Load balancing processing method and device, equipment and medium

Abstract

The invention discloses a load balancing processing method and device, equipment and a medium, relates to the technical field of data processing, is applied to a target security gateway which is located in a preset routing mode deployment scene and serves as a host, and comprises the steps that a to-be-processed data packet is received through an IP node, and whether the destination IP address of the to-be-processed data packet is consistent with the physical address of a local machine or not is judged; if not, matching the preset intranet virtual address and the preset extranet virtual address by using the destination IP address; if the matching is successful, sending the data packet to be processed to a load balancing node through the IP node after determining that the current IP node is located at the host; and performing session matching by using the target IPSec VPN tunnel address through the load balancing node, and determining whether to trigger a target physical address updating operation corresponding to the to-be-processed data packet based on a real server corresponding to the target session so as to complete a balancing processing operation. The deployment cost and complexity can be reduced under the condition of realizing load balancing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a load balancing processing method, device, equipment and medium. Background Art

[0002] IPSec VPN (Internet Protocol Security Virtual Private Network) is a virtual private network technology used to provide a secure communication channel between two private networks on the public Internet and ensure the security of the connection through an encrypted channel, that is, to provide a private data packet service between two public gateways.

[0003] Currently, the load balancing solutions for IPSec VPN on the market are all implemented by using a balancer plus a real server. This method requires an additional load balancer to be added to the solution, but the single point of failure problem needs to be considered separately during the deployment and use of the load balancer, which increases the complexity of deployment and also increases the deployment cost.

[0004] As can be seen from the above, how to reduce deployment cost and complexity while achieving load balancing is an urgent problem to be solved. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a load balancing processing method, device, equipment and medium, which can effectively realize IPSec VPN load balancing without deploying an additional independent balancer, thereby reducing the cost and complexity of deployment and improving user experience. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a load balancing processing method, which is applied to a target security gateway as a host in a preset routing mode deployment scenario, comprising:

[0007] Receiving a corresponding data packet to be processed through a local IP node and a preset data plane development kit, and determining whether a destination IP address corresponding to the data packet to be processed is consistent with a local physical address, so as to obtain a corresponding first determination result;

[0008] If the first judgment result indicates inconsistency, matching the preset intranet virtual address and the preset extranet virtual address by using the destination IP address through the IP node to obtain a corresponding address matching result;

[0009] If the address matching result indicates that the match is successful, after determining that the current IP node is located at the host, the to-be-processed data packet is sent to the local load balancing node through the IP node and using the address matching result;

[0010] The load balancing node uses the target IPSec VPN tunnel address corresponding to the data packet to be processed to perform session matching, and determines whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

[0011] Optionally, after determining whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address to obtain a corresponding first determination result, the method further includes:

[0012] If the first judgment result is consistent, jump to the step of sending the to-be-processed data packet to the local load balancing node operation through the IP node and using the matching result after determining that the current IP node is located at the host.

[0013] Optionally, if the first judgment result indicates inconsistency, matching a preset intranet virtual address and a preset extranet virtual address by using the target IP address through the IP node to obtain a corresponding address matching result, further comprising:

[0014] If the address matching result indicates that the match fails, the data packet to be processed is forwarded to a node other than the IP node and the load balancing node located in the target security gateway through the IP node, or the data packet to be processed is discarded;

[0015] Correspondingly, if the address matching result indicates that the match is successful, the method further includes:

[0016] Determine whether the current IP node is located at the host to obtain a corresponding second determination result;

[0017] When the second judgment result indicates that the current IP node is not located in the host, the data packet to be processed is forwarded to the local encryption and decryption node through the IP node to complete the corresponding balanced distribution operation so that the encryption and decryption node can process the data packet to be processed.

[0018] Optionally, performing session matching by using the target IPSecVPN tunnel address corresponding to the data packet to be processed through the load balancing node includes:

[0019] Determining, by the load balancing node, whether the data in the to-be-processed data packet has been encrypted, so as to obtain a corresponding third determination result;

[0020] If the third judgment result indicates that it is not encrypted, matching the five-tuple information corresponding to the data packet to be processed with the preset IPSec VPN policy, and determining the target IPSec VPN tunnel address corresponding to the data packet to be processed based on the obtained matching result;

[0021] If the third judgment result indicates that it has been encrypted, session matching is performed using the target IPSec VPN tunnel address corresponding to the data packet to be processed.

[0022] Optionally, after performing session matching by using the target IPSecVPN tunnel address corresponding to the data packet to be processed through the load balancing node, the method further includes:

[0023] If the obtained session matching result indicates that the match fails, a session is created through the load balancing node and using the target IPSec VPN tunnel address, and after the created session is assigned a corresponding real server based on a preset scheduling algorithm, it is determined based on the created session whether to trigger a target physical address update operation corresponding to the data packet to be processed.

[0024] Optionally, the determining whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session includes:

[0025] Determine whether the real server corresponding to the matched target session is the host to obtain a corresponding fourth determination result;

[0026] When the fourth judgment result indicates that the real server is the host, the data packet to be processed is forwarded to the local encryption and decryption node through the load balancing node, so that the encryption and decryption node processes the data packet to be processed;

[0027] When the fourth judgment result indicates that the real server is not the host, a target physical address update operation corresponding to the data packet to be processed is triggered.

[0028] Optionally, the triggering of a target physical address update operation corresponding to the data packet to be processed to complete a balancing operation corresponding to the data packet to be processed includes:

[0029] Obtaining a first target physical address corresponding to the real server of the target session;

[0030] Updating the second target physical address corresponding to the data packet to be processed to the first target physical address;

[0031] Determine the target interface of the IP node for receiving the data packet to be processed;

[0032] If the target interface is a preset intranet interface corresponding to the intranet virtual address, the to-be-processed data packet is returned based on the preset intranet interface;

[0033] If the target interface is a preset external network interface corresponding to the external network virtual address, the data packet to be processed is returned based on the preset external network interface to complete the balancing processing operation corresponding to the data packet to be processed.

[0034] In a second aspect, the present application provides a load balancing processing device, which is applied to a target security gateway as a host in a preset routing mode deployment scenario, including:

[0035] A judgment result acquisition module is used to receive the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain the corresponding first judgment result;

[0036] A matching result acquisition module, configured to match the preset intranet virtual address and the preset extranet virtual address through the IP node and using the target IP address to obtain a corresponding address matching result if the first judgment result indicates inconsistency;

[0037] A data packet sending module, for sending the data packet to be processed to a local load balancing node through the IP node and using the address matching result after determining that the current IP node is located at the host if the address matching result indicates that the match is successful;

[0038] The session matching module is used to perform session matching by using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node, and determine whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

[0039] In a third aspect, the present application provides an electronic device, including:

[0040] Memory, used to store computer programs;

[0041] The processor is used to execute the computer program to implement the aforementioned load balancing processing method.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned load balancing processing method when executed by a processor.

[0043] As can be seen from the above, before performing load balancing processing, the present application needs to receive the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and determine whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address to obtain the corresponding first judgment result; if the first judgment result indicates inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched through the IP node and the destination IP address to obtain the corresponding address matching result; if the address matching result indicates a successful match, after determining that the current IP node is located at the host, the data packet to be processed is sent to the local load balancing node through the IP node and the address matching result; the load balancing node uses the target IPSec VPN tunnel address corresponding to the data packet to be processed to perform session matching, and determines whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed. It can be seen that the present application obtains the first judgment result by using the local IP node to judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address. If the first judgment result shows inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched by using the target IP address and a matching result is obtained; if the matching result shows that the match is successful, after determining that the current IP node is located at the host, the data packet to be processed is sent to the local load balancing node by using the matching result; and the target IPSec VPN tunnel address corresponding to the data packet to be processed is used for session matching by the load balancing node, and based on the real server corresponding to the matched target session, it is determined whether to trigger the target physical address update operation corresponding to the data packet to be processed, so as to complete the balancing processing operation corresponding to the data packet to be processed. In this way, IPSec VPN load balancing can be effectively realized without deploying an independent balancer, thereby reducing the cost and complexity of deployment and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flow chart of a load balancing processing method disclosed in this application;

[0046] Figure 2A schematic diagram of a deployment scenario of a preset routing mode disclosed in this application;

[0047] Figure 3 A logical schematic diagram of forwarding data packets between a host and a backup machine disclosed in the present application;

[0048] Figure 4 A schematic diagram of a process flow of an IP node processing a data packet disclosed in this application;

[0049] Figure 5 A schematic diagram of a process flow of a load balancing node processing a data packet disclosed in the present application;

[0050] Figure 6 A schematic diagram of the structure of a load balancing processing device disclosed in this application;

[0051] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] IPSec VPN is used to provide a secure communication channel for two private networks on the public Internet, and to ensure the security of the connection through an encrypted channel, that is, to provide a packet service for private data between two public gateways. Currently, the load balancing solutions for IPSecVPN on the market are all implemented by using a balancer plus a real server. This method requires an additional load balancer to be added to the solution, but the single point failure problem needs to be considered separately during the deployment and use of the load balancer, thereby increasing the complexity of the deployment and also causing an increase in the deployment cost. To this end, the present application provides a load balancing processing solution that can effectively implement IPSec VPN load balancing without deploying an additional independent balancer, thereby reducing the cost and complexity of deployment and improving the user experience.

[0054] See also Figure 1 As shown, an embodiment of the present invention discloses a load balancing processing method, which is applied to a target security gateway as a host in a preset routing mode deployment scenario, including:

[0055] Step S11, receiving the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and judging whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain the corresponding first judgment result.

[0056] In this embodiment, the target security gateway needs to form a load balancing environment together with other security gateways, and the above load balancing environment exists in a preset routing mode deployment scenario. The preset routing mode deployment scenario is as follows: Figure 2 As shown: In the preset routing mode deployment scenario, security gateway 1, security gateway 2 and security gateway 3 as backup machines together form a load balancing environment. Security gateway 1, that is, the target security gateway as the host, is integrated with a load balancing node for distributing data packets, wherein the intranet virtual address of the load balancing environment is VIP2 (Virtual Internet Protocol Address), and the external network virtual address is VIP1. The above intranet virtual address and external network virtual address both have corresponding preset intranet interfaces and preset external network interfaces for transmitting the above data packets to be processed, that is, the target security gateway provides the load balancing function of the load balancer while providing IPSec (Internet Protocol Security) service, wherein IPSec service is a network security protocol suite that provides security for Internet protocols, aiming to ensure the security and integrity of data transmitted through public or private networks, while security gateway 2 and security gateway 3 are backup machines and only provide IPSec service.

[0057] In addition, the security gateway 4 uses the IPSec protocol to establish an IPSec tunnel with the security gateway 1, security gateway 2 and security gateway 3, and the tunnel IPs (Internet Protocol) are VIP1 and IP0; and the first data forwarding participant on the far right in the figure can also establish an IPSec tunnel with the security gateway 1, security gateway 2 and security gateway 3, and the tunnel IPs are IP2 and IP1. Among them, the physical address of the second data forwarding participant on the far left in the figure is IP2, and the physical address of the first data forwarding participant on the far right in the figure is IP1.

[0058] It should be understood that the data balancing function between security gateway 1, security gateway 2 and security gateway 3 is implemented in a single-arm mode, that is, when the target host needs to redirect traffic to other security gateways, it only needs to change the destination MAC (Media Access Control Address, i.e., the media access control address, i.e., the physical address) of the data packet to the corresponding real server MAC. As backup machines, security gateway 2 and security gateway 3 need to be configured with VIP1 and VIP2 internally to receive data packets forwarded by the host, but cannot respond to ARP (Address Resolution Protocol) requests from VIP1 and VIP2 to avoid IP conflicts. In other words, when the target host sends a data packet, it broadcasts the ARP request containing the target IP address to security gateway 2 and security gateway 3, but the above-mentioned security gateway 2 and security gateway 3 will not respond to the ARP request from security gateway 1.

[0059] In this embodiment, the forwarding logic inside the data forwarding plane of each of the above security gateways is as follows: Figure 3 As shown: Figure 3 The left half is the forwarding process performed in the standby machine. The standby machine includes a local encryption and decryption node and an IP node. In the standby machine, the IP node can receive the data packets to be processed input by the DPDK (Data Plane Development Kit). Subsequently, the IP node can forward the data packets to be processed to the local encryption and decryption node located locally, so that the local encryption and decryption node processes the data packets to be processed, and then outputs the processed data packets through the DPDK. Figure 3 The right half is the forwarding process carried out in the host. Compared with the above-mentioned standby machine, the host also includes a load balancing node. In the host, the IP node can receive the pending data packets input by the DPDK. Subsequently, the IP node can forward the pending data packets to the local load balancing node. After the load balancing node processes the pending data packets, the load balancing node needs to determine whether the pending data packets need to be processed locally. If the pending data packets need to be processed locally, the pending data packets can be forwarded to the local encryption and decryption node so that the local encryption and decryption node can process the pending data packets, and then output the processed data packets through the DPDK; if the pending data packets do not need to be processed locally, the DPDK forwarding function is used to forward the pending data packets to the local node.

[0060] It can be understood that in the application scenario of load balancing, the above-mentioned IP node is consistent with the IP layer data processing node in VPP (Vector Packet Processing, a high-performance network data packet processing software), but in the embodiment of the present application, a response function for messages from internal and external network virtual addresses (VIP1 and VIP2) is added to the IP node.

[0061] It is worth mentioning that the standby machine only has the IPSec function. When data is transmitted to the physical interface, the standby machine data plane will receive and process the data packet normally; while the host machine not only has the IPSec function, but also has the load balancing function. In the processing flow of the data plane, a load balancing node is added after the IP node so that the load balancing node can be used to distribute the data packets evenly.

[0062] Specific, combined Figure 4 As shown, in this embodiment, after receiving the data packet to be processed, the local IP node first determines whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain a corresponding first judgment result; it is worth mentioning that when the information represented by the above-mentioned first judgment result is different, the subsequent operations are also different. Specifically, after determining whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain the corresponding first judgment result, it can also include: if the first judgment result shows consistency, jump to the step of sending the data packet to be processed to the local load balancing node operation through the IP node and using the address matching result after determining that the current IP node is located at the host.

[0063] Step S12: If the first judgment result indicates inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched through the IP node and using the destination IP address to obtain a corresponding address matching result.

[0064] In this embodiment, combined with Figure 4As shown, after obtaining the first judgment result, the first judgment result needs to be further determined, that is, the result represented by the first judgment result determines the subsequent operation that the IP node should perform; when the first judgment result indicates inconsistency, the preset intranet virtual address and the preset external network virtual address need to be matched through the IP node and the target IP address to obtain the corresponding address matching result. However, after obtaining the corresponding address matching result, the embodiment of the present application needs to determine the address matching result, that is, the result represented by the address matching result determines the subsequent operation that the IP node should perform. Specifically, if the first judgment result indicates inconsistency, the preset intranet virtual address and the preset external network virtual address are matched through the IP node and the target IP address to obtain the corresponding address matching result, and it can also include: if the address matching result indicates that the match fails, the IP node forwards the to-be-processed data packet to a node other than the IP node and the load balancing node located in the target security gateway, or discards the to-be-processed data packet.

[0065] Step S13: If the address matching result indicates that the match is successful, after determining that the current IP node is located at the host, the to-be-processed data packet is sent to the local load balancing node through the IP node and using the address matching result.

[0066] In this embodiment, combined with Figure 4 As shown, since the result represented by the address matching result determines the subsequent operation that the IP node should perform, when the address matching result indicates that the match is successful, it is necessary to judge whether the current IP node is located in the host to obtain a second judgment result; then, the embodiment of the present application needs to determine the subsequent operation of the IP node based on the characterization result of the above second judgment result. Specifically, if the address matching result indicates that the match is successful, it can also include: judging whether the current IP node is located in the host to obtain the corresponding second judgment result; when the second judgment result indicates that the current IP node is not located in the host, the IP node forwards the data packet to be processed to the local encryption and decryption node to complete the corresponding balanced distribution operation so that the encryption and decryption node can process the data packet to be processed.

[0067] Step S14: performing session matching by using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node, and determining whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

[0068] In this embodiment, combined with Figure 5 As shown, after the load balancing node receives the data packet to be processed sent by the IP node, it is necessary to determine whether the data packet to be processed has been encrypted. It can be understood that if the load balancing node receives the data packet forwarded by the IP node through the preset intranet interface, it is considered that the data in the data packet to be processed is not encrypted; if the load balancing node receives the data packet forwarded by the IP node through the preset extranet interface, it is considered that the data in the data packet to be processed has been encrypted. Specifically, the session matching by the load balancing node using the target IPSec VPN tunnel address corresponding to the data packet to be processed may include: determining whether the data in the data packet to be processed has been encrypted by the load balancing node to obtain a corresponding third judgment result; then, subsequent operations need to be performed based on the result indicated by the third judgment result, that is, the representation of the third judgment result is different, and the operations performed are also different. Specifically, if the third judgment result indicates that it is not encrypted, the five-tuple information corresponding to the data packet to be processed is matched with the preset IPSec VPN policy, and the target IPSec VPN tunnel address corresponding to the data packet to be processed is determined based on the matching result; if the third judgment result indicates that it has been encrypted, the target IPSec VPN tunnel address corresponding to the data packet to be processed is used for session matching.

[0069] Among them, after performing session matching based on the target IPSec VPN tunnel address corresponding to the data packet to be processed, a corresponding matching result will be obtained, and the embodiment of the present application needs to perform subsequent operations based on the matching result. In a specific implementation, when the matching result indicates that the matching fails, it is necessary to create a session through the load balancing node and using the target IPSec VPN tunnel address. Specifically, after performing session matching through the load balancing node using the target IPSec VPN tunnel address corresponding to the data packet to be processed, it can also include: if the obtained session matching result indicates that the matching fails, then creating a session through the load balancing node and using the target IPSec VPN tunnel address, and after performing corresponding real server allocation for the created session based on the preset scheduling algorithm, determine whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the created session.

[0070] It can be understood that the above-mentioned preset scheduling algorithm can be determined according to actual needs, and any algorithm that can schedule data can be applicable to this embodiment, for example, the first-come-first-service scheduling algorithm (FCFS), priority scheduling algorithm (Priority Scheduling), shortest job first scheduling algorithm (SJF), high response ratio priority scheduling algorithm (HRRN), round-robin scheduling algorithm (RR), multi-level feedback queue scheduling algorithm (MFQS), etc.

[0071] In another specific implementation, when the matching result indicates a successful match, it is necessary to determine whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the target session obtained after the match. Specifically, the determination of whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session may include: determining whether the real server corresponding to the matched target session is the host to obtain a corresponding fourth judgment result; when the fourth judgment result indicates that the real server is the host, forwarding the data packet to be processed to the local encryption and decryption node through the load balancing node so that the encryption and decryption node processes the data packet to be processed; when the fourth judgment result indicates that the real server is not the host, triggering the target physical address update operation corresponding to the data packet to be processed.

[0072] It is understandable that when the fourth judgment result indicates that the real server is not the host, the target physical address update operation corresponding to the data packet to be processed is triggered, that is, the target physical address corresponding to the data packet to be processed is updated to the physical address corresponding to the real server. Specifically, the triggering of the target physical address update operation corresponding to the data packet to be processed to complete the balancing processing operation corresponding to the data packet to be processed may include: obtaining the first target physical address corresponding to the real server of the target session; updating the second target physical address corresponding to the data packet to be processed to the first target physical address.

[0073] In this embodiment, after the second target physical address corresponding to the data packet to be processed is updated to the first target physical address, it is necessary to return to the data source through the load balancing node. That is, if the IP node receives the data packet to be processed from the preset intranet interface corresponding to the intranet virtual address, the data packet to be processed after the target address is updated is returned from the preset intranet interface; if the IP node receives the data packet to be processed from the preset external network interface corresponding to the external network virtual address, the data packet to be processed after the target address is updated is returned from the preset external network interface. Specifically, the triggering of the target physical address update operation corresponding to the data packet to be processed to complete the balancing operation corresponding to the data packet to be processed may include: determining the target interface of the IP node receiving the data packet to be processed; if the target interface is the preset intranet interface corresponding to the intranet virtual address, the data packet to be processed is returned based on the preset intranet interface; if the target interface is the preset external network interface corresponding to the external network virtual address, the data packet to be processed is returned based on the preset external network interface to complete the balancing operation corresponding to the data packet to be processed.

[0074] This solution implements the preset routing mode deployment scenario based on the efficient data plane framework VPP, and implements load balancing of business data based on IPSecVPN. It can be understood that compared with the traditional load balancing solution, this solution eliminates the need for independent balancer equipment, greatly reduces the deployment cost, and simplifies the deployment solution; and by adopting the forwarding method of updating the destination MAC address in the preset intranet interface and the preset extranet interface corresponding to the intranet virtual address and the extranet virtual address respectively, the load balancing scenario is perfectly compatible with the IPSec VPN protocol.

[0075] As can be seen from the above, the present application uses the target security gateway as the host in the preset routing mode deployment scenario to use the local IP node to determine whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, thereby obtaining a first judgment result. If the first judgment result shows inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched using the target IP address and a matching result is obtained; if the matching result shows that the match is successful, after determining that the current IP node is located in the host, the data packet to be processed is sent to the local load balancing node using the matching result; and the target IPSec VPN tunnel address corresponding to the data packet to be processed is used for session matching through the load balancing node, and based on the real server corresponding to the matched target session, it is determined whether to trigger the target physical address update operation corresponding to the data packet to be processed, so as to complete the balancing processing operation corresponding to the data packet to be processed. In this way, IPSec VPN load balancing can be effectively realized without deploying an additional independent balancer, thereby reducing the cost and complexity of deployment and improving the user experience.

[0076] Combine the following Figure 5 The schematic diagram disclosed in the figure specifically illustrates the technical solution of the embodiment of the present application.

[0077] In this embodiment, the load balancing node is mainly used to distribute the data packets to be processed. The specific data packet processing flow is as follows:

[0078] After the data packet to be processed is sent to the load balancing node through the IP node and using the address matching result, the load balancing node will determine whether the data in the data packet to be processed has been encrypted; it is worth mentioning that the data in the data packet to be processed may not be encrypted, such as the protection traffic input through the preset intranet interface; if the data in the data packet to be processed is not encrypted, the five-tuple information corresponding to the data packet to be processed is matched with the preset IPSec VPN policy, wherein the five-tuple information corresponding to the data packet to be processed is the source IP address, source port, destination IP address, destination port and transport layer protocol corresponding to the data packet to be processed; if the data in the data packet to be processed has been encrypted, session matching is performed based on the target IPSec VPN tunnel address corresponding to the data packet to be processed, wherein the tunnel source address and destination address that are the same are the same tunnel, and the data packets of the same tunnel are in the same session.

[0079] It is worth mentioning that if the obtained session matching result indicates that the match fails, the load balancing node can use the target IPSec VPN tunnel address to create a session. After obtaining the created session, the real server can be allocated to the created session based on the preset scheduling algorithm, and then it is determined whether the above-mentioned real server is the host. If the real server is the host, the load balancing node forwards the data packet to be processed to the encryption and decryption node located locally on the host so that the encryption and decryption node processes the data packet to be processed; if the real server is not the host, the target physical address update operation corresponding to the data packet to be processed is triggered. Among them, the target physical address update operation corresponding to the data packet to be processed is as follows: obtain the MAC address corresponding to the real server of the target session, that is, the first target physical address; update the second target physical address corresponding to the data packet to be processed to the first target physical address, that is, update the destination MAC address corresponding to the message to the MAC address corresponding to the real server of the target session.

[0080] Finally, the data packet to be processed needs to be returned along the original route. The specific process is as follows: determine the target interface of the IP node to receive the data packet to be processed; if the target interface is the preset intranet interface corresponding to the intranet virtual address, return the data packet to be processed based on the preset intranet interface; if the target interface is the preset external network interface corresponding to the external network virtual address, return the data packet to be processed based on the preset external network interface to complete the balancing operation corresponding to the data packet to be processed. It can be understood that the load balancing node uses a preset balancing algorithm to balance forwarding the data packet to be processed. The preset balancing algorithm can be determined according to actual needs. For example, LVS supports polling (Linux Virtual Server), weighted polling (WRR, Weight RoundRobin), smooth weighted polling algorithm (SWRR, Smooth Weight Round Robin) and other balancing algorithms can be used, which are not specifically limited here. It is worth mentioning that in order to maximize the working efficiency of the entire load balancing scenario, it is necessary to reduce the balancing weight of the host, and provide sufficient computing power for the host to distribute data to avoid the host becoming a bottleneck for load balancing.

[0081] It can be seen that the present application obtains the first judgment result by using the local IP node to judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address. If the first judgment result shows inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched by using the target IP address and a matching result is obtained; if the matching result shows that the match is successful, after determining that the current IP node is located at the host, the data packet to be processed is sent to the local load balancing node by using the matching result; and the target IPSec VPN tunnel address corresponding to the data packet to be processed is used for session matching by the load balancing node, and based on the real server corresponding to the matched target session, it is determined whether to trigger the target physical address update operation corresponding to the data packet to be processed, so as to complete the balancing processing operation corresponding to the data packet to be processed. In this way, IPSec VPN load balancing can be effectively realized without deploying an independent balancer, thereby reducing the cost and complexity of deployment and improving the user experience.

[0082] See also Figure 6 As shown, the embodiment of the present application also provides a load balancing processing device, which is applied to a target security gateway as a host in a preset routing mode deployment scenario, including:

[0083] The judgment result acquisition module 11 is used to receive the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain the corresponding first judgment result;

[0084] A matching result acquisition module 12 is used for matching the preset intranet virtual address and the preset extranet virtual address through the IP node and using the target IP address to obtain a corresponding address matching result if the first judgment result indicates inconsistency;

[0085] The data packet sending module 13 is used for sending the data packet to be processed to the local load balancing node through the IP node and using the address matching result after determining that the current IP node is located at the host if the address matching result indicates that the match is successful;

[0086] The session matching module 14 is used to perform session matching using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node, and determine whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

[0087] As can be seen from the above, in the process of load balancing, the embodiment of the present application needs to receive the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address to obtain the corresponding first judgment result; if the first judgment result shows inconsistency, the preset intranet virtual address and the preset extranet virtual address are matched by the IP node and the destination IP address to obtain the corresponding address matching result; if the address matching result shows that the match is successful, after determining that the current IP node is located at the host, the data packet to be processed is sent to the local load balancing node through the IP node and the address matching result; the target IPSec VPN tunnel address corresponding to the data packet to be processed is used by the load balancing node to perform session matching, and determine whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed. In this way, IPSec VPN load balancing can be effectively realized without deploying an independent balancer, thereby reducing the cost and complexity of deployment and improving the user experience.

[0088] In some specific implementations, the judgment result acquisition module 11 may specifically include:

[0089] The data packet sending unit is used to jump to the step of sending the to-be-processed data packet to the local load balancing node operation through the IP node and using the address matching result after determining that the current IP node is located at the host if the first judgment result shows consistency.

[0090] In some specific implementations, the matching result acquisition module 12 may specifically include:

[0091] A data packet operation unit, configured to forward the data packet to be processed to a node other than the IP node and the load balancing node located in the target security gateway through the IP node, or discard the data packet to be processed if the address matching result indicates that the match fails;

[0092] A first judgment result obtaining unit is used to judge whether the current IP node is located at the host if the address matching result indicates that the match is successful, so as to obtain a corresponding second judgment result;

[0093] The data packet processing unit is used to forward the data packet to be processed to the local encryption and decryption node through the IP node when the second judgment result indicates that the current IP node is not located at the host, and complete the corresponding balanced distribution operation so that the encryption and decryption node can process the data packet to be processed.

[0094] In some specific implementations, the conversation matching module 14 may specifically include:

[0095] A second judgment result obtaining unit, configured to judge whether the data in the to-be-processed data packet has been encrypted through the load balancing node, so as to obtain a corresponding third judgment result;

[0096] a tunnel address determining unit, configured to match the five-tuple information corresponding to the data packet to be processed with a preset IPSec VPN policy if the third judgment result indicates that the data packet is not encrypted, and determine a target IPSec VPN tunnel address corresponding to the data packet to be processed based on the obtained matching result;

[0097] The session matching unit is used to perform session matching using the target IPSec VPN tunnel address corresponding to the data packet to be processed if the third judgment result indicates that it has been encrypted.

[0098] In some specific implementations, the conversation matching module 14 may specifically include:

[0099] The session creation unit is used to create a session through the load balancing node and using the target IPSec VPN tunnel address if the obtained session matching result indicates that the match fails, and after allocating the corresponding real server to the created session based on a preset scheduling algorithm, determine whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the created session.

[0100] In some specific implementations, the conversation matching module 14 may specifically include:

[0101] a third judgment result obtaining unit, configured to judge whether the real server corresponding to the matched target session is the host, so as to obtain a corresponding fourth judgment result;

[0102] A data packet forwarding unit, configured to forward the data packet to be processed to a local encryption and decryption node through the load balancing node when the fourth judgment result indicates that the real server is the host, so that the encryption and decryption node processes the data packet to be processed;

[0103] The address update triggering unit is used to trigger the target physical address update operation corresponding to the data packet to be processed when the fourth judgment result indicates that the real server is not the host.

[0104] In some specific implementations, the conversation matching module 14 may specifically include:

[0105] A physical address acquisition unit, configured to acquire a first target physical address corresponding to the real server of the target session;

[0106] A physical address updating unit, configured to update a second target physical address corresponding to the data packet to be processed to the first target physical address;

[0107] An interface determination unit, used for determining a target interface for receiving the data packet to be processed by the IP node;

[0108] A first data packet returning unit, configured to return the data packet to be processed based on the preset intranet interface if the target interface is a preset intranet interface corresponding to the intranet virtual address;

[0109] The second data packet returning unit is used to return the data packet to be processed based on the preset external network interface if the target interface is the preset external network interface corresponding to the external network virtual address, so as to complete the balancing processing operation corresponding to the data packet to be processed.

[0110] Furthermore, the present application also discloses an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the load balancing processing method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0111] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0112] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0113] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the load balancing processing method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0114] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed load balancing processing method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0115] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0117] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0118] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0119] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A load balancing processing method, characterized in that: Applies to the target security gateway as a host in a preset routing mode deployment scenario, including: Receiving a corresponding data packet to be processed through a local IP node and a preset data plane development kit, and determining whether a destination IP address corresponding to the data packet to be processed is consistent with a local physical address, so as to obtain a corresponding first determination result; If the first judgment result indicates inconsistency, matching the preset intranet virtual address and the preset extranet virtual address by using the destination IP address through the IP node to obtain a corresponding address matching result; If the address matching result indicates that the match is successful, after determining that the current IP node is located at the host, the to-be-processed data packet is sent to the local load balancing node through the IP node and using the address matching result; The load balancing node uses the target IPSec VPN tunnel address corresponding to the data packet to be processed to perform session matching, and determines whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

2. The load balancing processing method according to claim 1, characterized in that: After determining whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address to obtain the corresponding first determination result, the method further includes: If the first judgment result is consistent, jump to the step of sending the to-be-processed data packet to the local load balancing node operation through the IP node and using the address matching result after determining that the current IP node is located at the host.

3. The load balancing processing method according to claim 1, characterized in that: If the first judgment result indicates inconsistency, then after matching the preset intranet virtual address and the preset extranet virtual address by using the target IP address through the IP node to obtain a corresponding address matching result, the method further includes: If the address matching result indicates that the match fails, the data packet to be processed is forwarded to a node other than the IP node and the load balancing node located in the target security gateway through the IP node, or the data packet to be processed is discarded; Correspondingly, if the address matching result indicates that the match is successful, the method further includes: Determine whether the current IP node is located at the host to obtain a corresponding second determination result; When the second judgment result indicates that the current IP node is not located in the host, the data packet to be processed is forwarded to the local encryption and decryption node through the IP node to complete the corresponding balanced distribution operation so that the encryption and decryption node can process the data packet to be processed.

4. The load balancing processing method according to claim 1, characterized in that: The performing session matching by using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node includes: Determining, by the load balancing node, whether the data in the to-be-processed data packet has been encrypted, so as to obtain a corresponding third determination result; If the third judgment result indicates that it is not encrypted, matching the five-tuple information corresponding to the data packet to be processed with the preset IPSec VPN policy, and determining the target IPSec VPN tunnel address corresponding to the data packet to be processed based on the obtained matching result; If the third judgment result indicates that it has been encrypted, session matching is performed using the target IPSec VPN tunnel address corresponding to the data packet to be processed.

5. The load balancing processing method according to claim 1, characterized in that: After performing session matching by using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node, the method further includes: If the obtained session matching result indicates that the match fails, a session is created through the load balancing node and using the target IPSec VPN tunnel address, and after the created session is assigned a corresponding real server based on a preset scheduling algorithm, it is determined based on the created session whether to trigger a target physical address update operation corresponding to the data packet to be processed.

6. The load balancing processing method according to claim 1, characterized in that: The determining whether to trigger a target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session includes: Determine whether the real server corresponding to the matched target session is the host to obtain a corresponding fourth determination result; When the fourth judgment result indicates that the real server is the host, the data packet to be processed is forwarded to the local encryption and decryption node through the load balancing node, so that the encryption and decryption node processes the data packet to be processed; When the fourth judgment result indicates that the real server is not the host, a target physical address update operation corresponding to the data packet to be processed is triggered.

7. The load balancing processing method according to any one of claims 1 to 6, characterized in that: The triggering of the target physical address update operation corresponding to the data packet to be processed to complete the balancing processing operation corresponding to the data packet to be processed includes: Obtaining a first target physical address corresponding to the real server of the target session; Updating the second target physical address corresponding to the data packet to be processed to the first target physical address; Determine the target interface of the IP node for receiving the data packet to be processed; If the target interface is a preset intranet interface corresponding to the intranet virtual address, the to-be-processed data packet is returned based on the preset intranet interface; If the target interface is a preset external network interface corresponding to the external network virtual address, the data packet to be processed is returned based on the preset external network interface to complete the balancing processing operation corresponding to the data packet to be processed.

8. A load balancing processing device, characterized in that: include: A judgment result acquisition module is used to receive the corresponding data packet to be processed through the local IP node and the preset data plane development kit, and judge whether the destination IP address corresponding to the data packet to be processed is consistent with the local physical address, so as to obtain the corresponding first judgment result; A matching result acquisition module, configured to match the preset intranet virtual address and the preset extranet virtual address through the IP node and using the target IP address to obtain a corresponding address matching result if the first judgment result indicates inconsistency; A data packet sending module, for sending the data packet to be processed to a local load balancing node through the IP node and using the address matching result after determining that the current IP node is located at the host if the address matching result indicates that the match is successful; The session matching module is used to perform session matching by using the target IPSec VPN tunnel address corresponding to the data packet to be processed through the load balancing node, and determine whether to trigger the target physical address update operation corresponding to the data packet to be processed based on the real server corresponding to the matched target session, so as to complete the balancing processing operation corresponding to the data packet to be processed.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the load balancing processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the load balancing processing method according to any one of claims 1 to 7 are implemented.

Images