Load balancing client connections across servers of trusted network

Abstract

The embodiment of the invention relates to load balancing client connections across servers of a trusted network. In some examples, a proxy system establishes a client-side secure network tunnel between the proxy system and a client device, and establishes a plurality of server-side secure connections between the proxy system and respective servers of a trusted network. The proxy system load balances the plurality of connections of the client device in the client-side secure network tunnel across the servers of the trusted network through respective server-side secure connections of the plurality of server-side secure connections.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] Pursuant to 35 U.S.C. §119(e), this application claims the benefit of U.S. Provisional Patent Application No. 63 / 516,663, filed on July 31, 2023, which is hereby incorporated by reference. Background Art

[0003] In network computing, a secure network protocol suite allows clients and servers to communicate in a secure manner over a public network such as the Internet. This is advantageous because public networks are not secure and therefore present security risks. Public networks also form much of the backbone for worldwide communications and are therefore commonly used. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Some implementations of the present disclosure are described with reference to the following figures.

[0005] Figure 1 is a block diagram of an arrangement including a client device, a proxy server, a zero-trust network, and a secure network environment according to some examples.

[0006] Figure 2 is a flow diagram of a process according to some examples.

[0007] Figure 3 is a block diagram of a proxy system according to some examples.

[0008] Figure 4 is a block diagram of a storage medium storing machine-readable instructions according to some examples.

[0009] Throughout the drawings, the same reference numerals denote similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the dimensions of some components may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0010] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. In addition, some statements may apply to some inventive features but not to other features. In general, unless otherwise stated, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, the same numerals represent the same parts in several views.

[0011] Zero Trust Networks use a security model that establishes trust through the continuous authentication and monitoring of every network access attempt by entities such as users, devices, and programs. These entities are not trusted implicitly or by default (such as when an entity performs network access from a local network that is considered more secure than an external network). Instead, for each network access, the entity must be authenticated before network access is granted.

[0012] A client device can connect to a target resource of a zero-trust network. In some examples, the resources in the zero-trust network include a destination server, which is a computing entity (physical server or virtual server) on the zero-trust network, and the device can establish a secure connection through the zero-trust network to access the target endpoint. However, if the client device directly establishes a secure connection with the destination server, the destination server may be overloaded due to the client connection traffic between the client device and the destination server. In some examples, the client device may be a router, a gateway, or other type of network device, and the electronic device can be connected to other endpoints through the client device. If the client device supports a relatively large number of electronic devices, there may be a large number of client connections (corresponding to the traffic of the electronic device) between the client device and the destination server of the zero-trust network. If the destination server is overloaded, the network communication performance of the electronic device may be affected.

[0013] In addition, if the destination server is unavailable for any reason, the client device will have to terminate the secure connection with the destination server and re-establish another secure connection with another destination server in the zero trust network. When a destination server in a zero trust network is unavailable, re-establishing a new secure connection may cause the client device to temporarily lose service.

[0014] According to some implementations of the present disclosure, a proxy system may be provided between a client device and a trust network (such as a zero trust network) so as to establish a client-side secure network tunnel between the client device and the proxy system, and to establish a separate server-side secure connection between the proxy system and the corresponding destination server of the trust network. As used herein, a "secure network tunnel" may refer to a secure connection that may provide one or more client connections. A "client connection" may refer to a connection established between a client device and a target endpoint. In some examples, a client connection may include a Transmission Control Protocol (TCP) connection according to the TCP protocol. In other examples, a client connection may be established according to other transport protocols.

[0015] The server-side secure connection established between the proxy system and the corresponding destination server of the trust network can refer to any connection that protects the transmitted data from unauthorized access. For example, the server-side secure connection can include a server-side secure network tunnel established between the proxy system and the corresponding destination server. As another example, the server-side secure connection can be a connection established on a network link within the trust network. In the latter case, no secure network tunnel is established between the proxy system and the corresponding destination server.

[0016] A "trust network" may refer to a network environment in which a computing entity authorizes access requests from client devices. An example of a trust network is a zero trust network. Applications may be load balanced, where client connections from client devices in a client-side secure network tunnel may be load balanced across multiple destination servers of the trust network. A "destination server" in a trust network refers to a trust network resource to which a secure connection may be established. In some examples, the destination server may also be able to perform authorization of the access request. Alternatively, the destination server may forward the access request to another entity in the trust network to perform the authorization.

[0017] The access request may include a control message transmitted by the requester to connect to the target endpoint. In other examples, the access request may include a data packet transmitted by the requester to reach the target endpoint. In some examples, the destination server may also be referred to as a front-end server or a virtual private network (VPN) back-end server (in examples where a VPN is used).

[0018] Furthermore, if a given destination server in the trust network becomes unavailable for any reason, the traffic of the client connection can be moved from a first server-side secure connection established with the given destination server to a second server-side secure connection established with another destination server in the trust network without reestablishing the client secure network protocol. The given destination server may be unavailable due to a failure of the given destination server, a failure of a communication link with the given destination server, the given destination server being updated (for repair or maintenance, such as updating an operating system, firmware, or software), or the given destination server being overloaded.

[0019] Security protocol suites such as the Internet Protocol Security (IPSec) suite can be used for secure communications. In some examples, IPSec can be used for VPNs. A secure network tunnel can be established using IPSec as a tunneling protocol. To transmit data through an IPSec network tunnel, an encryption algorithm is applied to a data packet (such as an Internet Protocol (IP) packet), and the protected data packet is wrapped in an outer header, including an authentication header (AH) or an encapsulating security payload (ESP) header.

[0020] Using the techniques or mechanisms according to some examples of the present disclosure, the IPSec protocol can be adopted in a network arrangement with a trust network (such as a zero trust network). In addition, when a destination server in the trust network is available, it is not necessary to discard and re-establish a secure network tunnel based on client-side IPSec. In other examples, other security protocols that encrypt data packet payloads can be used to establish a secure network tunnel.

[0021] Various disclosed examples of the present disclosure include methods and systems for providing a secure network tunnel for communications between a client device and a zero-trust network. In some examples, the proxy system establishes a first (client-side) secure network tunnel with the client device and establishes a second (server-side) secure connection with a destination server in the zero-trust network. This network architecture allows the maintenance of a first (client-side) secure network tunnel between the proxy system and the client device, while enabling as many second (server-side) secure connections as needed with corresponding destination servers in the zero-trust network.

[0022] For example, according to some examples, the provision of a client-side secure network tunnel with a server-side secure connection allows for the transfer (e.g., switching) of communications of a client device (in a client connection) from a first destination server to a second destination server in a zero trust network without having to re-establish the client-side secure network tunnel, i.e., only changing the location where the client-connected business is transferred on the server side, such as by moving the client-side connected business to another existing server-side secure connection or a new server-side secure connection connected to another destination server in the zero trust network.

[0023] In some examples, when a given destination server is marked for maintenance, the proxy system can stop allocating new secure network tunnels to the given destination server. However, existing secure network tunnels to the given destination server remain uninterrupted. Data packets of existing secure network tunnels are allowed to be "drained" from the given destination server, which means that communication of data packets is allowed to be completed through the existing secure network tunnel. However, new traffic will not be forwarded to the given destination server, which will be shut down for maintenance.

[0024] In some examples, routing tables, rules, filters, combinations thereof, etc. are updated to reroute data packets originally directed to the first destination server from the client device to the second destination server. Generally, routing tables, rules, filters, or combinations thereof, etc. may be referred to as "routing information," which controls the traffic routing of the client connection to the destination server.

[0025] In some examples, the updating of routing information is part of a dynamic load balancing scheme that increases (or decreases) the number of destination servers to which the proxy system can direct data packets from a client device.

[0026] In some examples, the client device is a router, a gateway or other type of network device, and multiple computing devices thereof provide connectivity. Such a computing device is a requestor seeking to access a target endpoint through a client device. "Target endpoint" may refer to any resource that the requestor attempts to access. An example of a target endpoint is a target server, such as an application server, a web server, a cloud server, a storage system, a communication system, a database system or any other type of resource. The client connection between the client device and the proxy system includes a service transmitted to or from the requestor. For example, the requestor may establish one or more client connections with one or more target endpoints. The client connections of multiple requestors may be carried in a client-side secure network tunnel between the client device and the proxy system. The network architecture according to some examples of the present disclosure provides robust business connectivity for each computing device that is to access a target resource through a client device.

[0027] Figure 1 1 is a block diagram of an example arrangement including a client device 110 in communication with front-end servers 152, 154 of a zero trust network 150. The client device 110 may be a router, a gateway, or other type of network device. More generally, the client device 110 includes a computing device. The computing device may be a personal computing device, a mobile phone, a smart phone, a tablet computer, a laptop computer, or other electronic device. Although reference is made to a zero trust network in some examples, it should be noted that other types of trust networks may be employed in other examples. In some examples, the client device 110 initiates communication with the zero trust network 150 to access target resources in a secure network environment 160 that are not directly accessible to the client device 110. As shown in FIG. Figure 1 As shown, the client device 110 establishes a client-side secure network tunnel 120 with the load balancer 130 .

[0028] In an example where there are multiple client devices, multiple client-side secure network tunnels can be established between the proxy server 130 and the multiple client devices, so that each client device has a unique client-side secure network tunnel with the proxy server 130. It is safer to establish a separate client-side secure network tunnel between the proxy server 130 and the multiple client devices than to share a common client-side secure network tunnel by multiple client devices. For example, a shared common client-side secure network tunnel may mean that multiple client devices share a key, which is used to encrypt the business carried in the shared common client-side secure network tunnel, and the security of the tunnel is low. If one of the multiple client devices sharing the same key is leaked, the communication of each of the other client devices sharing the key will also be leaked.

[0029] In some examples, client device 110 communicates over an unsecured network, such as the Internet. To protect the communication of sensitive data transferred to or from target server 164 over the unsecured network in secure network environment 160, client device 110 is configured to communicate with target server 164 over zero trust network 150. Target server 164 may be an application server, a web server, a cloud server, or any other type of target resource. Figure 1 Only one target server 164 is depicted in FIG, but in other examples, the secure network environment 160 includes multiple target servers. In addition, in further examples, the zero trust network 150 can provide protected access to the destination server in multiple secure network environments.

[0030] In some examples, the zero trust network 150 provides various security services. For example, the zero trust network 150 (e.g., front-end servers 152, 154) can provide any or some combination of the following: Remote Desktop Protocol (RDP) service between the client device 110 and the target server 164, secure shell (SSH) access to the target server 164, isolated SSH access to the target server 164, secure web gateway (SWG) (filtering traffic, enforcing policies and ensuring regulatory compliance), or other services.

[0031] In some examples, the client device 110 and the proxy server 130 initiate a client-side secure network tunnel 120, which can be implemented using one or more computers. For example, the client-side secure network tunnel 120 is implemented using IPSec. The client device 110 sends a data packet (towards a target server 164) to the proxy server 130 through the client-side secure network tunnel 120. More generally, the client device 110 sends a data packet of a client-side connection to the proxy server 130 through the client-side secure network tunnel 120. The destination of the data packet may include one or more destination servers in the secure network environment 160. The source (origin) of the data packet may include one or more requesters 170. "Requester" may refer to an entity that can access a target resource, such as a physical electronic device or a virtual computing entity.

[0032] although Figure 1 Only one client-side secure network tunnel 120 is depicted in FIG. 1 , but in other examples, multiple client-side secure network tunnels may be established between the client device 110 and the proxy server 130 .

[0033] In some examples, the proxy server 130 includes a routing table 135, which is stored in a memory 136. The memory 136 can be in the proxy server 130 or outside the proxy server 130. The proxy server 130 directs the data packet to a selected server-side secure network tunnel in a plurality of server-side secure network tunnels 142, 144 based on the routing table 135. In an example, the proxy server 130 is implemented as a virtual machine (VM) including a LINUX-based operating system (OS) and an Iptable software program. The Iptable software program allows a system administrator to configure filtering rules for data packets (such as IP data packets). The filtering rules can be in the form of a routing table 135, or the filtering rules can have any other form.

[0034] In some examples, the proxy server 130 initiates multiple server-side secure network tunnels 142, 144. Each server-side secure network tunnel is established between the proxy server 130 and a corresponding front-end server of the zero-trust network 150. For example, a server-side secure network tunnel 142 is established between the proxy server 130 and the front-end server 152, and a server-side secure network tunnel 144 is established between the proxy service 130 and the front-end service 154. Each server-side secure network tunnel 142 or 144 can be established using IPSec. Note that multiple secure network tunnels can be established between the load balancer 130 and any given destination server.

[0035] The ability to establish multiple server-side secure network tunnels allows the client-side secure network tunnel 120 to be maintained between the client device 110 and the proxy server 130, while some client-connected traffic in the client-side secure network tunnel 120 is transferred from one server-side secure network tunnel to another server-side secure network tunnel, such as when a front-end server in the zero-trust network 150 is unavailable. This transfer capability allows additional front-end servers to be provided in the zero-trust network 150 to replace front-end servers that have become unavailable.

[0036] If the client device 110 is directly connected to the front-end server through a secure network tunnel, and the front-end server is unavailable, the secure network tunnel must be terminated and a new secure network tunnel must be established between the client device 110 and the front-end server. This interferes with the communication of the client device 110. By adding a proxy server 130 between the client device 110 and the zero-trust network 150, the client-side secure network tunnel 120 can remain active between the client device 100 and the proxy server 130, while the client-side connection traffic in the client-side secure network tunnel 120 is transferred to (multiple) another server-side secure network tunnel, whether existing or newly established. For example, another front-end server (e.g., 154) can be provided for transmitting the traffic of the client device 110, instead of terminating the secure network tunnel between the client device 110 and the front-end server 152.

[0037] In an example, the front-end server 152 or 154 of the zero-trust network 150 can provide a secure service, such as an RDP service, an SSH service, a SWG service, or other services, between the client device 110 and the target server 164. The front-end server 152 or 154 establishes a service by communicating with the back-end server 156 of the zero-trust network 150. The "back-end server" may refer to a server in the zero-trust network 150 that is responsible for communicating with a network environment (e.g., a secure network environment 160) that includes a target resource to be accessed by the requester 170. The back-end server 156 may communicate with a connector 162 in the secure network environment 160. In an example, the connector 162 forwards data packets between the zero-trust network 150 and the target resources (including the target server 164) of the secure network environment 160.

[0038] In some examples, the proxy server 130 can update the routing table 135 to change the destination of the data packets received from the client device 110 through the client-side secure network tunnel 120 in the zero trust network 150. For example, before updating the routing table 135, the client-connected traffic in the client-side secure network tunnel 120 is transmitted to the front-end server 152 through the server-side secure network tunnel 142. However, after updating the routing table 135, the client-side connected traffic in the client-side secure network tunnel 120 is transmitted to the second front-end server 154 through the server-side secure network tunnel 144. The update of the routing table for redirecting the client-connected traffic through different server-side secure network tunnels can be used for dynamic load balancing, or be performed based on the front-end server 152 becoming unavailable, such as due to a failure of the front-end server 152, a failure of a communication link with the front-end server 152, the front-end server 152 being offline to update an outdated version of software or firmware executed on the front-end server 152, or for any other reason.

[0039] The ability to keep the client-side secure network tunnel 120 active allows for zero downtime for communications of the client device 110 because the client device 110 does not have to establish, rebuild, or otherwise modify an existing client-side secure network tunnel 120 due to unavailability of a front-end server.

[0040] Furthermore, in some examples of the present disclosure, the proxy server 130 is capable of performing load balancing of client connections in the client-side secure network tunnel 120. For example, the proxy server 130 may transmit data packets of a first subset of client connections in the client-side secure network tunnel 120 to the front-end server 152 over the server-side secure network tunnel 142, transmit data packets of a second subset of different client connections in the client-side secure network tunnel 120 to the front-end server 154 over the server-side secure network tunnel 144, and so on.

[0041] If the client device 110 is, for example, a router to which the requester 170 is connected for routing the requester 170's data, load balancing can be performed on the traffic in the client connection associated with the requester 170 that is transmitted to the proxy server 130 through the client-side secure network tunnel 120. Load balancing can involve increasing or decreasing the number of front-end servers in the zero trust network 150, and the client connections of the client-side secure network tunnel 120 can be distributed across the zero trust network 150. The ability to scale up or down the front-end servers is transparent to the client device 110 and does not require the client device 110 to establish, re-establish, change, terminate, etc. any network tunnels.

[0042] According to some examples, the network architecture described herein allows for dynamic load balancing of communications between client devices 110 and zero trust network 150 without the client devices 110 having to terminate the client-side secure network tunnel 120 established by the client devices 110 .

[0043] According to some examples, the network architecture described herein allows changes to be made at the zero trust network 150, such as upgrading a server, taking a server offline and back online, etc., without terminating the client-side secure network tunnel 120 connected to the client device 110.

[0044] In some examples, the proxy server 130 is deployed in the zero trust network 150 or outside the zero trust network 250. In further examples, multiple proxy servers 130 can be deployed. In examples where the zero trust network 150 includes a proxy server 130 deployed therein, it is not necessary to establish a secure network tunnel between the proxy server 130 and the front-end server 152 in the zero trust network 140. In these examples, the connection between the proxy server 130 and the front-end server in the zero trust network 150 is implicitly secure. In other examples, if the load balancer 130 is outside the zero trust network 150, a server-side secure network tunnel is established between the proxy server 130 and the resources of the zero trust network 250 (such as the front-end server).

[0045] Proxy manager 140 may also be used with proxy server 130. Proxy manager 140 may be implemented using one or more computers. Although depicted as being separate from proxy server 130, in other examples, proxy manager 140 and proxy server 130 may be integrated into one entity.

[0046] The agent manager 140 may monitor the conditions of resources (including the front-end servers 152, 154) in the zero trust network 150. For example, the monitored conditions may include metrics indicating the workload of the respective front-end servers 152, 154. For example, the metrics may include any of the following or a combination thereof: metrics indicating the usage or performance of the processing resources of each front-end server, metrics indicating the usage or performance of memory resources, metrics indicating the usage or performance of network or communication resources, or any other metrics indicating the load of the front-end servers.

[0047] Monitoring can be implemented using push or pull technology. In some cases, in a pull model, the agent manager 140 can poll the front-end server to obtain the monitored indicators. In other cases, in a push model, the agent manager 140 can subscribe to the front-end server to receive notifications of any changes in the metrics.

[0048] Based on the monitored conditions of the front-end servers, the proxy manager 140 can send control information to the proxy server 130 to adjust the balance of client connections across the server-side secure network tunnels. For example, the proxy manager 140 can send instructions to the proxy server 130 to move a subset of client connections in the client-side secure network tunnel 120 from the first server-side secure network tunnel to the second server-side secure network tunnel. The second server-side secure network tunnel may already exist, in which case the traffic of the subset of client connections can be simply forwarded to the second server-side secure network tunnel, such as by updating the routing table 135. In other cases, the proxy server 130 establishes a new second server-side secure network tunnel and forwards the traffic of the subset of client connections on the tunnel.

[0049] Figure 2 is an agent system according to some examples of the present disclosure (e.g., Figure 1 130) for performing a process 200 on a client device (e.g., Figure 1 110) and zero trust networks (e.g. Figure 1 Provide secure network business communication between 150) in.

[0050] At S210, the proxy system establishes a client-side secure network tunnel with the client device. In some examples, the proxy system includes a routing table (e.g. Figure 1 135), wherein the routing table includes an identifier of the client device and an identifier of the target server (e.g., Figure 1 For example, the identifier of a device (client device or destination server) includes any or a combination of the following: an IP address, a name in a namespace, a unique identifier (e.g., a media access control (MAC) address), or another identifier.

[0051] The identifier of the device may be read from a data packet, for example in data or metadata of a data packet transmitted from a client device to the proxy system.A data packet may include a payload carrying data to be communicated and a header containing metadata such as an identifier.

[0052] At S220, the proxy system connects the proxy system to the trust network (eg Figure 1 The proxy system may establish multiple server-side secure connections between corresponding servers (such as front-end servers or other types of resources) of the zero trust network 150. Other types of resources to which the proxy system may establish server-side secure connections may include any one or a combination of the following: access portal servers, virtual computing entities (such as containers (e.g., Kubernetes containers) or VMs), serverless functions, or other types of resources.

[0053] In some examples, a front-end server (e.g. Figure 1 152 or 154) is an RDP front-end server that communicates between a client device and a remote server (e.g., Figure 1 The RDP service is provided between the target server 164 in the secure network environment 160 of the RDP front-end server. In a specific example, the RDP front-end server can provide an XRDP container to capture login details, etc. from the client device, and establish an RDP session with the remote server using the captured login details.

[0054] In a further example, the front-end server is an SSH front-end server that can initiate an SSH session between a client device and a remote server deployed in a secure network. The SSH front-end server can isolate the remote server, for example, using techniques or mechanisms described in more detail in U.S. Patent Application No. 18 / 359,538, entitled “Remote Server Isolation Utilizing Zero Trust Architecture,” the entire contents of which are incorporated herein by reference.

[0055] In additional examples, an access portal server in the trust network can capture login information from the client device, such as a login identifier, authentication information, etc. Such login information can include any of the following information or a combination thereof: a user name, a password, a phrase, an encryption key, a certificate, an email address, a network address, a name in a namespace, an IP address, a MAC address, or other information that can be used to authenticate the client device or a user of the client device.

[0056] In some examples, the client device may provide the above login information periodically, or may provide login information in response to other events. Providing login information can ensure that the user of the client device is an authorized user (i.e., a user authorized to access a trusted network, a secure network, a combination thereof, etc.).

[0057] At S230, the proxy system load balances multiple connections of the client device in the client-side secure network tunnel across servers of the trust network through corresponding server-side secure connections in multiple server-side secure connections, wherein traffic of a first connection in the multiple connections is transferred through a first server-side secure connection in the multiple server-side secure connections, and traffic of a second connection in the multiple connections is transferred through a second server-side secure connection in the multiple server-side secure connections, and wherein traffic of the multiple connections includes data packets.

[0058] The proxy system may process the data packet in the following manner. In some examples, processing, for example, a data packet received from a client device includes: receiving the data packet from the client device via a client-side secure network tunnel, routing the data packet to the zero-trust network via a selected server-side secure connection (e.g., the server-side secure network tunnel), receiving a response from the zero-trust network environment via the server-side secure connection, and sending the response to the client device via the client-side secure tunnel.

[0059] In some examples, the proxy system can inspect the received data packet. The data packet can include a client identifier, and the proxy system can query a routing table for the destination based on the client identifier (e.g., Figure 1 135 in). For example, the routing table can be implemented as an Iptable of a LINUX operating system.

[0060] The load balancing performed by the proxy system can be based on the proxy manager (e.g. Figure 1 For example, the proxy system may receive an instruction from the proxy manager to replace the first server-side secure connection (to the first destination server) with the second server-side secure connection (to the second destination server), which causes at least a subset of the client-side connections in the client-side secure network tunnel to be transferred from the first destination server to the second destination server in the trust network.

[0061] In some examples, the proxy system may establish (such as in response to instructions from the proxy manager) a third server-side secure connection between the proxy system and a third destination server of the trust network. In some cases, the proxy system may terminate the second server-side secure connection after determining that the third secure connection has been established and is operational. The second server-side secure connection may be terminated to allow the second destination server to be taken offline, such as for repair or maintenance.

[0062] In some examples, balancing the data packets of the client-side connection between multiple server-side security connections includes maintaining a counter for each server-side security connection, so that the number of data packets pointing to each server-side security connection is counted by the corresponding counter. In some examples, the proxy system can set a threshold. The threshold can be provided by the proxy manager 140 or another entity. The proxy system uses the threshold to ensure that the difference between the counts of any counter pairs associated with the corresponding server-side security connection does not exceed the threshold. For example, the proxy system can maintain a counter A for server-side security connection A, a counter B for server-side security connection B, and a counter C for server-side security connection C. As the data packets of the client connection pass through the server-side security connections A, B, and C, the corresponding counters A, B, and C are incremented. The proxy system compares the counts of counters A, B, and C with each other. If the count difference of any two of counters A, B, and C exceeds the threshold, the proxy system can redirect the data packet from the server-side security connection experiencing a larger business to another server-side security connection experiencing a smaller business. For example, if the difference between the counts of counters A and B exceeds a threshold, and the business of server-side secure connection B is greater than that of server-side secure connection A, the proxy system can redirect the data packets of the client connection from server-side secure connection B to server-side secure connection A or C, for example by updating the routing table.

[0063] In some examples, the proxy system can establish a server-side secure network tunnel to the XFRM interface. In an example, the XFRM interface can communicate with a TUNnel (TUN) device of a front-end server. XFRM refers to a framework for implementing IPSec data packet path functions. The TUN device provides a virtual interface that implements software-based network abstraction by simulating the behavior of a physical network card (such as an Ethernet or Wi-Fi card).

[0064] Figure 3 is a block diagram of an agent system 300 according to some examples of the present disclosure. Examples of the agent system 300 are Figure 1 The proxy server 130. The proxy system 300 includes a processing circuit 310 coupled to a storage medium 330.

[0065] Processing circuit 310 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, exemplary types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other information operations. One or more hardware logic components and circuits may be referred to as one or more hardware processors.

[0066] The storage medium 330 may include a memory or a storage device. The memory may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read-only memory, flash memory, etc.), or a combination thereof. The memory may include on-chip memory, off-chip memory, combinations thereof, etc. The memory may include a scratch pad memory for the processing circuit 310. The storage medium 330 may alternatively or additionally include magnetic memory, optical memory, solid-state memory, combinations thereof, etc., such as flash memory, a hard drive or other storage technology, or any other medium that can be used to store information.

[0067] In some examples, machine-readable instructions for performing the various tasks discussed herein may be stored in storage medium 330. Machine-readable instructions may include any one or more combinations of software, firmware, middleware, microcode, hardware description language, or other. Machine-readable instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit 310, the machine-readable instructions cause processing circuit 310 to perform various processes described herein.

[0068] The machine-readable instructions include client-side secure network tunnel establishment instructions 312 for establishing a secure network tunnel between the proxy system 300 and a client device (e.g., Figure 1 The client-side secure network tunnel includes a requester (e.g., Figure 1 170) client connection.

[0069] The machine-readable instructions include server-side secure connection establishment instructions 314 for establishing multiple server-side secure connections between the proxy system 300 and destination servers in a trust network (such as front-end servers 152, 154 in the zero trust network 150).

[0070] The machine-readable instructions include destination server condition information receiving instructions 316 for receiving condition information of a destination server in the trust network. In some examples, the information is obtained from Figure 1 Received by the agent manager 140.

[0071] The machine-readable instructions include load balancing instructions 318 for load balancing client-side connections in a client-side secure network tunnel through corresponding server-side secure connections in a plurality of server-side secure connections and destination servers across a trust network based on a condition of a target server.

[0072] In some examples, load balancing includes adding another server-side secure connection to another destination server of the trusted network based on a condition of the destination server, or terminating a server-side secure connection with the destination server based on a condition of the destination server.

[0073] Figure 4 is a block diagram of a non-transitory machine-readable or computer-readable storage medium 400 storing machine-readable instructions that, when executed, cause an agent system (e.g., Figure 1 The proxy server 130) performs various tasks.

[0074] The machine-readable instructions in the storage medium 400 include client-side secure network tunnel establishment instructions 402 for establishing a secure network tunnel between the proxy system and the client device (eg, Figure 1 A client-side secure network tunnel is established between 110).

[0075] The machine-readable instructions in the storage medium 400 include server-side secure connection establishment instructions 404 for establishing a plurality of server-side secure connections between the proxy system and corresponding servers of the trust network.

[0076] The machine-readable instructions in the storage medium 400 include load balancing instructions 406 to load balance, by the proxy system, multiple connections of client devices in a client-side secure network tunnel through corresponding ones of the multiple server-side secure connections across servers of the trust network.

[0077] In some examples, the multiple connections in the client-side secure network tunnel include TCP connections.

[0078] In some examples, load balancing of multiple connections of client devices across servers of a trust network is performed according to a dynamic load balancing process based on conditions of the servers of the trust network.

[0079] In some examples, the condition of the server of the trust network includes a problem affecting the performance of the server in the server. The problem may include a server failure, a communication link failure with the server, or a server overload.

[0080] In some examples, the condition of trusting a server of the network includes an update of the server of the server.

[0081] In some examples, the dynamic load balancing process creates a new server-side secure connection to another server of the trusted network based on the server's conditions.

[0082] In some examples, the dynamic load balancing process terminates the server-side secure connection in the server-side secure connection based on a condition of the server.

[0083] In some examples, machine-readable instructions cause the proxy system to detect unavailability of a first server in a trust network of servers and, based on detecting the unavailability of the first server, transfer a subset of connections of client devices established through a first server-side secure connection in the server-side secure connections to a second server-side secure connection, the subset of connections of client devices being part of a plurality of connections of the client devices.

[0084] In some examples, the unavailability of the first server is based on a failure of the first server, a failure of a link to the first server, an overload of the first server, or an update performed on the first server.

[0085] In some examples, the transfer of a subset of connections of client devices from a first server-side secure connection to a second server-side secure connection is performed without reestablishing a client-side secure network tunnel.

[0086] All examples and conditional language cited herein are intended to help the reader understand the principles of the disclosed examples and should be interpreted as not being limited to these specifically cited examples and conditions. In addition, all statements of narrative principles, aspects, and examples herein are intended to cover their structural and functional equivalents. In addition, such equivalents include currently known equivalents and equivalents developed in the future, i.e., any element developed to perform the same function, regardless of its structure.

[0087] It should be understood that any reference to an element using names such as "first", "second" etc. herein generally does not limit the quantity or order of these elements. On the contrary, these designations are generally used as a convenient method for distinguishing two or more elements or element instances. Therefore, reference to the first and second elements does not mean that only two elements can be adopted there, or that the first element must be before the second element in some way. In addition, unless otherwise indicated, an element set includes one or more elements.

[0088] In the present disclosure, the use of the terms "a", "an" or "the" is also intended to include plural forms, unless the context clearly indicates otherwise. In addition, the terms "comprises", "comprising", "including", "containing", "having" or "having" when used in the present disclosure specify the presence of the elements described, but do not exclude the presence or addition of other elements.

[0089] In the foregoing description, many details are set forth to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without some of these details. Other implementations may include modifications and variations to the above details. The appended claims are intended to cover these modifications and variations.

Claims

1. A non-transitory machine-readable storage medium comprising instructions that, when executed, cause an agent system to: establishing a client-side secure network tunnel between the proxy system and the client device; establishing a plurality of server-side secure connections between the proxy system and corresponding servers of the trust network; and Multiple connections of the client device in the client-side secure network tunnel are load balanced by the proxy system across the servers of the trust network through corresponding ones of the plurality of server-side secure connections.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the plurality of server-side secure connections between the proxy system and the corresponding servers of the trust network comprise a plurality of server-side secure network tunnels between the proxy system and the corresponding servers of the trust network. 3 . The non-transitory machine-readable storage medium of claim 1 , wherein the plurality of connections in the client-side secure network tunnel comprises Transmission Control Protocol (TCP) connections.

4. The non-transitory machine-readable storage medium of claim 1, wherein the load balancing of the multiple connections of the client devices across the servers of the trust network is according to a dynamic load balancing process based on conditions of the servers of the trust network. 5 . The non-transitory machine-readable storage medium of claim 4 , wherein the condition of the server of the trust network comprises an issue affecting performance of a server of the server. 6 . The non-transitory machine-readable storage medium of claim 5 , wherein the condition of the server of the trust network comprises an update of a server of the server.

7. The non-transitory machine-readable storage medium of claim 4, wherein the dynamic load balancing process creates a new server-side secure connection to another server of the trust network based on the condition of the server.

8. The non-transitory machine-readable storage medium of claim 4, wherein the dynamic load balancing process terminates a server-side secure connection in the plurality of server-side secure connections based on the condition of the server.

9. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when executed, cause the proxy system to: detecting unavailability of a first server among the servers of the trust network; and Based on detecting the unavailability of the first server, a subset of connections of the client device established through a first server-side secure connection among the multiple server-side secure connections is transferred to a second server-side secure connection, the subset of connections of the client device being part of the multiple connections of the client.

10. The non-transitory machine-readable storage medium of claim 9, wherein the unavailability of the first server is based on a failure of the first server, a failure of a link to the first server, an overload of the first server, or an update performed at the first server.

11. The non-transitory machine-readable storage medium of claim 9, wherein the transfer of the subset of connections of the client device from the first server-side secure connection to the second server-side secure connection is performed without reestablishing the client-side secure network tunnel. 12 . The non-transitory machine-readable storage medium of claim 1 , wherein the server of the trust network comprises a physical server or a virtual server.

13. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when executed, cause the proxy system to: inspecting a data packet received from a client device, the data packet including a client identifier; and querying a routing table for a destination based on the client identifier, The load balancing is based on updating the routing table.

14. The non-transitory machine-readable storage medium of claim 1, wherein the plurality of server-side secure connections comprises server-side secure network tunnels, the server-side secure tunnels comprising a first server-side secure network tunnel and a second server-side secure network tunnel, and the instructions when executed cause the proxy system to: establishing a third server-side secure network tunnel between the proxy system and another server in the trust network; and In response to determining that the third server-side secure network tunnel is operational, terminating the second server-side secure network tunnel.

15. The non-transitory machine-readable storage medium of claim 1, wherein the client device comprises a network device through which the electronic device connects to the target endpoint through the trusted network.

16. The non-transitory machine-readable storage medium of claim 1, wherein the client-side secure network tunnel is established according to an Internet Protocol security (IPSec) protocol.

17. A method comprising: Establishing, by the proxy system, a client-side secure network tunnel between the proxy system and the client device; Establishing, by the proxy system, a plurality of server-side secure connections between the proxy system and corresponding servers of the trust network; as well as The proxy system load balances multiple connections of the client device in the client-side secure network tunnel through corresponding server-side secure connections among the multiple server-side secure connections and across the servers of the trust network, wherein the business of a first connection among the multiple connections is transferred through a first server-side secure connection among the multiple server-side secure connections, and the business of a second connection among the multiple connections is transferred through a second server-side secure connection among the multiple server-side secure connections, and wherein the business of the multiple connections includes data packets.

18. The method of claim 17, wherein the plurality of server-side secure connections comprises a server-side secure network tunnel established with the server.

19. An agent system comprising: processor; as well as A non-transitory storage medium storing instructions executable on the processor for: establishing a client-side secure network tunnel between the proxy system and a client device, the client-side secure network tunnel comprising a requestor's client connection coupled to the client device; establishing a plurality of server-side secure connections between the proxy system and a destination server in the trust network; receiving information about a condition of the destination server in the trust network; as well as The client connections in the client-side secure network tunnel are load balanced by the proxy system through corresponding ones of the plurality of server-side secure connections across the destination servers of the trust network based on the condition of the destination server.

20. The proxy system according to claim 19, wherein the load balancing comprises: adding another server-side secure connection to another destination server of the trust network based on the condition of the destination server, or The server-side secure connection with the destination server is terminated based on a condition of the destination server.

Images