Tunnel anomaly detection method, electronic device, readable medium and program product

Abstract

The invention provides a tunnel abnormity detection method, which is applied to a client and comprises the following steps: a service process of an SSL VPN tunnel inquires a tunnel process of the SSL VPN tunnel according to a preset time interval; under the condition that the tunnel process is inquired, the service process sends a keep-alive message to the tunnel process; and under the condition that the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal. The disclosure also provides an electronic device, a computer readable medium, and a computer program product. According to the method and the device, the SSL VPN client can establish a set of tunnel SSL abnormal state detection and processing mechanism under the condition that the SSL layer program is not changed, the problem that the SSL VPN tunnel is stiff is solved, and the running, maintenance and deployment cost of the VPN is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method for detecting tunnel anomalies, an electronic device, a computer-readable medium, and a computer program product. Background Art

[0002] VPN (Virtual Private Network) is a communication method commonly used to connect private networks between medium and large enterprises or groups. It uses tunneling protocols to achieve functions such as sender authentication, message confidentiality and accuracy. SSL (Secure Socket Layer) is a secure socket layer protocol, which is a protocol for secure information exchange between Web browsers and Web servers. SSL VPN is a VPN technology that establishes tunnels based on the SSL protocol. It is based on HTTPS (Secure HTTP, Hypertext Transfer Security Protocol, that is, HTTP protocol that supports SSL). While it has many advantages, it will also be affected by the status of the SSL transport layer. If an SSL VPN tunnel anomaly detection mechanism is established at the SSL protocol layer, the client and server need to replace the SSL layer program at the same time when handling anomalies, which greatly increases the implementation cost and product instability. Summary of the invention

[0003] The embodiments of the present disclosure provide a method for detecting tunnel anomalies, an electronic device, a computer-readable medium, and a computer program product.

[0004] In a first aspect, an embodiment of the present disclosure provides a method for detecting tunnel anomalies, which is applied to a client and includes:

[0005] The service process of the SSL VPN tunnel queries the tunnel process of the SSL VPN tunnel at a preset time interval;

[0006] When the tunnel process is found, the service process sends a keep-alive message to the tunnel process;

[0007] In a case where the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, it is determined that the SSL VPN tunnel is abnormal.

[0008] In some embodiments, when the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal includes:

[0009] Record the number of times the service process fails to receive the response message;

[0010] When the service process fails to receive the response message for a number of times exceeding a preset number, it is determined that the SSL VPN tunnel is abnormal.

[0011] In some embodiments, when the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal further includes:

[0012] When the service process fails to receive the response message for more than a preset number of times, the service process analyzes the tunnel process log of the tunnel process to determine whether the context of the tunnel process log meets the tunnel abnormality feature; and / or

[0013] When the service process fails to receive the response message for more than a preset number of times, the service process performs line detection to detect whether the network connection between the client and the server is reachable;

[0014] The SSL VPN tunnel is determined to be abnormal when the context of the tunnel process log meets the tunnel abnormality feature and / or the network connection between the client and the server is reachable.

[0015] In some embodiments, determining whether the context of the tunnel process log meets the tunnel abnormality feature includes:

[0016] In the case where a record is detected in the tunnel process log that the data packet being transmitted when the blockage occurs has the same basic information as the data packet entering the SSL VPN tunnel, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or

[0017] In the case where a security detection result of a data packet that fails to be sent or received is detected as a correct record in the tunnel process log, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or

[0018] When it is detected in the tunnel process log that the difference between the time when the data packet enters the SSL VPN tunnel and the time when the blockage occurs is within a preset range, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or

[0019] In the case where it is detected in the tunnel process log that the log records of calling the SSL layer dynamic library function and waiting for the SSLSSL layer dynamic library function to respond are incomplete, determining that the context of the tunnel process log meets the tunnel abnormality characteristics; and / or

[0020] When no record of the tunnel process processing the keep-alive message is detected in the tunnel process log, it is determined that the context of the tunnel process log meets the tunnel abnormality feature.

[0021] In some embodiments, the service process sends a keep-alive message to the tunnel process, including:

[0022] The service process sends a keep-alive message to the tunnel process via a preset UDP port;

[0023] The tunnel process sends a response message to the service process through the preset UDP port.

[0024] In some embodiments, before the service process of the SSL VPN tunnel queries the tunnel process of the SSLVPN tunnel at a preset time interval, the method further includes:

[0025] In response to the client exit instruction, the service process sends a disconnect instruction to the tunnel process;

[0026] The tunnel process sets the normal exit identifier to a preset value in response to the disconnect instruction;

[0027] When the service process detects that the normal exit identifier is not the preset value, the service process executes the step of querying the tunnel process of the SSL VPN tunnel at a preset time interval.

[0028] In some embodiments, after determining that the SSL VPN tunnel is abnormal, the method further includes:

[0029] In the transparent access mode, when an exception occurs when the SSL VPN tunnel is working, the service process restarts the tunnel process so that the tunnel process rebuilds the SSL VPN tunnel according to the tunnel information in the shared memory;

[0030] When an exception occurs when the SSL VPN tunnel is disconnected, the service process clears the tunnel information in the shared memory, restarts the virtual network card and restores the routing table of the client;

[0031] In the network isolation mode and the network full proxy mode, when an abnormality occurs in the SSL VPN tunnel, the service process disconnects the SSL VPN tunnel and restores the routing table of the client.

[0032] In some embodiments, after determining that the SSL VPN tunnel is abnormal, the method further includes:

[0033] The service process records the anomaly detection information and the anomaly handling information so that the service process can make a prediction on the possible anomaly of the SSL VPN tunnel;

[0034] After the network status is restored, the service process reports the exception detection information and the exception handling information to the service end; and / or

[0035] When the SSL VPN tunnel is disconnected, the service process logs out of the session to the server.

[0036] In a second aspect, an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting tunnel anomalies as described in the first aspect of the embodiment of the present disclosure.

[0037] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the method for detecting tunnel anomalies described in the first aspect of the embodiment of the present disclosure is implemented.

[0038] In a fourth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the method for detecting tunnel anomalies described in the first aspect of the embodiment of the present disclosure.

[0039] The disclosed embodiment detects whether the SSL VPN tunnel is in an abnormal state through a heartbeat keep-alive mechanism, thereby solving the problem of SSL layer blocking from the network application layer, avoiding the problem of SSL VPN tunnel deadlock from the SSL layer, thereby avoiding the need to replace the SSL layer program on the SSLVPN server side, and reducing the cost of VPN operation, maintenance and deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the position relationship of SSL in the Internet model;

[0041] Figure 2 It is a schematic diagram of the working principle of a VPN;

[0042] Figure 3 It is a schematic diagram of the program structure of a VPN client;

[0043] Figure 4 It is a schematic diagram of the logical relationship between three tunnel exception handling mechanisms in the embodiment of the present disclosure;

[0044] Figure 5 is a flow chart of a method for detecting tunnel anomalies in an embodiment of the present disclosure;

[0045] Figure 6 is a schematic diagram of the composition of an electronic device in an embodiment of the present disclosure;

[0046] Figure 7 It is a schematic diagram of a tunnel anomaly detection and processing process in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the technical solution of the present disclosure is described in detail below with reference to the accompanying drawings.

[0048] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0049] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0050] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0051] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0052] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0053] SSL (Secure Socket Layer) is a secure socket layer protocol, which is a protocol for securely exchanging information between web browsers and web servers. Figure 1 As shown in the figure, in actual applications, computer networks include application layer, transport layer (TCP or UDP), Internet layer (IP), etc., among which the SSL layer is between the application layer and the transport layer (TCP or UDP). For devices using SSL communication, application layer data is no longer directly passed to the transport layer, but to the SSL layer. The SSL layer encrypts the data received from the application layer and adds its own SSL header to achieve the purpose of identification and confidentiality.

[0054] In a VPN (Virtual Private Network) deployment environment, the network topology is often complex. The working principle diagram of VPN is as follows: Figure 2 As shown in the figure, users in the ExtraNet can use VPN Client to connect to the VPN Server built by the organization to establish a communication tunnel and a virtual private network. When users access resources in the IntraNet, the VPN Client can capture the messages sent by the users, encapsulate the messages and send them to the VPN Server through the physical network communication link. After receiving the messages, the VPN Server unpacks them and forwards them to the actual IntraNet targets (server1, server2, server3). The workflow of a VPN is fully realized.

[0055] like Figure 3 The figure shows a program structure diagram of a VPN client. The client mainly implements the function of the virtual network card through the tunnel process. The tunnel process encrypts and encapsulates the data packet through the SSL layer, sends the encrypted data packet to the protocol stack and sends it to the server (physical network card). It also decrypts the data packet from the server (application). The service process controls the working status of each program. The service process mainly controls the tunnel process through shared memory and UDP port and obtains the working status of the tunnel process.

[0056] The disclosed embodiment performs abnormality detection on the SSL VPN tunnel based on a heartbeat keep-alive mechanism between two processes of the client, namely, a service process and a tunnel process.

[0057] The disclosed embodiment is a supplement to the tunnel keep-alive mechanism and the tunnel no-flow reconnection mechanism. The logical relationship between the three mechanisms is as follows: Figure 4As shown. First, the SSL connection established between the client and the server is a long connection. The tunnel currently has a set of long connection keep-alive mechanisms, never timeout mechanisms, and NAT keep-alive mechanisms to ensure that the tunnel works normally. Secondly, when the tunnel connection between the client and the server is interrupted due to network fluctuations, the client's tunnel no-traffic reconnection mechanism will be triggered. The client will calculate the tunnel no-traffic time. Once it times out, it will trigger the tunnel reconstruction mechanism to reconstruct the tunnel. When the client reconnects without traffic, it first creates a TCP connection with the server, and then creates an SSL connection with the server after success. Then it sends a login packet to the server. After the server verifies it, the tunnel completes the tunnel reconstruction. However, in the actual no-traffic reconnection process of VPN, due to the changeable network environment and the waiting mechanism of each network layer program, the SSL connection between the client and the server may fall into a stuck state, unable to interrupt the connection or re-negotiate SSL, and then the tunnel process freezes. Tunnel process freezes can cause more serious problems such as failure of the client tunnel function, failure to disconnect the tunnel correctly when exiting, and failure to restore the client network environment after exiting. If an abnormality detection mechanism is established at the SSL protocol layer, the client and server need to replace the SSL program at the same time, which will greatly increase the implementation cost and product instability. The SSL abnormality detection mechanism and SSL connection reconstruction mechanism included in the embodiment of the present disclosure are intended to solve this problem.

[0058] The SSL VPN adapted by the embodiment of the present disclosure mainly has three working modes, namely transparent access mode, network isolation mode and network full proxy mode. The transparent access mode means that the user can access the authorized resources through the VPN server, and other network access of the terminal is not affected; the network isolation mode means that the user can only access the authorized resources through the VPN server and cannot access other networks; the network full proxy mode means that all network resources accessed by the user must pass through the SSL VPN tunnel, which is equivalent to the VPN server acting as a proxy for all network access of the user.

[0059] First, refer to Figure 5 The present disclosure provides a method for detecting tunnel anomalies, including:

[0060] S1, the service process of the SSL VPN tunnel queries the tunnel process of the SSL VPN tunnel according to a preset time interval;

[0061] S2. When the tunnel process is found, the service process sends a keep-alive message to the tunnel process;

[0062] S3. When the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determine that the SSL VPN tunnel is abnormal.

[0063] The embodiment of the present disclosure detects the SSL VPN tunnel based on the heartbeat keep-alive mechanism, which can avoid the situation where the SSL VPN tunnel is abnormal and cannot return an error to the tunnel process, causing the tunnel process to remain in a waiting state. The heartbeat keep-alive mechanism refers to a technical mechanism in which the two parties of the connection send a keep-alive packet at one end and a response packet at the other end at regular intervals to confirm that the connection is maintained and the connection status is normal.

[0064] In the disclosed embodiment, the heartbeat keep-alive mechanism is established between the service process and the tunnel process of the client, rather than between the client and the server. The service process, as the sender, sends a keep-alive message to the tunnel process, and the tunnel process, as the responder, sends a response message to the service process. When the SSL layer is in a zombie state, the tunnel process cannot correctly reply to the keep-alive message sent by the service process, and the service process can then infer that the SSL VPN tunnel is abnormal.

[0065] The present disclosure does not specifically limit the specific circumstances of the SSL VPN tunnel anomaly. In some embodiments, the SSL VPN tunnel anomaly may refer to the tunnel process being in a zombie state.

[0066] In the disclosed embodiment, after the SSL VPN tunnel is established, the service process periodically searches for the tunnel process in the system's process list. If the tunnel process is not found in the process list, it means that the tunnel has been disconnected, and the service process waits for the next heartbeat to search for the tunnel process again. If the tunnel process is found in the process list, the service process starts to send a keep-alive message to the tunnel process through a preset port. When the tunnel process receives the keep-alive message sent by the service process, it can immediately send a response message through a preset port to respond to the keep-alive message sent by the service process. If the service process receives the response message sent by the tunnel process in response to the keep-alive message, it means that the SSL VPN tunnel is normal; if the service process does not receive the response message sent by the tunnel process in response to the keep-alive message, it means that the SSL VPN tunnel is abnormal.

[0067] In an embodiment of the present disclosure, the service process starts to send keep-alive messages to the tunnel process through a preset port. The present disclosure does not specifically limit the preset port, for example, it can be a UDP port.

[0068] In some embodiments, the service process periodically searches for the tunnel process in the system process list, including:

[0069] A new timer is created through the service process, and the tunnel process is searched in the system process list at fixed time intervals.

[0070] The disclosed embodiment detects whether the SSL VPN tunnel is in an abnormal state through a heartbeat keep-alive mechanism, thereby solving the problem of SSL layer blocking from the network application layer, avoiding the problem of SSL VPN tunnel deadlock from the SSL layer, thereby avoiding the need to replace the SSL layer program on the SSLVPN server side, and reducing the cost of VPN operation, maintenance and deployment.

[0071] Accordingly, in some embodiments, when the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal includes:

[0072] Record the number of times the service process fails to receive the response message;

[0073] When the service process fails to receive the response message for a number of times exceeding a preset number, it is determined that the SSL VPN tunnel is abnormal.

[0074] The present disclosure does not specifically limit the preset number of times, which can be one, two or more. In some embodiments, the preset number of times is set to three times, and if the service process does not receive the response message sent by the tunnel process in response to the keep-alive message for more than three times, the tunnel process is judged to be in a dead state.

[0075] In some embodiments, when the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal further includes:

[0076] When the service process fails to receive the response message for more than a preset number of times, the service process analyzes the tunnel process log of the tunnel process to determine whether the context of the tunnel process log meets the tunnel abnormality feature; and / or

[0077] When the service process fails to receive the response message for more than a preset number of times, the service process performs line detection to detect whether the network connection between the client and the server is reachable;

[0078] The SSL VPN tunnel is determined to be abnormal when the context of the tunnel process log meets the tunnel abnormality feature and / or the network connection between the client and the server is reachable.

[0079] In the disclosed embodiment, since the SSL layer is blocked and no error message can be returned to the tunnel process, the tunnel process has been in a waiting state, so the log of the tunnel process has been recording the waiting for the response of the SSL layer. Therefore, the log of the tunnel process can be used as a basis for determining whether the tunnel is dead due to an abnormality in the SSL layer.

[0080] In the disclosed embodiment, the service process analyzes the tunnel process log of the tunnel process as a supplementary mechanism after the heartbeat keep-alive mechanism discovers an abnormality. When analyzing the tunnel process log, the service process monitors and promptly discovers tunnel abnormalities by comparing the log context of the tunnel process and based on the tunnel abnormality characteristics of the SSL VPN tunnel.

[0081] The embodiments of the present disclosure do not specifically limit the abnormal tunnel characteristics of the SSL VPN tunnel. In some embodiments, the abnormal tunnel characteristics of the SSL VPN tunnel include at least one of the following, but are not limited to the following situations:

[0082] In the tunnel process log, it is detected that the basic information of the data packets being transmitted when the blocking occurs is the same as the data packets entering the SSL VPN tunnel;

[0083] The security detection result of the failed data packet sent or received is recorded as correct in the tunnel process log;

[0084] In the tunnel process log, it is detected that the difference between the time when the data packet enters the SSL VPN tunnel and the time when the blockage occurs is within the preset range;

[0085] In the tunnel process log, it is detected that the log records of calling the SSL layer dynamic library function and waiting for the SSL layer dynamic library function response are incomplete;

[0086] No record of the tunnel process processing keep-alive messages is detected in the tunnel process log.

[0087] In the disclosed embodiment, when a data packet is sent through the SSL VPN tunnel, there will be corresponding log records. When a record is detected in the tunnel process log that the basic information of the data packet being transmitted when the blockage occurs is the same as the data packet entering the SSL VPN tunnel, it can be determined that the data packet entering the SSL VPN tunnel is the data packet that has been blocked.

[0088] In the embodiment of the present disclosure, when it is detected in the tunnel process log that the security detection result of the data packet that failed to be sent or received is a correct record, it is determined that an abnormality has occurred in the SSL VPN tunnel.

[0089] In an embodiment of the present disclosure, when a record is detected in the tunnel process log that the difference between the time when a data packet enters the SSL VPN tunnel and the time when the blockage occurs is within a preset range, it can be determined that the SSL VPN tunnel was blocked when the data packet entered the SSL VPN tunnel.

[0090] In the disclosed embodiment, the SSL layer interaction will be recorded in the SSL layer log. When it is detected in the tunnel process log that the log records of calling the SSL layer dynamic library function and waiting for the SSL layer dynamic library function response are incomplete, it is determined that an abnormality has occurred in the SSL VPN tunnel. In some embodiments, the incomplete log record means that there is a log record of calling the SSL layer dynamic library function, but there is no log record of the SSL layer dynamic library function response.

[0091] In the embodiment of the present disclosure, when no record of the tunnel process processing the keep-alive message is detected in the tunnel process log, it is determined that an abnormality occurs in the SSL VPN tunnel.

[0092] In the disclosed embodiment, the service process performs line detection as another supplementary mechanism after the heartbeat keep-alive mechanism discovers an abnormality. When the service process fails to receive a response message for more than a preset number of times, the client's service process creates a new network Socket connection to connect to the server. If the connection times out, it is determined that an abnormality has occurred in the SSL VPN tunnel.

[0093] In the disclosed embodiment, in the network full proxy mode, all network data packets of the client go through the tunnel. After the heartbeat keep-alive mechanism finds an abnormality, it is possible to determine whether the SSL VPN tunnel is abnormal by detecting whether the network connection between the client and the server is reachable. However, in the transparent access mode and network isolation mode, it is impossible to determine whether the SSL VPN tunnel is abnormal only by line detection. In this case, it is necessary to combine the log analysis of the above tunnel process to determine whether the SSL VPN tunnel is abnormal.

[0094] In some embodiments, before the service process of the SSL VPN tunnel queries the tunnel process of the SSLVPN tunnel at a preset time interval, the method further includes:

[0095] In response to the client exit instruction, the service process sends a disconnect instruction to the tunnel process;

[0096] The tunnel process sets the normal exit identifier to a preset value in response to the disconnect instruction;

[0097] When the service process detects that the normal exit identifier is not the preset value, the service process executes the step of querying the tunnel process of the SSL VPN tunnel at a preset time interval.

[0098] In the disclosed embodiment, the exit of the client will trigger the tunnel disconnection instruction. When the tunnel process executes the disconnection instruction, it is in a complex working state and cannot respond to the keep-alive message sent by the service process in time, so the service process determines that the SSLVPN tunnel is in a dead state. Therefore, it is also necessary to detect the state of the SSLVPN tunnel when disconnecting the tunnel to avoid the inability to disconnect the tunnel due to the SSLVPN tunnel being in a dead state.

[0099] In the disclosed embodiment, after the tunnel process receives the disconnection instruction sent by the service process, it first modifies the normal exit identifier in the shared memory, for example, it can be set to 1, and then performs the normal operation of disconnecting the tunnel. When the tunnel process disconnects the tunnel, the service process first checks the normal exit identifier in the shared memory. If it is not 1, it means that the tunnel process has not received the disconnection instruction or may be dead and unable to process the disconnection instruction. The service process then executes the step of querying the tunnel process of the SSLVPN tunnel at a preset time interval to further determine whether the tunnel process is dead; if it is 1, it means that the tunnel process has received the disconnection instruction and has started to process the operation of disconnecting the tunnel normally, and the service process no longer uses heartbeat to keep alive to determine whether the tunnel process is dead.

[0100] In some embodiments, after determining that the SSL VPN tunnel is abnormal, it is also necessary to handle the abnormality so that the client can restore the network status. There are different abnormality handling mechanisms for different VPN working modes.

[0101] In the disclosed embodiment, in the transparent access mode, when an abnormality occurs while the SSL VPN tunnel is working, the service process restarts the tunnel process so that the tunnel process rebuilds the SSL VPN tunnel according to the tunnel information in the shared memory.

[0102] In some embodiments, the service process restarts the tunnel process, including:

[0103] The service process confirms that the tunnel information in the shared memory is complete;

[0104] Set the status flag of re-establishing the SSL VPN tunnel;

[0105] End the tunnel process and pull it back up;

[0106] After the tunnel process is restarted, it clears the last SSL connection and residual routes, reads the tunnel information in the shared memory, and negotiates SSL with the server again to establish a new tunnel.

[0107] In the disclosed embodiment, in transparent access mode, when an exception occurs when the SSL VPN tunnel is disconnected, the service process clears the tunnel information in the shared memory, restarts the virtual network card and restores the client's routing table.

[0108] In the disclosed embodiments, in the network isolation mode and the network full proxy mode, when an abnormality occurs in the SSL VPN tunnel, the service process disconnects the SSL VPN tunnel and restores the client's routing table.

[0109] In the disclosed embodiments, in the network isolation mode and the network full proxy mode, the default gateway of the egress physical network card in the client routing table will be set to the IP address of the server. When the SSL VPN tunnel is dead, the default gateway will become unavailable due to network reasons. The client cannot perform SSL negotiation with the server to establish a new tunnel again. Therefore, the client's service process can only perform the tunnel disconnection operation.

[0110] In the disclosed embodiment, the operation of restoring the client routing table is normally performed by the tunnel process, and is abnormally performed by the service process.

[0111] In some embodiments, after the terminal network status returns to normal, the client's service process will record the anomaly detection information and anomaly handling information of this tunnel anomaly, so that the service process can predict possible SSL VPN tunnel anomalies and handle them early, thereby reducing the time overhead and network transmission data loss caused by tunnel anomalies; after the network status is restored, the service process will report the anomaly detection information and anomaly handling information to the server; when the SSL VPN tunnel is disconnected, the service process will log out of the session to the server.

[0112] In the disclosed embodiment, the anomaly detection information and anomaly handling information of the tunnel anomaly are recorded to predict possible SSL VPN tunnel anomalies. The reason is that before and after the SSL VPN tunnel anomaly, the anomaly detection information and anomaly handling information of the tunnel anomaly will continue to be recorded in the log. This information can be used as characteristic information of the SSL VPN tunnel anomaly. When similar information appears in the log again, it indicates that a tunnel anomaly may occur, thereby predicting and handling it in advance.

[0113] In the disclosed embodiment, tunnel anomalies usually occur when the network environment is poor. The tunnel itself has a reconnection mechanism. When the network environment is abnormal, the tunnel will automatically reconnect and record it in the log. By analyzing the tunnel process log, it is possible to predict the possibility of tunnel anomalies.

[0114] Second, refer to Figure 6 , an embodiment of the present disclosure provides an electronic device, comprising:

[0115] One or more processors 101;

[0116] A memory 102, on which one or more programs are stored. When the one or more programs are executed by one or more processors, the one or more processors implement the tunnel anomaly detection method according to the first aspect of the embodiment of the present disclosure;

[0117] One or more I / O interfaces 103 are connected between the processor and the memory and are configured to implement information exchange between the processor and the memory.

[0118] Among them, the processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU) and the like; the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus) and the like.

[0119] In some embodiments, the processor 101 , the memory 102 , and the I / O interface 103 are connected to each other via a bus 104 , and further connected to other components of the computing device.

[0120] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the method for detecting tunnel anomalies described in the first aspect of the embodiment of the present disclosure is implemented.

[0121] In a fourth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the method for detecting tunnel anomalies described in the first aspect of the embodiment of the present disclosure.

[0122] In a fifth aspect, an embodiment of the present disclosure provides a tunnel anomaly detection device, which is applied to a client and includes:

[0123] A query module configured as a service process of the SSL VPN tunnel to query the tunnel process of the SSL VPN tunnel at a preset time interval;

[0124] A keep-alive module, configured to, when the tunnel process is found, cause the service process to send a keep-alive message to the tunnel process;

[0125] The judgment module is configured to determine that the SSL VPN tunnel is abnormal when the service process does not receive a response message sent by the tunnel process in response to the keep-alive message.

[0126] In some embodiments, the judgment module is configured to: record the number of times the service process fails to receive the response message; and determine that the SSL VPN tunnel is abnormal if the number of times the service process fails to receive the response message exceeds a preset number of times.

[0127] In some embodiments, the judgment module is configured as follows: when the service process has not received the response message for more than a preset number of times, the service process analyzes the tunnel process log of the tunnel process to determine whether the context of the tunnel process log meets the tunnel abnormality characteristics; and / or when the service process has not received the response message for more than a preset number of times, the service process performs line detection to detect whether the network connection between the client and the server is reachable; when the context of the tunnel process log meets the tunnel abnormality characteristics, and / or the network connection between the client and the server is reachable, the SSL VPN tunnel is determined to be abnormal.

[0128] In some embodiments, determining whether the context of the tunnel process log meets the tunnel anomaly feature includes: when a record is detected in the tunnel process log that the basic information of the data packet being transmitted when the blockage occurs is the same as the basic information of the data packet entering the SSL VPN tunnel, determining that the context of the tunnel process log meets the tunnel anomaly feature; and / or when a record is detected in the tunnel process log that the security detection result of the data packet that failed to be sent or received is correct, determining that the context of the tunnel process log meets the tunnel anomaly feature; and / or when a record is detected in the tunnel process log that the difference between the time when the data packet enters the SSL VPN tunnel and the time when the blockage occurs is within a preset range, determining that the context of the tunnel process log meets the tunnel anomaly feature; and / or when a log record of calling an SSL layer dynamic library function and waiting for a response from the SSL layer dynamic library function is incomplete, determining that the context of the tunnel process log meets the tunnel anomaly feature; when no record of the tunnel process processing the keep-alive message is detected in the tunnel process log, determining that the context of the tunnel process log meets the tunnel anomaly feature.

[0129] In some embodiments, the keep-alive module is configured as follows: the service process sends a keep-alive message to the tunnel process through a preset UDP port; and the tunnel process sends a response message to the service process through the preset UDP port.

[0130] In some embodiments, the detection device also includes: a disconnect module, configured to respond to a client exit instruction, the service process sending a disconnect instruction to the tunnel process; the tunnel process sets a normal exit identifier to a preset value in response to the disconnect instruction; when the service process detects that the normal exit identifier is not the preset value, the query module executes the step of querying the tunnel process of the SSL VPN tunnel at a preset time interval.

[0131] In some embodiments, the detection device also includes a recovery module, which is configured as follows: in transparent access mode, when an exception occurs when the SSL VPN tunnel is working, the service process restarts the tunnel process so that the tunnel process rebuilds the SSL VPN tunnel according to the tunnel information in the shared memory; when an exception occurs when the SSL VPN tunnel is disconnected, the service process clears the tunnel information in the shared memory, restarts the virtual network card and restores the client's routing table; in network isolation mode and network full proxy mode, when an exception occurs in the SSL VPN tunnel, the service process disconnects the SSLVPN tunnel and restores the client's routing table.

[0132] In some embodiments, the recovery module is configured as follows: the service process records exception detection information and exception handling information so that the service process can predict the possible SSL VPN tunnel exceptions; after the network status is restored, the service process reports the exception detection information and the exception handling information to the server; and / or when the SSL VPN tunnel is disconnected, the service process logs out of the session to the server.

[0133] In order to enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of the present disclosure, the technical solutions provided by the embodiments of the present disclosure are described in detail below through specific embodiments:

[0134] Embodiment 1

[0135] like Figure 7 As shown, the detection and processing of SSL VPN tunnel anomalies in this embodiment includes the following process:

[0136] (1) After the SSL VPN tunnel is established, the service process sets a fixed heartbeat interval; when the client exits, if the tunnel process does not receive an exit instruction, execute step (2); if the tunnel process receives an exit instruction, execute step (7);

[0137] (2) Wait for the heartbeat interval to end and search for the tunnel process in the system's process list;

[0138] (3) If the tunnel process is not found, it means that the tunnel is disconnected and the tunnel process will be searched again after the next heartbeat.

[0139] (4) After finding the tunnel process, the service process sends a keep-alive message to the tunnel process and waits for the tunnel process to send a response message in response to the keep-alive message;

[0140] (5) If the service process does not receive a response message for a number of times that does not exceed the preset number, it indicates that the SSL VPN tunnel is normal and waits for the next heartbeat to search for the tunnel process again;

[0141] (6) When the number of times that the service process does not receive a response message exceeds a preset number, the SSL VPN tunnel is determined to be abnormal by combining the context of the tunnel process log or performing line detection on the network connection between the client and the server through the service process.

[0142] (7) In transparent access mode, if the SSL VPN tunnel has been disconnected, the service process clears the tunnel information in the shared memory, restarts the virtual network card and restores the client's routing table; if the SSL VPN tunnel is working, the service process restarts the tunnel process so that the tunnel process rebuilds the SSL VPN tunnel based on the tunnel information in the shared memory.

[0143] Embodiment 2

[0144] This embodiment is applied to the phenomenon that the client network environment fluctuates and causes the SSL VPN tunnel to freeze. In normal network environment fluctuations, the SSL VPN tunnel will be reestablished through the no-flow disconnection reconnection mechanism, but in some special cases, such as interruptions in the SSL layer sending and receiving data packets, or interruptions or infinite waiting when the client and the server reestablish SSL negotiation, the tunnel freezes and cannot continue to work.

[0145] The specific process of detecting SSL VPN tunnel anomalies and reestablishing SSL VPN tunnels in this embodiment is as follows:

[0146] (1) After the SSL VPN tunnel is established, the service process sets a fixed heartbeat interval;

[0147] (2) Wait for the heartbeat interval to end and search for the tunnel process in the system's process list;

[0148] (3) After finding the tunnel process, the service process sends a keep-alive message to the tunnel process and waits for the tunnel process to send a response message in response to the keep-alive message;

[0149] (4) When the number of times that the service process does not receive a response message exceeds a preset number, by analyzing the context of the tunnel process log, if it is detected in the tunnel process log that the log records of calling the SSL layer dynamic library function and waiting for the SSL layer dynamic library function to respond are incomplete, it is determined that an abnormality has occurred in the SSL VPN tunnel;

[0150] (5) The service process restarts the tunnel process so that the tunnel process rebuilds the SSLVPN tunnel based on the tunnel information in the shared memory.

[0151] This embodiment uses an SSL VPN client to promptly detect abnormal status of the SSL VPN tunnel, promptly disconnect the SSLVPN tunnel, and use the tunnel information in the shared memory to unconsciously rebuild the tunnel, thereby restoring the normal working state of the VPN and avoiding the trouble of users manually restarting the client and re-authenticating.

[0152] Embodiment 3

[0153] This embodiment is applied to the phenomenon that the SSL VPN tunnel is frozen due to switching between the intranet and the extranet. Assume that a terminal user can use VPN to access the intranet environment in the extranet environment. This VPN server is deployed in the extranet environment, and when the terminal directly accesses the intranet environment, it will not be able to continue to establish a connection with the server. After the user completes the VPN access to the intranet at home (extranet environment), he leaves home and goes to the office (intranet environment) without exiting the VPN client. After the user arrives at the office, the computer enters the intranet environment, but there will be abnormal access to the intranet. The reason for this problem is that the VPN client that has not exited is disconnected from the server, and the infinite reconnection mechanism of the client causes the client to continuously rebuild the SSL connection. The imperfect timeout waiting mechanism of the SSL layer causes the tunnel process to freeze, which in turn causes the tunnel to be paralyzed. In addition, the tunnel is not disconnected, resulting in abnormal routing of the user's computer, affecting its access to the intranet.

[0154] The specific process of detecting SSL VPN tunnel abnormality and disconnecting SSL VPN tunnel in this embodiment is as follows:

[0155] (1) After the SSL VPN tunnel is established, the service process sets a fixed heartbeat interval;

[0156] (2) When the client exits, the tunnel process does not receive the exit command. After waiting for the heartbeat interval to end, the service process searches for the tunnel process in the system process list;

[0157] (3) After finding the tunnel process, the service process sends a keep-alive message to the tunnel process and waits for the tunnel process to send a response message in response to the keep-alive message;

[0158] (4) When the service process fails to receive a response message for more than a preset number of times, the client's service process creates a new network socket connection to the server. If the connection times out multiple times, it is determined that the SSL VPN tunnel is abnormal.

[0159] (5) In response to the client exit instruction, after the tunnel process receives the disconnection instruction sent by the service process, it first modifies the normal exit identifier in the shared memory, sets the normal exit identifier to 1, and then performs a normal tunnel disconnection operation;

[0160] (6) The service process restores the routing table of the client.

[0161] This embodiment uses an SSL VPN client to promptly detect abnormal tunnel status, disconnect the tunnel in time, and restore the normal network status of the user's computer. This effectively reduces the tunnel deadlock problem caused by SSL connection failures in the SSL VPN tunnel, improves the stability of the SSL VPN tunnel in a complex network environment, reduces the failure rate of the SSL VPN, and improves the survivability of the product.

[0162] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0163] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly noted, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A method for detecting tunnel anomalies, applied to a client, comprising: The service process of the SSL VPN tunnel queries the tunnel process of the SSL VPN tunnel at a preset time interval; When the tunnel process is found, the service process sends a keep-alive message to the tunnel process; In a case where the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, it is determined that the SSL VPN tunnel is abnormal.

2. The detection method according to claim 1, wherein: In a case where the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal includes: Record the number of times the service process fails to receive the response message; When the service process fails to receive the response message for a number of times exceeding a preset number, it is determined that the SSLVPN tunnel is abnormal.

3. The detection method according to claim 2, wherein: In the case where the service process does not receive a response message sent by the tunnel process in response to the keep-alive message, determining that the SSL VPN tunnel is abnormal further includes: When the service process fails to receive the response message for more than a preset number of times, the service process analyzes the tunnel process log of the tunnel process to determine whether the context of the tunnel process log meets the tunnel abnormality feature; and / or When the service process fails to receive the response message for more than a preset number of times, the service process performs line detection to detect whether the network connection between the client and the server is reachable; The SSL VPN tunnel is determined to be abnormal when the context of the tunnel process log meets the tunnel abnormality feature and / or the network connection between the client and the server is reachable.

4. The detection method according to claim 3, wherein: Determining whether the context of the tunnel process log meets the tunnel abnormality feature includes: In the case where a record is detected in the tunnel process log that the data packet being transmitted when the blockage occurs has the same basic information as the data packet entering the SSL VPN tunnel, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or In the case where a security detection result of a data packet that fails to be sent or received is detected as a correct record in the tunnel process log, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or When it is detected in the tunnel process log that the difference between the time when the data packet enters the SSL VPN tunnel and the time when the blockage occurs is within a preset range, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or When it is detected in the tunnel process log that the log records of calling the SSL layer dynamic library function and waiting for the response of the SSL layer dynamic library function are incomplete, determining that the context of the tunnel process log meets the tunnel abnormality feature; and / or When no record of the tunnel process processing the keep-alive message is detected in the tunnel process log, it is determined that the context of the tunnel process log meets the tunnel abnormality feature.

5. The detection method according to any one of claims 1 to 4, wherein: The service process sends a keep-alive message to the tunnel process, including: The service process sends a keep-alive message to the tunnel process via a preset UDP port; The tunnel process sends a response message to the service process through the preset UDP port.

6. The detection method according to any one of claims 1 to 4, wherein: Before the service process of the SSL VPN tunnel queries the tunnel process of the SSL VPN tunnel at a preset time interval, the method further includes: In response to the client exit instruction, the service process sends a disconnect instruction to the tunnel process; The tunnel process sets the normal exit identifier to a preset value in response to the disconnect instruction; When the service process detects that the normal exit identifier is not the preset value, the service process executes the step of querying the tunnel process of the SSL VPN tunnel at a preset time interval.

7. The detection method according to any one of claims 1 to 4, wherein: After determining that the SSL VPN tunnel is abnormal, the method further includes: In the transparent access mode, when an exception occurs when the SSL VPN tunnel is working, the service process restarts the tunnel process so that the tunnel process rebuilds the SSL VPN tunnel according to the tunnel information in the shared memory; When an exception occurs when the SSL VPN tunnel is disconnected, the service process clears the tunnel information in the shared memory, restarts the virtual network card and restores the routing table of the client; In the network isolation mode and the network full proxy mode, when an abnormality occurs in the SSL VPN tunnel, the service process disconnects the SSL VPN tunnel and restores the routing table of the client.

8. The detection method according to any one of claims 1 to 4, wherein: After determining that the SSL VPN tunnel is abnormal, the method further includes: The service process records the anomaly detection information and the anomaly handling information so that the service process can make a prediction on the possible anomaly of the SSL VPN tunnel; After the network status is restored, the service process reports the exception detection information and the exception handling information to the service end; and / or When the SSL VPN tunnel is disconnected, the service process logs out of the session to the server.

9. An electronic device, comprising: one or more processors; A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the tunnel anomaly detection method according to any one of claims 1 to 8.

10. A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method for detecting tunnel anomalies according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the method for detecting tunnel anomalies according to any one of claims 1 to 8 is implemented.

Images