Gatekeeper deployment method and device, storage medium and computer program product

Abstract

The invention provides a gatekeeper deployment method and device, a storage medium and a computer program product, and the method comprises the steps: receiving own device resource information sent by a sub-engine after a main engine establishes communication connection with the sub-engine; the main engine carries out statistics on self equipment resource information to obtain resource statistical information; after the main engine is connected with service servers at the two ends of the Internet access and obtains the to-be-synchronized data, an expected strategy corresponding to the to-be-synchronized data is obtained; the main engine determines a distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy; the main engine issues a distribution strategy to the sub-engines; and after receiving the distribution strategy, the sub-engine creates a self-synchronization strategy according to the distribution strategy and operates the self-synchronization strategy. According to the method, the problem that a high-concurrency and high-performance data synchronization environment is complex to build can be solved through distributed information interaction of the father-son engine, so that manual participation is avoided, the time cost of manual operation is reduced, and the processing efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network gate deployment method, device, storage medium and computer program product. Background Art

[0002] As a physical isolation device between different networks and different security domains, the network gate basically adopts the technical architecture of "internal machine + dedicated hardware communication card + external machine". It usually has data synchronization functions such as database synchronization and file synchronization. One end is connected to the internal machine for data collection, and the other end is connected to the external machine for data reception and writing, or vice versa. Large database servers and file servers are the infrastructure and necessary conditions for environments such as "on the cloud", "cloud storage", and "cloud computing". In the synchronization process of cloud storage backup, migration, long-term data archiving, etc., network gate products are required to quickly and securely migrate data and ensure that the data is correct and complete. However, a single network gate is far from achieving the performance required for cloud storage data synchronization. Multiple network gates are required to configure different synchronization tables or synchronization directories for parallel processing. In the existing technology, each device needs to be manually tested for connection and configuration during the construction process. In a cloud storage environment, especially when there are a large number of network gate devices, policy configuration becomes extremely difficult. Summary of the invention

[0003] The purpose of this application is to provide a network gate deployment method, device, storage medium and computer program product, which can solve the complex problem of building a high-concurrency and high-performance data synchronization environment through distributed information interaction of parent-child engines, thereby avoiding manual participation, reducing the time cost of manual operation, and improving processing efficiency.

[0004] In a first aspect, the present application provides a network gate deployment method, the network gate deployment method is applied to a distributed network gate system, the distributed network gate system includes a main engine and a sub-engine, the method includes:

[0005] After establishing a communication connection with the sub-engine, the main engine receives its own device resource information sent by the sub-engine;

[0006] The main engine collects statistics on the resource information of its own device to obtain resource statistical information;

[0007] The main engine is connected to the business servers at both ends of the gateway and obtains the data to be synchronized, and then obtains the expected policy corresponding to the data to be synchronized;

[0008] The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy;

[0009] The main engine sends the distribution strategy to the sub-engine;

[0010] After receiving the distribution strategy, the sub-engine creates its own synchronization strategy according to the distribution strategy and runs the own synchronization strategy.

[0011] In the above implementation process, the network gate deployment method is applied to the distributed network gate system, which includes a main engine and a sub-engine. Based on this, it can be known that the parent-child relationship constructed in this application is the parent-child relationship between the main engine and the sub-engine, so that the main engine can complete the distributed deployment by controlling the sub-engine, thereby facilitating the solution of the complex problem of building a high-concurrency and high-performance data synchronization environment. Specifically, in this method, the main engine can first obtain the resource information of its own device sent by the sub-engine, and count the resource information of its own device to obtain resource statistical information; it can be seen that this method can complete the collection and statistics of basic information, so as to facilitate subsequent display and control scheduling. Then, the main engine obtains the data to be synchronized and the expected strategy, and determines the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy; it can be seen that this method can be uniformly scheduled by the main engine to achieve a simple, fast, accurate and effective network gate distributed deployment effect. Finally, the main engine sends the distribution strategy to the sub-engine, and after the sub-engine receives the distribution strategy, the sub-engine can create its own synchronization strategy according to the distribution strategy and run its own synchronization strategy. It can be seen that the sub-engine can run the corresponding strategy on its own when receiving the distribution strategy, so as to realize the normal operation of the distributed network gate, thereby effectively solving the complex problem of building a high-concurrency and high-performance data synchronization environment.

[0012] Furthermore, the method further comprises:

[0013] The main engine starts the monitoring service and opens the monitoring port;

[0014] The sub-engine configures the IP of the main engine, the port of the main engine and the sub-engine management IP address information of the same engine group;

[0015] The sub-engine starts the port service and tests the connection with the main engine;

[0016] After the test connection is passed, the sub-engine establishes a communication connection with the main engine;

[0017] The sub-engine sends its own device resource information to the main engine; wherein, the own device resource information at least includes all interface addresses of the sub-engine, engine group information where the sub-engine is located, basic device information of the sub-engine and communication connection status, and the basic device information at least includes device CPU information, device memory information and disk usage.

[0018] In the above implementation process, the method can achieve efficient communication mechanism, flexible engine group management, automated connection testing and establishment, and comprehensive resource information management, thereby significantly improving the overall performance and stability of the distributed system.

[0019] Furthermore, the main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy, including:

[0020] The main engine sends a test connection command corresponding to the expected strategy to the sub-engine;

[0021] The sub-engine determines the service IP addresses of the service servers at both ends of the network gate in the expected strategy based on the test connection command;

[0022] The sub-engine performs a reachability detection on the service IP to obtain a detection result; wherein, when the detection is successful, the detection result at least includes the service IP communicated with the service server and the existing strategy of the sub-engine;

[0023] The main engine receives the detection result returned by the sub-engine;

[0024] The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information, the expected strategy and the detection result.

[0025] In the above implementation process, the method can realize accurate service IP reachability detection, and realize dynamic policy adjustment and optimization through fusion decision of comprehensive information, so as to improve the reliability and stability of the distributed system.

[0026] Furthermore, the main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information, the expected strategy and the detection result, including:

[0027] The main engine determines the performance information of the sub-engine according to the resource statistical information when the detection result indicates that the detection is successful;

[0028] The main engine determines a distribution strategy corresponding to the sub-engine according to the expected strategy and the performance information of the sub-engine.

[0029] In the above implementation process, the method can determine the corresponding distribution strategy based on the performance information to optimize resource utilization, thereby enhancing the response speed and stability of the system.

[0030] Furthermore, after the main engine sends the distribution strategy to the sub-engine, the method further includes:

[0031] When an exception occurs in the process of sending the distribution strategy, the main engine performs failure processing.

[0032] In the above implementation process, the method can automatically perform failure processing when an abnormal situation occurs, thereby achieving the effect of automatic resolution of the abnormality.

[0033] Furthermore, when an exception occurs in the process of issuing the distribution strategy, the main engine performs failure processing, including:

[0034] The main engine detects whether the sub-engine is normal;

[0035] When the sub-engine is normal, the main engine determines whether the upstream and downstream structures are complete by reorganizing the test connection;

[0036] When the upstream and downstream structures are complete, the main engine re-issues the distribution strategy to the sub-engine;

[0037] When the main engine successfully sends the distribution strategy, it exits the failure processing.

[0038] In the above implementation process, the method can detect problems layer by layer through the operation of the sub-engine, the integrity of the upstream and downstream structures, and the top frame of the policy delivery, thereby improving the detection rate of abnormal causes and automatically redeploying when the abnormality disappears.

[0039] Furthermore, the method further comprises:

[0040] When the main engine detects that the sub-engine is abnormal, the upstream and downstream structures are incomplete, or the distribution strategy fails to be issued, the main engine outputs an abnormal notification message.

[0041] In the above implementation process, the method can output a corresponding notification message when the abnormal cause is determined so that the staff can handle it.

[0042] Furthermore, after the sub-engine runs the self-synchronization strategy, the method further includes:

[0043] When the sub-engine fails to execute the policy, the sub-engine sends a sub-engine execution failure message to the main engine;

[0044] When receiving the execution failure message of the sub-engine, the main engine performs failure processing.

[0045] In the above implementation process, the method can also trigger the failure handling process on the sub-engine side, thereby completing the comprehensiveness of failure handling and further improving the operational stability of the distributed system.

[0046] The second aspect of the present application provides a distributed network gate system, the distributed network gate system includes a main engine and a sub-engine, wherein:

[0047] The main engine is used to receive the own device resource information sent by the sub-engine after establishing a communication connection with the sub-engine;

[0048] The main engine is further used to collect statistics on the resource information of the own device to obtain resource statistical information;

[0049] The main engine is also used to obtain the expected policy corresponding to the data to be synchronized after the business servers at both ends of the gateway are connected and the data to be synchronized is obtained;

[0050] The main engine is further used to determine the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy;

[0051] The main engine is further used to send the distribution strategy to the sub-engine;

[0052] The sub-engine is used to create its own synchronization strategy according to the distribution strategy after receiving the distribution strategy, and run the own synchronization strategy.

[0053] Furthermore, the main engine is also used to start the monitoring service and open the monitoring port;

[0054] The sub-engine is also used to configure the IP of the main engine, the port of the main engine and the sub-engine management IP address information of the same engine group;

[0055] The sub-engine is also used to start the port service and test the connection with the main engine;

[0056] The sub-engine is further used to establish a communication connection with the main engine after the test connection passes;

[0057] The sub-engine is also used to send its own device resource information to the main engine; wherein the own device resource information at least includes all interface addresses of the sub-engine, engine group information where the sub-engine is located, basic device information of the sub-engine and communication connection status, and the basic device information at least includes device CPU information, device memory information and disk usage.

[0058] Further, the main engine is specifically used to send a test connection command corresponding to the expected strategy to the sub-engine;

[0059] The sub-engine is specifically used to determine the service IP addresses of the service servers at both ends of the network gate in the expected strategy based on the test connection command;

[0060] The sub-engine is further used to perform reachability detection on the service IP to obtain a detection result; wherein, when the detection is successful, the detection result at least includes the service IP communicated with the service server and the existing strategy of the sub-engine;

[0061] The main engine is further configured to receive the detection result returned by the sub-engine;

[0062] The main engine is further configured to determine a distribution strategy corresponding to the sub-engine according to the resource statistical information, the expected strategy and the detection result.

[0063] Furthermore, the main engine is further configured to determine the performance information of the sub-engine according to the resource statistical information when the detection result indicates that the detection is successful;

[0064] The main engine is further configured to determine a distribution strategy corresponding to the sub-engine according to the expected strategy and the performance information of the sub-engine.

[0065] Furthermore, the main engine is further configured to perform failure processing when an exception occurs in the process of issuing the distribution strategy after issuing the distribution strategy to the sub-engine.

[0066] Furthermore, the main engine is specifically used to detect whether the sub-engine is normal;

[0067] The main engine is further configured to determine whether the upstream and downstream structures are complete by reorganizing the test connection when the sub-engine is normal;

[0068] The main engine is further configured to re-issue the distribution strategy to the sub-engine when the upstream and downstream structures are complete;

[0069] The main engine is further configured to exit failure processing when the distribution strategy is successfully issued.

[0070] Furthermore, the main engine is also used to output an abnormality notification message when it is detected that the sub-engine is abnormal, the upstream and downstream structures are incomplete, or the distribution strategy fails to be issued.

[0071] Furthermore, the sub-engine is further configured to send a sub-engine execution failure message to the main engine after the sub-engine runs the self-synchronization strategy and when a strategy execution failure occurs;

[0072] The main engine is further configured to perform failure processing upon receiving a message indicating that the sub-engine has failed to execute.

[0073] A third aspect of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network gate deployment method described in any one of the first aspects of the present application.

[0074] A fourth aspect of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the network gate deployment method described in any one of the first aspect of the present application is executed.

[0075] A fifth aspect of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the network gate deployment method described in any one of the first aspects of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0077] Figure 1 A schematic diagram of a flow chart of a network gate deployment method provided in an embodiment of the present application;

[0078] Figure 2 A flowchart of another method for deploying a network gate provided in an embodiment of the present application;

[0079] Figure 3 A schematic diagram of an example flow of a method for deploying a network gate provided in an embodiment of the present application;

[0080] Figure 4 A schematic diagram of the structure of a distributed network firewall system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0082] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0083] Example 1

[0084] Please see Figure 1 , Figure 1 A schematic flow chart of a method for deploying a network gate provided in this embodiment. The method for deploying a network gate is applied to a distributed network gate system, the distributed network gate system includes a main engine and a sub-engine, and the method includes:

[0085] S101. After establishing a communication connection with a sub-engine, the main engine receives its own device resource information sent by the sub-engine.

[0086] S102: The main engine collects statistics on its own equipment resource information to obtain resource statistical information.

[0087] S103: After the main engine is connected to the business servers at both ends of the gateway and obtains the data to be synchronized, it obtains the expected policy corresponding to the data to be synchronized.

[0088] S104: The main engine determines a distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy.

[0089] S105: The main engine sends the distribution strategy to the sub-engine.

[0090] S201. After receiving the distribution strategy, the sub-engine creates its own synchronization strategy according to the distribution strategy and runs its own synchronization strategy.

[0091] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0092] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0093] It can be seen that the implementation of the network gate deployment method described in this embodiment can automatically complete the construction and maintenance work, thereby achieving the effect of saving costs, improving processing efficiency, and reducing manual operation time costs. At the same time, the main engine can also perform task distribution calculations to ensure that the distribution quantity is proportional to the resource utilization rate, thereby improving the resource utilization rate of each device.

[0094] Example 2

[0095] Please see Figure 2 , Figure 2 A schematic flow chart of a method for deploying a network gate provided in this embodiment. The method for deploying a network gate is applied to a distributed network gate system, the distributed network gate system includes a main engine and a sub-engine, and the method includes:

[0096] S301, the main engine starts the monitoring service and opens the monitoring port.

[0097] S401: The sub-engine configures the IP address of the main engine, the port of the main engine, and the sub-engine management IP address information of the same engine group.

[0098] In this embodiment, the sub-engine can automatically configure the main engine IP address, port and the management address of the same engine group. Specifically, the engine group refers to the two sub-engine topologies used to implement the complete data synchronization process from the source server to the destination server.

[0099] S402: The sub-engine starts the port service and tests the connection with the main engine.

[0100] S403: After the test connection is passed, the sub-engine establishes a communication connection with the main engine.

[0101] In this embodiment, the sub-engine has two situations: upward test connection and downward test connection.

[0102] In this embodiment, the upward test connection refers to testing whether it is possible to connect to the main engine after the information configuration is completed; and the downward test connection refers to the subsequent reachability detection of the service IP according to the requirements of the main engine when the test connection command sent by the main engine is received.

[0103] S404: The sub-engine sends its own device resource information to the main engine.

[0104] In this embodiment, the device resource information includes at least all interface addresses of the sub-engine, the engine group information where the sub-engine is located, the sub-engine's basic device information and the communication connection status. The basic device information includes at least the device CPU information, device memory information and disk usage.

[0105] In this embodiment, the sub-engine may send all its own device resource information to the main engine to complete the status reporting.

[0106] In this embodiment, the own device resource information may also include the existing policies and policy status (ie, activation status) of the sub-engine.

[0107] In this embodiment, the sub-engine can also report in real time during operation whether its own synchronization strategy is successfully created, the start-up and disable status of existing strategies, the operation synchronization status of data, etc.

[0108] S302: After establishing a communication connection with the sub-engine, the main engine receives its own device resource information sent by the sub-engine.

[0109] In this embodiment, after opening the listening port, the main engine waits for the sub-engine to connect, and after the sub-engine is connected, receives and counts the own device resource information sent by all the sub-engines.

[0110] S303: The main engine collects statistics on its own device resource information to obtain resource statistical information.

[0111] In this embodiment, the main engine can display all resource statistics of the sub-engines in the form of engine groups on the management page, including interface addresses, whether connections have been established, policy execution results, and basic information such as the device's CPU information, memory information, disk usage, etc.

[0112] S304: After the main engine is connected to the business servers at both ends of the gateway and obtains the data to be synchronized, it obtains the expected policy corresponding to the data to be synchronized.

[0113] In this embodiment, the main engine connects to the business servers at both ends of the network gate, and after obtaining the data to be synchronized, creates the expected strategy on the above-mentioned management page to achieve the desired final effect.

[0114] S305: The main engine sends a test connection command corresponding to the expected strategy to the sub-engine.

[0115] In this embodiment, the main engine can distribute the test connection command downward so that the sub-engines try to connect to the interfaces of the service servers at both ends.

[0116] S405: The sub-engine determines the service IP addresses of the service servers at both ends of the network gate in the expected strategy based on the test connection command.

[0117] In this embodiment, the sub-engine here refers to the engine group, that is, the detection process includes: detecting whether a sub-engine can connect to the source server, detecting whether another sub-engine can connect to the destination server, and whether a sub-engine can connect to another sub-engine.

[0118] S406: The sub-engine performs a reachability detection on the service IP and obtains a detection result.

[0119] In this embodiment, when the detection is successful, the detection result at least includes the service IP communicating with the service server and the existing strategy of the sub-engine.

[0120] S306: The main engine receives the detection result returned by the sub-engine.

[0121] S307: When the detection result indicates that the detection is successful, the main engine determines the performance information of the sub-engine according to the resource statistical information.

[0122] In this embodiment, the method may divide the reachable sub-engines into an engine group, which is called an available engine group.

[0123] S308: The main engine determines the distribution strategy corresponding to the sub-engine according to the expected strategy and the performance information of the sub-engine.

[0124] In this embodiment, since there is an existing strategy in the sub-engine, the method can determine whether there is a conflict between the existing strategy and the distribution strategy, and give priority to using the existing strategy of the sub-engine if there is a conflict. If there is no conflict, the distribution strategy is re-determined and the task distribution is performed.

[0125] In this embodiment, the main engine can calculate the number of tasks required to be distributed to each sub-engine and the specific policy content according to the expected strategy and the performance of multiple sub-engines (the actual performance of multiple single network gateways), and send the corresponding distribution strategy and tasks to the corresponding sub-engine.

[0126] S309: The main engine sends the distribution strategy to the sub-engine.

[0127] As an optional implementation, after the main engine sends the distribution strategy to the sub-engine, the method further includes:

[0128] When an exception occurs during the process of issuing a distribution policy, the main engine performs failure processing.

[0129] As a further optional implementation, when an exception occurs in the process of issuing the distribution strategy, the main engine performs failure processing, including:

[0130] The main engine detects whether the sub-engine is normal;

[0131] When the sub-engine is normal, the main engine determines whether the upstream and downstream structures are complete by reorganizing the test connection;

[0132] When the upstream and downstream structures of the main engine are complete, the distribution strategy is reissued to the sub-engines;

[0133] When the main engine successfully sends the distribution policy, it exits the failure processing.

[0134] As a further optional implementation, the method further includes:

[0135] When the main engine detects that the sub-engine is abnormal, the upstream and downstream structures are incomplete, or the distribution strategy fails, it outputs an abnormal notification message.

[0136] In this embodiment, when an abnormality occurs in the task delivery, the method can first determine whether all sub-engines are normal, then retest the connection to determine whether the upstream and downstream structures are complete, and finally try to re-deliver the distribution strategy and the corresponding task. If all the above tests fail or are abnormal, the administrator is notified immediately.

[0137] In this embodiment, if all the above tests fail or are abnormal, the method can also allow the main engine to directly distribute the distribution strategy to other available sub-engines so that other available sub-engines can perform the operation on its behalf.

[0138] S407: After receiving the distribution strategy, the sub-engine creates its own synchronization strategy according to the distribution strategy and runs its own synchronization strategy.

[0139] In this embodiment, after receiving the task processing result of the main engine, the sub-engine creates its own synchronization strategy on the sub-engine according to the distribution strategy and runs the self-synchronization strategy.

[0140] As an optional implementation, after the sub-engine runs its own synchronization strategy, the method further includes:

[0141] When a sub-engine fails to execute a policy, it sends a sub-engine execution failure message to the main engine;

[0142] When the main engine receives the sub-engine execution failure message, it performs failure processing.

[0143] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0144] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0145] It can be seen that the implementation of the network gate deployment method described in this embodiment can automatically complete the construction and maintenance work, thereby achieving the effect of saving costs, improving processing efficiency, and reducing manual operation time costs. At the same time, the main engine can also perform task distribution calculations to ensure that the distribution quantity is proportional to the resource utilization rate, thereby improving the resource utilization rate of each device.

[0146] Example 3

[0147] Please see Figure 3 , Figure 3 The following is a flow chart of an example of a method for deploying a network gate provided in this embodiment. The method for deploying a network gate is applied to a distributed network gate system, which includes a main engine and a sub-engine. The main engine includes a monitoring statistics module, a unified management module, a policy processing module, and a task processing module. The sub-engine includes a configuration service module, an information reporting module, and a task execution module. The module functions are described in detail as follows:

[0148] (1) Monitoring and statistics module (main engine): service startup, port monitoring, and receiving resource information of the statistics sub-engine;

[0149] (2) Unified management module (main engine): displays the resource status of all engine groups and sub-engines; summarizes the operation results and feedback;

[0150] (3) Policy processing module (main engine): create expected policies; test connections; calculate tasks; distribute tasks;

[0151] (4) Task processing module (main engine): Send processing results; handle failure of sent tasks;

[0152] (5) Configuration service module (sub-engine): configure the basic information required for connection;

[0153] (6) Information reporting module (sub-engine): status reporting; reporting of existing policies, reporting of policy status (creation status, enablement and disablement status, running status, etc.); upward and downward test connections;

[0154] (7) Task execution module (sub-engine): receives the strategy creation command and runs it.

[0155] Based on the distributed network gate system, the example process of the network gate deployment method is as follows:

[0156] E101, the main engine A opens the service in the monitoring statistics module, starts port monitoring, and waits for the sub-engine to connect.

[0157] E201. Sub-engine B configures the IP and port of main engine A and the management IP address information of sub-engine C in the same engine group as main engine A in the configuration service module.

[0158] E202, the internal terminal of sub-engine B can connect to the source business server 192.168.10.10, and the external terminal of sub-engine C can connect to the destination business server 192.168.20.20. The operations of sub-engine B and sub-engine C are the same and they belong to the same network gate. The subsequent examples only take the sub-engine as an example.

[0159] E203. The sub-engine starts the port service in the configuration service module and tests the connection to the main engine.

[0160] E204. After the test connection is passed, the sub-engine information reporting module sends its own device resource information to the main engine.

[0161] In this embodiment, the resource information includes but is not limited to all interface addresses, information about the engine group to which they belong, and the usage of the device's basic resources CPU, memory, and disk.

[0162] E102. The main engine receives sub-engine related information in the monitoring statistics module, and displays resource information and communication connection status sent by all sub-engine information reporting modules in the unified management interface.

[0163] E103, the main engine connects to the business servers at both ends of the network gate in the policy processing module, obtains the data to be synchronized, and creates and configures the expected policy on the interface, that is, the final effect to be achieved. Taking the database synchronization of 50,000 tables as an example, the expected policy is to synchronize the contents of 50,000 tables at the source end to 50,000 tables at the destination end.

[0164] E104. The main engine sends test connection information to the downstream sub-engine through the test connection of the policy processing module.

[0165] E205. When the sub-engine receives the test connection request sent by the main engine, it detects whether the business IPs 192.168.10.10 and 192.168.20.20 in the expected strategy are reachable according to the requirements of the main engine, and returns its own detection results. When the detection is successful, it reports the business IP communicated with the business server and related existing strategy information.

[0166] E105, the main engine determines that the device topology environment service is available based on the return results of each sub-engine and the existing strategy of the engine, and can be used as an execution sub-engine to process the task. In this example, there are 10 groups of sub-engines.

[0167] E106. The main engine will distribute the expected strategy to 10 execution sub-engines according to the specified structure (default equal distribution). Each execution sub-engine needs to synchronize 5,000 tables. The basic information of the database is the same, and only the synchronization table selected when configuring the strategy is different.

[0168] E206, after the execution sub-engine obtains the distribution strategy in the task execution module, it creates a complete synchronization strategy in its own engine. That is, the internal end of the execution sub-engine creates the source end strategy for database synchronization, selecting 5000 tables on the 192.168.10.10 server; the external end of the execution sub-engine creates the destination end strategy for database synchronization, selecting 5000 tables on the 192.168.20.20 server.

[0169] E207, after the task execution module starts the strategy according to the plan, the execution sub-engine keeps the distributed structure communication active. When the execution fails, it reports to the main engine in time, and the main engine handles the failure.

[0170] In this embodiment, failure processing includes: retrying to test the connection structure, checking the engine status, reissuing, and switching the policy to other available execution sub-engines.

[0171] In this embodiment, the report processing sequence is: service startup→status summary→policy distribution→policy execution.

[0172] E107. When the main engine summarizes the running result feedback in the same management module, after receiving the message of the sub-engine execution failure, it will perform the failure processing of the task in the task processing module: first determine whether the execution sub-engine in the unified management module is normal, and then reorganize the test connection of the policy processing module to check whether the upstream and downstream structures are complete, and then try to re-issue the corresponding policies of its subordinate tasks; if all fail or are abnormal, notify the administrator or directly distribute the policies to other available execution sub-engines.

[0173] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0174] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0175] It can be seen that the implementation of the network gate deployment method described in this embodiment can automatically complete the construction and maintenance work, thereby achieving the effect of saving costs, improving processing efficiency, and reducing manual operation time costs. At the same time, the main engine can also perform task distribution calculations to ensure that the distribution quantity is proportional to the resource utilization rate, thereby improving the resource utilization rate of each device.

[0176] Example 4

[0177] Please see Figure 4 , Figure 4 FIG. 1 is a schematic diagram of the structure of a distributed network firewall system provided in this embodiment. Figure 4 As shown, the distributed network gate system includes a main engine 500 and a sub-engine 600, wherein:

[0178] The main engine 500 is used to receive the device resource information of the main engine 500 after establishing a communication connection with the sub-engine 600;

[0179] The main engine 500 is also used to collect statistics on its own equipment resource information to obtain resource statistics information;

[0180] The main engine 500 is also used to obtain the expected policy corresponding to the data to be synchronized after the business servers at both ends of the gateway are connected and the data to be synchronized is obtained;

[0181] The main engine 500 is also used to determine the distribution strategy corresponding to the sub-engine 600 according to the resource statistical information and the expected strategy;

[0182] The main engine 500 is also used to send distribution strategies to the sub-engine 600;

[0183] The sub-engine 600 is used to create its own synchronization strategy according to the distribution strategy after receiving the distribution strategy, and run its own synchronization strategy.

[0184] As an optional implementation, the main engine 500 is also used to start the monitoring service and open the monitoring port;

[0185] The sub-engine 600 is also used to configure the IP of the main engine 500, the port of the main engine 500, and the sub-engine 600 management IP address information of the same engine group;

[0186] The sub-engine 600 is also used to start the port service and test the connection with the main engine 500;

[0187] The sub-engine 600 is also used to establish a communication connection with the main engine 500 after the test connection passes;

[0188] The sub-engine 600 is also used to send its own device resource information to the main engine 500; wherein, the own device resource information at least includes all interface addresses of the sub-engine 600, the engine group information where the sub-engine 600 is located, the basic device information of the sub-engine 600 and the communication connection status, and the basic device information at least includes the device CPU information, the device memory information and the disk usage.

[0189] As an optional implementation, the main engine 500 is specifically used to send a test connection command corresponding to the expected strategy to the sub-engine 600;

[0190] The sub-engine 600 is specifically used to determine the service IP addresses of the service servers at both ends of the network gate in the expected strategy based on the test connection command;

[0191] The sub-engine 600 is also used to perform reachability detection on the service IP and obtain detection results; wherein, when the detection is successful, the detection result at least includes the service IP communicated with the service server and the existing strategy of the sub-engine 600;

[0192] The main engine 500 is further configured to receive the detection result returned by the sub-engine 600;

[0193] The main engine 500 is further configured to determine a distribution strategy corresponding to the sub-engine 600 according to resource statistical information, expected strategies and detection results.

[0194] As an optional implementation, the main engine 500 is further configured to determine the performance information of the sub-engine 600 according to the resource statistical information when the detection result indicates that the detection is successful;

[0195] The main engine 500 is further configured to determine a distribution strategy corresponding to the sub-engine 600 according to the expected strategy and the performance information of the sub-engine 600.

[0196] As an optional implementation, the main engine 500 is further configured to perform failure processing when an exception occurs in the process of issuing the distribution policy after issuing the distribution policy to the sub-engine 600.

[0197] As an optional implementation, the main engine 500 is further used to detect whether the sub-engine 600 is normal;

[0198] The main engine 500 is also specifically used to determine whether the upstream and downstream structures are complete by reorganizing the test connection when the sub-engine 600 is normal;

[0199] The main engine 500 is also used to re-issue the distribution strategy to the sub-engine 600 when the upstream and downstream structures are complete;

[0200] The main engine 500 is also specifically used to exit failure processing when the distribution strategy is successfully issued.

[0201] As an optional implementation, the main engine 500 is further configured to output an abnormality notification message when detecting that the sub-engine 600 is abnormal, the upstream and downstream structures are incomplete, or the distribution strategy fails to be issued.

[0202] As an optional implementation, the sub-engine 600 is further configured to send a sub-engine 600 execution failure message to the main engine 500 after the sub-engine 600 runs its own synchronization strategy and when a strategy execution failure occurs;

[0203] The main engine 500 is also used to perform failure processing when receiving an execution failure message from the sub-engine 600.

[0204] In this embodiment, the explanation of the network gate deployment device can refer to the description in Example 1 or Example 2, and will not be further described in this embodiment.

[0205] It can be seen that the network gate deployment device described in this embodiment can automatically complete the construction and maintenance work, thereby achieving the effect of saving costs, improving processing efficiency, and reducing manual operation time costs. At the same time, the main engine can also perform task distribution calculations to ensure that the distribution quantity is proportional to the resource utilization rate, thereby improving the resource utilization rate of each device.

[0206] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network gate deployment method in embodiment 1 or embodiment 2 of the present application.

[0207] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the network gate deployment method in embodiment 1 or embodiment 2 of the present application is executed.

[0208] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0209] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0210] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0211] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0212] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0213] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for deploying a network gate, characterized in that: The network gate deployment method is applied to a distributed network gate system, the distributed network gate system includes a main engine and a sub-engine, and the method includes: After establishing a communication connection with the sub-engine, the main engine receives its own device resource information sent by the sub-engine; The main engine collects statistics on the resource information of its own device to obtain resource statistical information; The main engine is connected to the business servers at both ends of the gateway and obtains the data to be synchronized, and then obtains the expected policy corresponding to the data to be synchronized; The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy; The main engine sends the distribution strategy to the sub-engine; After receiving the distribution strategy, the sub-engine creates its own synchronization strategy according to the distribution strategy and runs the own synchronization strategy.

2. The method for deploying a network gate according to claim 1, characterized in that: The method further comprises: The main engine starts the monitoring service and opens the monitoring port; The sub-engine configures the IP of the main engine, the port of the main engine and the sub-engine management IP address information of the same engine group; The sub-engine starts the port service and tests the connection with the main engine; After the test connection is passed, the sub-engine establishes a communication connection with the main engine; The sub-engine sends its own device resource information to the main engine; wherein, the own device resource information at least includes all interface addresses of the sub-engine, engine group information where the sub-engine is located, basic device information of the sub-engine and communication connection status, and the basic device information at least includes device CPU information, device memory information and disk usage.

3. The method for deploying a network gate according to claim 1, characterized in that: The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information and the expected strategy, including: The main engine sends a test connection command corresponding to the expected strategy to the sub-engine; The sub-engine determines the service IP addresses of the service servers at both ends of the network gate in the expected strategy based on the test connection command; The sub-engine performs a reachability detection on the service IP to obtain a detection result; wherein, when the detection is successful, the detection result at least includes the service IP communicated with the service server and the existing strategy of the sub-engine; The main engine receives the detection result returned by the sub-engine; The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information, the expected strategy and the detection result.

4. The method for deploying a network gate according to claim 3, characterized in that: The main engine determines the distribution strategy corresponding to the sub-engine according to the resource statistical information, the expected strategy and the detection result, including: When the detection result indicates that the detection is successful, the main engine determines the performance information of the sub-engine according to the resource statistical information; The main engine determines a distribution strategy corresponding to the sub-engine according to the expected strategy and the performance information of the sub-engine.

5. The method for deploying a network gate according to claim 1, characterized in that: After the main engine sends the distribution strategy to the sub-engine, the method further includes: When an exception occurs in the process of sending the distribution strategy, the main engine performs failure processing.

6. The method for deploying a network gate according to claim 5, characterized in that: When an exception occurs in the process of issuing the distribution strategy, the main engine performs failure processing, including: The main engine detects whether the sub-engine is normal; When the sub-engine is normal, the main engine determines whether the upstream and downstream structures are complete by reorganizing the test connection; When the upstream and downstream structures are complete, the main engine re-issues the distribution strategy to the sub-engine; When the main engine successfully sends the distribution strategy, it exits the failure processing.

7. The method for deploying a network gate according to claim 6, characterized in that: The method further comprises: When the main engine detects that the sub-engine is abnormal, the upstream and downstream structures are incomplete, or the distribution strategy fails to be issued, the main engine outputs an abnormal notification message.

8. The method for deploying a network gate according to claim 1, characterized in that: After the sub-engine runs the self-synchronization strategy, the method further includes: When the sub-engine fails to execute the policy, the sub-engine sends a sub-engine execution failure message to the main engine; When receiving the execution failure message of the sub-engine, the main engine performs failure processing.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network gate deployment method according to any one of claims 1 to 8.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the network gate deployment method according to any one of claims 1 to 8 is executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the gatekeeper deployment method according to any one of claims 1 to 8 is executed.

Images