Network platform dual-machine hot standby method based on VRRP (Virtual Router Redundancy Protocol)

Abstract

The invention relates to a network platform dual-machine hot standby method based on a VRRP protocol, and belongs to the technical field of network security. According to the method, a plurality of network platforms form a VRRP group based on a VRRP protocol, and equipment in the group is divided into Master equipment and Backup equipment according to priorities and virtual IPs of the network platforms; in an information exchange process between a Master device and a Backup device, a ciphertext is used for interaction, a thread is specially started in each of the Master device and the Backup device to process a dual-machine hot standby service, in the information exchange process, a device in a VRRP group carries out key negotiation on other devices in the group through multicast communication, negotiated keys are different from one another, and the other devices in the VRRP group carry out key negotiation on the other devices in the group through multicast communication. Different sessions are used for recording, and the information synchronization process between the main machine and the standby machine is protected in this way. According to the invention, a more perfect and safer scheme can be provided for the network platform dual-computer hot standby process, and the stability and disaster recovery performance of the platform are improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a network platform dual-machine hot standby method based on VRRP protocol. Background Art

[0002] With the rapid development of economy and society, the functions of computer and network technology are becoming more and more perfect, and the application fields are becoming more and more extensive. The network provides a convenient and fast information exchange channel for the development of society. All aspects of society are inseparable from the network, and the network security issues are becoming more and more serious. Recently, various network platforms have become more and more popular, responsible for the analysis, storage and forwarding of various data packets, so the stability and disaster recovery performance of the equipment are particularly important. However, the current network platform mainly performs simple hot standby functions through the heartbeat port. The number of standby machines and the hot standby mechanism need to be optimized and improved. At the same time, the security of information interaction and communication between the main and standby machines cannot be guaranteed. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to provide a dual-machine hot standby method for a network platform based on the VRRP protocol to solve the problem that the current network platform mainly performs simple hot standby functions through the heartbeat port, and the number of standby machines and the hot standby mechanism need to be optimized and improved.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention proposes a network platform dual-machine hot standby method based on the VRRP protocol, the method comprising:

[0007] Hot standby process: Based on the VRRP protocol, several network platforms are organized into a VRRP group. The devices in the group are divided into Master and Backup devices according to the priority and virtual IP of the network platform. In normal operation, only the Master device provides encryption and decryption and forwarding services, while the Backup device is on standby. The Master and Backup devices detect each other's status through the heartbeat interface. Once the status monitoring of the master device is abnormal or the master device synchronization message is not received, the backup device with the highest priority is selected to replace the master device to work.

[0008] Key negotiation process: During the information exchange process between the Master device and the Backup device, ciphertext is used for interaction. A thread is started inside the Master device and the Backup device to handle the hot standby service. During the information exchange process, the devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different and recorded in different sessions. In this way, the information synchronization process between the master and the backup devices is protected.

[0009] (III) Beneficial effects

[0010] The present invention proposes a dual-machine hot standby method for a network platform based on the VRRP protocol. The present invention is improved based on the VRRP protocol. On the one hand, the number of standby machines in the dual-machine hot standby process is increased, and the stability of the hot standby process and the switching speed of the main and standby machines are improved through a series of mechanisms. On the other hand, the information interaction between the traditional dual-machine hot standby heartbeat ports is all in plain text, and the present invention uses ciphertext for interaction, which greatly improves the security of the information interaction process. The present invention can provide a more complete and secure solution for the dual-machine hot standby process of the network platform, and realize the improvement of the stability and disaster recovery performance of the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a diagram of the VRRP dual-machine hot standby structure of the present invention;

[0012] Figure 2 This is a flow chart of data negotiation encryption and decryption of the present invention. DETAILED DESCRIPTION

[0013] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0014] The purpose of the present invention is to provide a dual-machine hot standby method based on an improved VRRP protocol, thereby increasing the number of standby machines and the stability of dual-machine hot standby, and at the same time providing a negotiation mechanism on the heartbeat message path of the master and standby machines to ensure the security of the data synchronization process between the master and standby machines.

[0015] The present invention provides a network platform dual-machine hot standby method based on VRRP protocol to improve the stability of the current network platform hot standby method, and also provides a key negotiation mechanism to improve the security of data exchange between the master and standby machines.

[0016] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0017] The first aspect is the hot standby process of two machines: the present invention forms a VRRP group with several network platforms based on the VRRP protocol, wherein the devices in the group are divided into Master devices and Backup devices according to the priority and virtual IP of the network platform. In normal operation, only the Master device provides encryption and decryption and forwarding services for the business, and the Backup device is on standby. The Master device and the Backup device detect each other's status through the heartbeat port. Once the status monitoring of the master device is abnormal or the master device synchronization message is not received, the backup device with the highest priority is selected to replace the master device to work. The specific hot standby mechanism is described in detail below.

[0018] Furthermore, the network platform is deployed at the connection between the internal network domain and the external network domain.

[0019] The second aspect is the key negotiation process: in the information exchange process between the Master device and the Backup device, the present invention uses ciphertext for interaction. The Master device and the Backup device each start a thread specifically to handle the dual-machine hot standby service. In the information exchange process, the devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different from each other and are recorded using different sessions. In this way, the information synchronization process between the master and the backup machines is protected.

[0020] Furthermore, the key negotiation includes: key negotiation between the Master device and the Backup device, and key negotiation between the Backup devices.

[0021] Embodiment 1:

[0022] The following is a further detailed description of the dual-machine hot standby process and the negotiation process based on the VRRP protocol of the present invention in conjunction with the embodiments.

[0023] In the dual-machine hot standby process, the present invention designs the network platform as follows:

[0024] 1. Masters device (host): Under normal circumstances, the Masters device is responsible for ARP response and providing business functions, and by default notifies other Backup devices of the current host status information every 1 second.

[0025] 2. Backup device: It is the backup network platform of the Masters device and does not provide business functions under normal circumstances. When the Masters device fails, the one with the highest priority among all the Backup devices becomes the new Masters device and takes over the business functions of the main device, thus ensuring uninterrupted business.

[0026] 3. The default priority of the device in the VRRP group is 100, and the value range is 0 to 255. Priority 0 is reserved by the system, and 255 is reserved for the IP address owner, which has the highest priority. During operation, key negotiation is first performed through the heartbeat interface and the priorities of each device are exchanged. The device with the highest priority is elected as the Masters device. If the priority is the same, the IP address size of the interface is compared. The device with the larger IP address becomes the Masters device, and the other network platforms in the backup group become the Backup devices.

[0027] The workflow of hot standby is as follows:

[0028] S11. The network platform is powered on and a Master device is elected in the VRRP group. After VRRP is enabled, the device sends VRRP packets using the multicast address to exchange VRRP information. The device with the highest priority is elected as the Master.

[0029] S12. The internal and external network units of the Master device send free ARP packets to notify the devices or hosts in the internal and external network domains connected to it of the virtual MAC address, and undertake the tasks of packet forwarding and encryption and decryption.

[0030] S13. The Master device periodically sends VRRP notification messages to all Backup devices in the group. If the Master device fails and the Backup device does not receive the Master device notification message within 3 seconds, after a short preemption delay, the Backup device with a higher priority is selected as the Master device.

[0031] S14. The internal and external network units of the new Master device will immediately send a free ARP message containing the VRRP message of the virtual IP address and virtual MAC address of the device to refresh the MAC table entries in the devices and host devices connected to the VRRP group, thereby guiding the user traffic to the new Master device. The whole process is completely transparent to the user.

[0032] S15. When the original Master device recovers from a fault, if the original Master device is the IP address owner (priority is 255), it will be restored as the Master device. If its priority is less than 255, it will be switched to the Backup device, and its priority will be restored to the previous priority of 255.

[0033] The above is a description of the overall process of hot standby. Key negotiation will be described below.

[0034] Key negotiation process:

[0035] The key negotiation process is carried out by sending multicast information through the Master device. By sending multicast key negotiation messages in a loop, negotiation is carried out in order of reply time until the negotiation is completed with all backup devices in the VRRP group. The following example takes the key negotiation process of two network platform devices as an example. Figure 2 Structure,To realize ciphertext hot standby, the network platform can roughly add three modules, namely, system management module, resource management module and isolated FPGA.

[0036] 1. Assume that the IP of network platform 1 is set to 192.168.0.100 and the IP of network platform 2 is set to 192.168.0.200. After the two devices are powered on, network platforms 1 and 2 send the negotiation strategy of hot standby data synchronization key to their own resource management modules. The strategy content probably includes the source and destination IP addresses of outbound and inbound modes, encryption protocol, transmission mode (tunnel or transmission), negotiation and encapsulation IP.

[0037] 2. The Master host initiates a key negotiation command and sends it to the resource management module through the system management module. The resource management module performs the key negotiation process through the isolated FPGA.

[0038] 3. When the data packet generated by the resource management module passes through the isolated FPGA and reaches the system management module, the data is encapsulated and the checksum is calculated. After the encapsulation is completed, it is sent to the other end. During the negotiation process, both parties will check the data integrity. If the check fails, it will not pass, discard the negotiation data and re-initiate the negotiation.

[0039] After key negotiation, the synchronous data exchange of dual-machine hot standby adopts ciphertext mode, and the interactive content mainly includes heartbeat information, policy information, system configuration, etc. The specific process is as follows.

[0040] Data synchronization process:

[0041] a. Encryption process

[0042] S21, the system management module sends the plain text of the data to be synchronized in the dual-machine hot standby process to the resource management module through the isolated FPGA;

[0043] S22, the resource management module encrypts the data according to the negotiated key, and sends the data to the system management module through the isolated FPGA.

[0044] S23, the system management module encapsulates the ciphertext, adds an IP header, performs NAT traversal format encapsulation, calculates the checksum, adds an ether header, adds the local and peer MAC addresses through the ARP table, adds the protocol type, and completes the encapsulation operation.

[0045] b. Decryption process

[0046] S31. After receiving the ciphertext data, the dual-machine hot standby thread of the system management module decrypts it, checks and judges the header information, and does not process the message that does not meet the format requirements.

[0047] S32. Send the decapsulated data to the resource management module for decryption.

[0048] S33, the resource management module sends the decrypted plain text to the system management module through the isolated FPGA for processing.

[0049] Since then, the information exchange process has been completed, and the validity period and number of times the negotiated key is used can be set by the user. During the data synchronization process, both parties will perform verification and check. If the data integrity check fails, the system management module will re-initiate the data synchronization process.

[0050] The present invention is improved based on the VRRP protocol. On the one hand, the number of standby machines in the dual-machine hot standby process is increased, and the stability of the hot standby process and the switching speed of the main and standby machines are improved through a series of mechanisms. On the other hand, the information interaction between the traditional dual-machine hot standby heartbeat ports is all in plain text, and the present invention uses ciphertext for interaction, which greatly improves the security of the information interaction process. The present invention can provide a more complete and secure solution for the dual-machine hot standby process of the network platform, and realize the improvement of the stability and disaster recovery performance of the platform.

[0051] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network platform dual-machine hot standby method based on VRRP protocol, characterized in that: The method includes: Hot standby process: Based on the VRRP protocol, several network platforms are organized into a VRRP group. The devices in the group are divided into Master and Backup devices according to the priority and virtual IP of the network platform. In normal operation, only the Master device provides encryption and decryption and forwarding services, while the Backup device is on standby. The Master and Backup devices detect each other's status through the heartbeat interface. Once the status monitoring of the master device is abnormal or the master device synchronization message is not received, the backup device with the highest priority is selected to replace the master device to work. Key negotiation process: During the information exchange process between the Master device and the Backup device, ciphertext is used for interaction. A thread is started inside the Master device and the Backup device to handle the hot standby service. During the information exchange process, the devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different and recorded in different sessions. In this way, the information synchronization process between the master and the backup devices is protected.

2. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 1, characterized in that: The network platform is deployed at the junction of the internal network domain and the external network domain.

3. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 1, characterized in that: Key negotiation includes key negotiation between the master and backup devices and key negotiation between backup devices.

4. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 1, characterized in that: The Masters device is responsible for ARP response and providing business functions, and by default notifies other Backup devices of the current host status information every 1 second. The Backup device is the backup network platform for the Masters device and does not provide business functions under normal circumstances. When the Masters device fails, the Backup device with the highest priority among all the Backup devices becomes the new Masters device and takes over the business functions of the Master device, thus ensuring uninterrupted business.

5. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 1, characterized in that: The default priority of a device in a VRRP group is 100, and the value range is 0 to 255. Priority 0 is reserved for the system, and 255 is reserved for the IP address owner, which has the highest priority. During operation, key negotiation is first performed through the heartbeat interface and the priorities of each device are exchanged. The device with the highest priority is elected as the Masters device. If the priorities are the same, the IP addresses of the interfaces are compared. The device with the larger IP address becomes the Masters device, and the other network platforms in the backup group become the Backup devices.

6. The network platform dual-machine hot standby method based on the VRRP protocol according to any one of claims 1 to 5, characterized in that: The workflow of hot standby is as follows: S11. The network platform is powered on, and the master device is elected in the VRRP group. After VRRP is enabled, the device sends VRRP packets through the multicast address to exchange VRRP information. The device with the highest priority is elected as the master. S12, the internal and external network units of the Master device send free ARP packets to notify the virtual MAC address to the devices or hosts in the internal and external network domains connected to it, and undertake the tasks of packet forwarding and encryption and decryption; S13: The master device periodically sends VRRP notification messages to all backup devices in the group. If the master device fails and the backup device does not receive the master device notification message within 3 seconds, after a short preemption delay, the backup device with a higher priority is selected as the master device. S14. The internal and external network units of the new Master device will immediately send a free ARP message containing the virtual IP address and virtual MAC address of the device to refresh the MAC table entries in the devices and host devices connected to the VRRP group, thereby directing user traffic to the new Master device. The whole process is completely transparent to the user. S15. When the original Master device recovers from a fault, if the original Master device is the IP address owner, it will be restored as the Master device. If its priority is less than 255, it will be switched to the Backup device and its priority will be restored to the previous priority of 255.

7. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 6, characterized in that: The key negotiation process is carried out by sending multicast information by the master device. The multicast key negotiation message is sent cyclically, and the negotiation is carried out in the order of reply time until the negotiation is completed with all backup devices in the VRRP group.

8. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 7, characterized in that: The network platform includes: system management module, resource management module and isolated FPGA; Assume that the IP of network platform 1 is set to 192.168.0.100 and the IP of network platform 2 is set to 192.168.0.

200. After the two devices are powered on, network platforms 1 and 2 respectively send the negotiation strategy of hot standby data synchronization key to their own resource management modules; the strategy content includes the source and destination IP addresses of outbound and inbound modes, encryption protocol, transmission method, negotiation and encapsulation IP; The master host initiates a key negotiation command and sends it to the resource management module through the system management module. The resource management module performs the key negotiation process through the isolated FPGA. When the data packet generated by the resource management module passes through the isolation FPGA and reaches the system management module, the data is encapsulated and the checksum is calculated. After the encapsulation is completed, it is sent to the other end. During the negotiation process, both parties will check the data integrity. If the check fails, it will not pass, the negotiation data will be discarded and the negotiation will be initiated again. After key negotiation, the synchronous data exchange of dual-machine hot standby adopts ciphertext mode, and the interactive content includes heartbeat information, policy information and system configuration.

9. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 8, characterized in that: The data encryption process includes: S21, the system management module sends the plain text of the data to be synchronized in the dual-machine hot standby process to the resource management module through the isolated FPGA; S22, the resource management module encrypts the data according to the negotiated key, and sends the data to the system management module through the isolated FPGA; S23. The system management module encapsulates the ciphertext, adds an IP header, performs NAT traversal format encapsulation, calculates the checksum, adds an ether header, adds the local and peer MAC addresses through the ARP table, adds the protocol type, and completes the encapsulation operation.

10. The network platform dual-machine hot standby method based on VRRP protocol as claimed in claim 8, characterized in that: The data decryption process includes: S31, the dual-machine hot standby thread of the system management module decrypts the ciphertext data after receiving it, checks and judges the header information, and does not process the message that does not meet the format requirements; S32, sending the decapsulated data to the resource management module for decryption; S33, the resource management module sends the decrypted plain text to the system management module through the isolated FPGA for processing.

Images