switched to another normally operating authentication server for authentication processing, including: When the authentication server processes the authentication request, it sends the authentication result to the gateway device; The gateway device determines the status of the authentication server based on the authentication result; If the authentication result of the authentication server is received normally, the status of the authentication server is set to normal; If no authentication result is received within the preset time, the authentication server status is set to a faulty status, and the faulty authentication server is removed, and subsequent authentication requests will not be distributed to the faulty authentication server.

6. According to the multi-link load balancing method based on concurrent authentication in claim 1, It is characterized in that The authentication request is transmitted in an encrypted manner.

7. A multi-link load balancing system based on concurrent authentication, It is characterized in that A multi-link load balancing method based on concurrent authentication applied to any one of claims 1-6, comprising an authentication request sending module, an authentication request distribution module, a data retrieval module and an authentication verification module; The authentication request sending module is used for the client to initiate an authentication request to the gateway device; The authentication request distribution module is used for the gateway device to receive the authentication request, and use the polling mechanism to load balance the authentication request, determine the final link for transmitting the authentication request, and distribute the authentication request of the client to the corresponding authentication server through the final link; wherein each link corresponds to one authentication server; The data retrieval module is used for the authentication server to receive the authentication request and retrieve the user data from the local database based on the user ID; The authentication verification module is used to compare the user data in the received authentication request message with the user data retrieved from the local database, verify the user data, and send an authentication success message to the client after the verification is successful.

8. According to the multi-link load balancing system based on concurrent authentication as claimed in claim 7, It is characterized in that Also includes a user information module; The user information module includes user name, password, and time of initiating authentication request.

9. An electronic device, It is characterized in that The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the multi-link load balancing method based on concurrent authentication as described in any one of claims 1-6.

10. A computer-readable storage medium storing a program, It is characterized in that When the program is executed by a processor, the multi-link load balancing method based on concurrent authentication described in any one of claims 1 to 6 is implemented.

Images