Traffic request processing method and device and computer equipment

Abstract

The invention discloses a traffic request processing method and device and computer equipment. The method comprises the following steps: receiving a flow request sent by a network element of a core network through a load balancing node in a signaling interworking gateway; selecting a target service processing node from a plurality of service processing nodes in the signaling interworking gateway according to the number of connected requests through the load balancing node, and sending the traffic request to a target network element through the target service processing node; the load balancing node generates a traceability table entry, the traceability table entry is used for representing a destination node which determines the target service processing node to send a reply message to the target network element, and the reply message is sent by the target network element in response to the traffic request. According to the method and the device, the technical problem of relatively low security of traffic request processing in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and computer equipment for processing traffic requests. Background Art

[0002] 5G converged private network services are developing rapidly, and the demand for intercommunication between private networks and large networks is becoming increasingly urgent. In the current high-availability cluster deployment, IPVS (IP Virtual Server) is used to distribute cluster inbound traffic to the service processing unit. However, this solution will randomly divert cluster traffic according to the algorithm, and cannot guarantee the consistency of the processing units for bidirectional service traffic (from private network to large network, from large network to private network), which leads to low security of traffic request processing. Summary of the invention

[0003] The embodiments of the present application provide a method, apparatus and computer device for processing traffic requests, so as to at least solve the technical problem of low security of traffic request processing in related technologies.

[0004] According to one aspect of an embodiment of the present application, a method for processing a traffic request is provided, including: receiving a traffic request sent by a core network network element through a load balancing node in a signaling intercommunication gateway; selecting a target business processing node from multiple business processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sending the traffic request to the target network element through the target business processing node; the load balancing node generates a traceability table entry, and the traceability table entry is used to characterize that the target business processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request.

[0005] Optionally, sending the traffic request to the target network element through the target service processing node includes: applying for a port index through the target service processing node; determining a port segment interval of the target service node according to the port index; randomly selecting a port from the port segment interval to be the source port for sending the traffic request to the target network element, and sending the traffic request to the destination port in the target network element through the source port.

[0006] Optionally, determining the port segment interval of the target service node according to the port index includes: obtaining the port index interval; randomly selecting an index value from the port index interval as a target index value; and determining the maximum and minimum values ​​of the port segment interval according to the target index value.

[0007] Optionally, before receiving the reply message generated by the target network element in response to the traffic request through the target service processing node, it includes: generating the traceability table entry through the load balancing node, and the traceability table entry includes: an IP address combination, a network firewall and an IP virtual server, the IP address combination is used to represent the IP address of the target service node, the network firewall is used to mark the message whose destination port is in the port segment interval of the target service node, and the IP virtual server indicates that the marked message will be transmitted to the target service processing node through the tunnel address corresponding to the target service processing node.

[0008] Optionally, the method also includes: receiving a reply message sent by the target network element through the target service processing node, wherein the destination IP address of the reply message is the IP address of the target service node, and the destination port of the reply message is the same as the source port of the target network element sending the traffic request, so as to hit the tracing table entry, wherein, when the reply message sent by the target network element hits the tracing table entry, it is determined that the destination node of the target network element sending the reply message is the target service processing node.

[0009] Optionally, after receiving the reply message sent by the target network element through the target service processing node, the method also includes: obtaining the destination IP address corresponding to the reply message through the target service processing node; and sending the reply message to the core network element through the target service processing node according to the destination IP address corresponding to the reply message.

[0010] Optionally, before selecting a target business processing node from multiple business processing nodes in the signaling intercommunication gateway through the load balancing node according to the number of connected requests, the method also includes: receiving monitoring information of the multiple business processing nodes through the load balancing node, the monitoring information including: the number of requests that the multiple business processing nodes are connected to.

[0011] According to another aspect of an embodiment of the present application, a signaling intercommunication gateway is also provided, including: a load balancing node and multiple service processing nodes; the load balancing node is used to receive a traffic request sent by a core network network element; the load balancing node selects a target service processing node from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests, and sends the traffic request to the target network element through the target service processing node; and is also used to generate a traceability table entry, the traceability table entry is used to characterize that the target service processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request.

[0012] According to another aspect of the embodiment of the present application, a computer device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned traffic request processing method.

[0013] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned traffic request processing method by running the computer program.

[0014] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned traffic request processing method when executed by a processor.

[0015] In an embodiment of the present application, a traffic request sent by a core network network element is received by a load balancing node in a signaling intercommunication gateway; a target service processing node is selected from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests by the load balancing node, and the traffic request is sent to the target network element through the target service processing node; the load balancing node generates a traceability table entry, and the traceability table entry is used to characterize that the target service processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request, so that the service processing node that processes the traffic request and the service processing node that receives the reply message are the same node using the traceability table entry, thereby achieving the technical effect of improving the security of traffic request processing, and further solving the technical problem of low security of traffic request processing in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a flow request processing method according to an embodiment of the present application;

[0018] Figure 2 is a flow chart of a method for processing a flow request according to an embodiment of the present application;

[0019] Figure 3 It is a flow chart of a method for processing a flow request in the related art;

[0020] Figure 4 is a flow chart of another method for processing a traffic request according to an embodiment of the present application;

[0021] Figure 5 It is a structural diagram of a signaling intercommunication gateway according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0025] In order to solve the problems existing in the related art, the embodiment of the present application provides a flow request processing method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0026] The traffic request processing method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a flow request processing method. Figure 1As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0027] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0028] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the flow request processing method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned flow request processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0029] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0030] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0031] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0032] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a traffic request processing method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 2 is a flow chart of a method for processing a flow request according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0034] Step S202, receiving a flow request sent by a core network element through a load balancing node in a signaling intercommunication gateway;

[0035] In the above step S202, the signaling intercommunication gateway includes: a load balancing node and multiple service processing nodes, and the core network element includes: an AMF (Access and Mobility Management Function) network element.

[0036] Step S204, selecting a target service processing node from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sending the traffic request to the target network element through the target service processing node;

[0037] In the above step S204, the method of selecting the target service processing node from multiple service processing nodes can adopt LC (Least Connection): minimum connection number algorithm to distribute the traffic to the service processing node with the minimum current connection number (target service processing node).

[0038] Step S206, the load balancing node generates a tracing table entry, the tracing table entry is used to characterize the target service processing node as the destination node for the target network element to send a reply message, the reply message is sent by the target network element in response to the traffic request.

[0039] In the above step S206, the target network element includes: UDM (User Data Management) network element, which is used to manage and store user-related data and provide authentication, authorization, user configuration and other functions for the 5G network.

[0040] Through the above steps S202 to S206, the traffic request sent by the core network element is received through the load balancing node in the signaling intercommunication gateway; the target service processing node is selected from the multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests, and the traffic request is sent to the target network element through the target service processing node; the load balancing node generates a traceability table entry, and the traceability table entry is used to characterize that the target service processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request, so that the service processing node that processes the traffic request and the service processing node that receives the reply message are the same node by using the traceability table entry to control, thereby achieving the technical effect of improving the security of traffic request processing, and then solving the technical problem of low security of traffic request processing in related technologies. The following is a detailed description.

[0041] Figure 3 FIG. 4 shows a flow diagram of a flow between an AMF and a UDM in the related art. Figure 3As shown in the figure, the load balancing node uses IPVS diversion to achieve load balancing and adopts LC algorithm to achieve traffic distribution; when the traffic request from the private network AMF to the large network UDM arrives at the load balancing node, by comparing the number of connections of each business processing node, the one with the least is selected as the diversion processing node, assuming it is business processing node 1; business processing node 1 proxies the traffic and sends it to the large network UDM; when the traffic from the large network UDM to the private network AMF arrives at the load balancing node, it continues to compare the number of connections of each business processing node, and selects the one with the least as the diversion processing node, assuming it is business processing node n; business processing node n has not processed the request message, resulting in the failure of processing the reply message; this load balancing solution does not achieve the same source and the same destination, and distributes the traffic replied by the large network to the node that processes the private network request traffic.

[0042] In step S204 of the above-mentioned traffic request processing method, the traffic request is sent to the target network element through the target service processing node, including: applying for a port index through the target service processing node; determining the port segment interval of the target service node according to the port index; randomly selecting a port from the port segment interval to be determined as the source port for sending the traffic request to the target network element, and sending the traffic request to the destination port in the target network element through the source port.

[0043] Among them, determining the port segment interval of the target service node according to the port index includes: obtaining the port index interval; randomly selecting an index value from the port index interval to be determined as a target index value; and determining the maximum and minimum values ​​of the port segment interval according to the target index value.

[0044] Taking the port index interval of [1,50] as an example, a port index (Index) is randomly selected from the port index interval, then the port segment interval is [10001+1000*(Index-1),11000+1000*(Index-1)]; taking Index 2 as an example, the port segment interval is [11001,12000].

[0045] In some embodiments of the present application, before receiving the reply message generated by the target network element in response to the traffic request through the target service processing node, the tracing table entry is generated through the load balancing node, and the tracing table entry includes: an IP address combination, a network firewall and an IP virtual server, the IP address combination is used to represent the IP address of the target service node, the network firewall is used to mark the message whose destination port is in the port segment interval of the target service node, and the IP virtual server indicates that the marked message will be transmitted to the target service processing node through the tunnel address corresponding to the target service processing node.

[0046] In some embodiments of the present application, a reply message sent by the target network element is received by the target service processing node, wherein the destination IP address of the reply message is the IP address of the target service node, and the destination port of the reply message is the same as the source port of the traffic request sent by the target network element, so as to hit the tracing table entry, wherein, when the reply message sent by the target network element hits the tracing table entry, it is determined that the destination node of the reply message sent by the target network element is the target service processing node.

[0047] After receiving the reply message sent by the target network element through the target service processing node, the destination IP address corresponding to the reply message is obtained through the target service processing node; the reply message is sent to the core network element through the target service processing node according to the destination IP address corresponding to the reply message.

[0048] For example, in a communication network, the target service processing node receives a reply message sent by the target network element and needs to forward the message to the core network element. This process usually involves the following steps:

[0049] 1. Receive reply messages: The target service processing node listens to and receives reply messages from the target network element. These messages may be responses to certain queries or confirmations of operations.

[0050] 2. Resolve the destination IP address: After receiving the reply message, the target service processing node needs to resolve the destination IP address contained in the message. This address is the IP address of the core network element to which the message should be forwarded.

[0051] 3. Message encapsulation: After knowing the destination IP address and routing information, the target business processing node encapsulates the reply message into a format suitable for network transmission. This may include adding header information, checksum, etc.

[0052] 4. Message forwarding: The target service processing node sends the encapsulated reply message to the core network element through an internal or external interface. This may involve sending data packets through a network layer protocol (such as IP protocol).

[0053] In an alternative approach, Figure 4As shown, step 1, the private network AMF (IP address: 192.11.22.10, port number: 12345) sends a request message (traffic request) to the load balancing node (IP address: 172.11.22.10, port number: 8080); step 2, the load balancing node (distribution tunnel address: 10.11.12.10) uses the minimum connection data algorithm to distribute the request message to the business processing node 2 (target business processing node, distribution tunnel address: 10.11.12.2); step 3, the business After receiving the request message, service processing node 2 uses one of the port segments [11001, 12000], assuming it is port 11111, to initiate a proxy request to the large network UDM with port 11111 as the source port, and sends the request message to UDM; step 4, UDM sends a reply message to the load balancing node; step 5, the load balancing node sends the reply message to service processing node 2 according to the port segment interval where the destination port of the reply message is located; step 6, service processing node 2 sends the reply message to AMF.

[0054] In an optional manner, the load balancing node may generate a tracing table entry (a first tracing table entry), as shown in Table 1, to distribute the traffic request to the service processing node 2.

[0055] Table 1

[0056]

[0057] As shown in Table 1, ipset (IP address combination) defines an ipset named CIWF-SBI-SERVER-IPSET, which has an IP address 172.11.22.10 and a port number of 8080 (load balancing node).

[0058] 2.iptables (network firewall), defines an iptables rule chain named CIWF-SBI-SERVER-CHAIN, which has a MARK rule that matches traffic initiated from the IP address defined in ipset CIWF-SBI-SERVER-IPSET and marks this traffic with 0x9201.

[0059] 3.ipvs (IP virtual server, used to achieve server load balancing) defines a FWM (FWMARK, Firewall Mark, used to mark filtered data packets) rule to forward traffic marked with 0x9201 to 10.11.12.1 and 10.11.12.2 (the distribution tunnel addresses of service processing node 2).

[0060] It should be noted that the traffic hits the ipset table item based on the IP and port of the load balancing node, thereby hitting the iptable table item with FWMARK 0x9201, and then hits the FWM of the ipvs virtual server. According to the LC principle, one is selected from the ipvs real server as the traffic distribution node. It is assumed that it is distributed to business processing node 2, and the source port for initiating the proxy request is 11111.

[0061] In an optional manner, when the target service processing node receives a reply message generated by the target network element in response to the traffic request, the load balancing node generates a tracing table entry (a second tracing table entry), as shown in Table 2, and sends the reply message to the target service node (service processing node 2).

[0062] Table 2

[0063]

[0064]

[0065] As shown in Table 2, ipset: contains an IP address 121.11.22.10 (the IP of business processing node 2); iptables contains two rules. The first rule: mark all incoming TCP traffic. This mark does not specifically specify the source address or destination address, which means that it applies to all incoming TCP traffic; the second rule: match all traffic with a destination port in the range of 11001 to 12000 (the port range of business processing node 2). If the destination IP address of the traffic is in the `CIWF-SBI-CLIENT-IPSET` set, this rule sets the reply message to the tag 0x9203; ipvs forwards the traffic marked with 0x9201 to 10.11.12.2 (the distribution tunnel address of business processing node 2).

[0066] Before selecting a target service processing node from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, the method also includes: receiving monitoring information of the multiple service processing nodes through the load balancing node, and the monitoring information includes: the number of requests that the multiple service processing nodes are connected to.

[0067] It should be noted that the traffic hits the ipset table item based on the destination IP, and then hits the iptable table item based on the destination port 11111 and is marked with FWMARK 0x9203, and then hits the FWMARK of the ipvs virtual server. At this time, there is only one ipvs real server in the virtual server, which is selected as the traffic distribution node and distributed to business processing node 2, so that the request traffic processing node and the reply request traffic processing node are the same node, achieving the same source and the same destination.

[0068] It should be noted that 0x9201 and 0x9203 can both be used as data packet marks; FWMARK is a target in the iptables rule that is used to set or check the mark of a data packet. These marks can be used to identify specific data flows.

[0069] In actual application scenarios, you can modify the tracing table entries to distribute traffic requests to different business processing nodes, and you can also control the flow of UDM reply messages.

[0070] The traffic request processing method provided in the present application realizes the same source and same destination of traffic under the premise of achieving load balancing, avoids the synchronization of traffic distribution information of the cluster, and reduces the CPU occupancy rate of hardware resources; by distributing different port resource segments to the cluster traffic processing nodes, the same source and same destination of traffic processing is achieved with lower performance loss.

[0071] Figure 5 is a structural diagram of a signaling intercommunication gateway according to an embodiment of the present application, such as Figure 5 As shown, the device comprises:

[0072] A load balancing node 40 and multiple business processing nodes 42, wherein the load balancing node 40 is connected to the multiple business processing nodes 42 respectively, wherein the business processing node 42 includes: a port resource application client 101, a process monitoring client 102 and a message proxy processing module 103, and the load balancing node 40 includes: a business process monitoring module 201 and a core control module 202. The port resource application client 101 is also connected to the port resource management module 301.

[0073] When the service processing node 42 is started, the port resource application client 101 applies for the TCP port resource index Index to the port resource management module 301, the index interval is [1,50], and the corresponding port resource calculation method is [10001+1000*(Index-1), 11000+1000*(Index-1)]; the port resource management module 301 is used to allocate the port resource index to the port resource application client 101;

[0074] The port resource application client 101 sends the resource index to the process monitoring client 102;

[0075] The service process monitoring module 201 of the load balancing node 40 sends a health monitoring message to the service monitoring client 102 of the service processing node 42;

[0076] If the process of the business processing node 42 is normal, the health information is reported to the business process monitoring module 201, and the message includes the business node information;

[0077] The core control module 202 of the load balancing node 40 receives the service node information fed back by the service process monitoring module 201, and generates a tracing table entry based on ipvs, ipset, and iptable;

[0078] When the private network AMF traffic is distributed to the business processing node 42 through the load balancing node 40, the message proxy processing module 103 uses a random one of the TCP port segments in the corresponding port range as the source port for initiating a proxy request to the large network UDM based on the applied port.

[0079] It should be noted that Figure 5 The signaling interworking gateway shown is used to perform Figure 2 The traffic request processing method shown, therefore the relevant explanations in the above traffic request processing method are also applicable to the signaling intercommunication gateway, and will not be repeated here.

[0080] An embodiment of the present application also provides a computer device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned traffic request processing method.

[0081] The traffic request processing method executed by the above-mentioned computer device receives the traffic request sent by the core network network element through the load balancing node in the signaling intercommunication gateway; selects the target business processing node from the multiple business processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sends the traffic request to the target network element through the target business processing node; the load balancing node generates a traceability table entry, and the traceability table entry is used to characterize that the target business processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request, so that the service processing node that processes the traffic request and the service processing node that receives the reply message are the same node using the traceability table entry, thereby achieving the technical effect of improving the security of traffic request processing, and then solving the technical problem of low security of traffic request processing in related technologies.

[0082] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned traffic request processing method by running the computer program.

[0083] The computer program stored in the above-mentioned non-volatile storage medium receives the traffic request sent by the core network network element through the load balancing node in the signaling intercommunication gateway; selects the target business processing node from the multiple business processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sends the traffic request to the target network element through the target business processing node; the load balancing node generates a traceability table entry, and the traceability table entry is used to characterize that the target business processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request, so that the service processing node that controls the processing of the traffic request and the service processing node that receives the reply message are the same node, thereby achieving the technical effect of improving the security of traffic request processing, and then solving the technical problem of low security of traffic request processing in related technologies.

[0084] An embodiment of the present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the traffic request processing method in the present application are implemented.

[0085] An embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the traffic request processing method in the present application.

[0086] An embodiment of the present application also provides a computer program, which, when executed by a processor, implements the steps of the traffic request processing method in the present application.

[0087] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0088] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0089] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0090] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0091] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0092] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0093] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing a flow request, characterized in that: include: Receive the traffic request sent by the core network element through the load balancing node in the signaling intercommunication gateway; Selecting a target service processing node from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sending the traffic request to the target network element through the target service processing node; The load balancing node generates a tracing table entry, where the tracing table entry is used to indicate that the target service processing node is determined as the destination node for the target network element to send a reply message, where the reply message is sent by the target network element in response to the traffic request.

2. The method according to claim 1, characterized in that Sending the traffic request to a target network element through the target service processing node includes: Applying for a port index through the target service processing node; Determine the port segment interval of the target service node according to the port index; A port is randomly selected from the port segment interval to be determined as a source port for sending the flow request to the target network element, and the flow request is sent to a destination port in the target network element through the source port.

3. The method according to claim 2, characterized in that Determining the port segment interval of the target service node according to the port index includes: Obtaining the port index interval; Randomly select an index value from the port index interval and determine it as a target index value; The maximum value and the minimum value of the port segment interval are determined according to the target index value.

4. The method according to claim 2, characterized in that: Before receiving, through the target service processing node, a reply message generated by the target network element in response to the traffic request, the method includes: The traceability table entry is generated by the load balancing node, and the traceability table entry includes: an IP address combination, a network firewall and an IP virtual server. The IP address combination is used to represent the IP address of the target business node, the network firewall is used to mark the message whose destination port is in the port segment interval of the target business node, and the IP virtual server indicates that the marked message is transmitted to the target business processing node through the tunnel address corresponding to the target business processing node.

5. The method according to claim 1, characterized in that The method further comprises: A reply message sent by the target network element is received through the target service processing node, wherein the destination IP address of the reply message is the IP address of the target service node, and the destination port of the reply message is the same as the source port of the traffic request sent by the target network element, so as to hit the tracing table entry, wherein, when the reply message sent by the target network element hits the tracing table entry, it is determined that the destination node where the target network element sends the reply message is the target service processing node.

6. The method according to claim 5, characterized in that After receiving, by the target service processing node, a reply message sent by the target network element, the method further includes: Obtaining the destination IP address corresponding to the reply message through the target service processing node; The reply message is sent to the core network element through the target service processing node according to the destination IP address corresponding to the reply message.

7. The method according to claim 1, characterized in that Before selecting a target service processing node from a plurality of service processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, the method further includes: The load balancing node receives monitoring information of the multiple service processing nodes, wherein the monitoring information includes: the number of requests to which the multiple service processing nodes have been connected.

8. A signaling intercommunication gateway, characterized in that: include: Load balancing nodes and multiple business processing nodes; The load balancing node is used to receive the flow request sent by the core network element; Selecting a target service processing node from multiple service processing nodes in the signaling intercommunication gateway according to the number of connected requests through the load balancing node, and sending the traffic request to the target network element through the target service processing node; It is also used to generate a tracing table entry, which is used to characterize that the target service processing node is determined as the destination node for the target network element to send a reply message, and the reply message is sent by the target network element in response to the traffic request.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the traffic request processing method described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the traffic request processing method described in any one of claims 1 to 7 is implemented.

Images