A network platform dual-computer hot backup method based on VRRP protocol

Abstract

This invention relates to a dual-machine hot standby method for network platforms based on the VRRP protocol, belonging to the field of network security technology. This invention groups several network platforms into a VRRP group based on the VRRP protocol. The devices within the group are divided into Master devices and Backup devices according to the priority and virtual IP of the network platforms. During information exchange between the Master and Backup devices, encrypted communication is used. Each Master and Backup device has a dedicated thread to handle the dual-machine hot standby service. During information exchange, devices within the VRRP group negotiate keys with other devices in the group via multicast communication. The negotiated keys are different for each device, and different sessions are used for recording. This method protects the information synchronization process between the master and backup machines. This invention provides a more complete and secure solution for the dual-machine hot standby process of network platforms, improving the stability and disaster recovery performance of the platform.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a dual-machine hot standby method for a network platform based on the VRRP protocol. Background Technology

[0002] With the rapid development of the economy and society, the functions of computer and network technologies are becoming increasingly sophisticated, and their applications are expanding. The network provides a convenient and efficient channel for information exchange, and all aspects of society rely on it. However, this also brings with it increasingly serious network security issues. Recently, various network platforms have become increasingly widespread, responsible for parsing, storing, and forwarding various data packets. Therefore, the stability and disaster recovery capabilities of these devices are particularly important. However, current network platforms mainly rely on simple hot standby functions via heartbeat ports. The number of standby machines and the hot standby mechanism need optimization and improvement. Furthermore, the security of information exchange and communication between primary and standby machines cannot be guaranteed. Summary of the Invention

[0003] (a) Technical problems to be solved

[0004] The technical problem to be solved by this invention is how to provide a dual-machine hot standby method for network platforms based on the VRRP protocol, so as to solve the problem that the current network platforms mainly perform simple hot standby functions through the heartbeat port, and the number of standby machines and the hot standby mechanism need to be optimized and improved.

[0005] (II) Technical Solution

[0006] To address the aforementioned technical problems, this invention proposes a dual-machine hot standby method for network platforms based on the VRRP protocol, the method comprising:

[0007] Dual-machine hot standby process: Based on the VRRP protocol, several network platforms are grouped into a VRRP group. The devices in the group are divided into Master devices and Backup devices according to the priority of the network platforms and virtual IPs. During normal operation, only the Master device provides encryption, decryption and forwarding services, while the Backup devices are in standby mode. The Master device and the Backup device detect each other's status through a heartbeat interface. If the status of the Master device is abnormal or no synchronization message is received from the Master device, the highest priority backup device is selected to replace the Master device to perform the work.

[0008] Key negotiation process: During the information exchange process between the Master device and the Backup device, encrypted communication is used. Each of the Master and Backup devices starts a dedicated thread to handle the dual-machine hot standby service. During the information exchange process, devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different from each other and are recorded using different sessions. This method protects the information synchronization process between the master and backup devices.

[0009] (III) Beneficial Effects

[0010] This invention proposes a dual-machine hot standby method for network platforms based on the VRRP protocol. This invention improves upon the VRRP protocol by increasing the number of standby machines during dual-machine hot standby and enhancing the stability and master-slave switching speed through a series of mechanisms. Furthermore, while traditional dual-machine hot standby uses plaintext for heartbeat interface communication, this invention uses encrypted communication, significantly improving the security of the information exchange process. This invention provides a more comprehensive and secure solution for dual-machine hot standby in network platforms, enhancing platform stability and disaster recovery capabilities. Attached Figure Description

[0011] Figure 1 This is a diagram of the VRRP dual-machine hot standby structure of the present invention;

[0012] Figure 2 This is a flowchart of the data negotiation encryption / decryption process of the present invention. Detailed Implementation

[0013] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0014] The purpose of this invention is to provide a dual-machine hot standby method based on an improved VRRP protocol, which increases the number of standby machines and the stability of dual-machine hot standby. At the same time, it provides a negotiation mechanism on the heartbeat communication path between the primary and standby machines to ensure the security of the data synchronization process between the primary and standby machines.

[0015] This invention provides a dual-machine hot standby method for network platforms based on the VRRP protocol to improve the stability of current network platform hot standby methods, and also provides a key negotiation mechanism to improve the security of data exchange between the primary and standby machines.

[0016] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0017] Firstly, the dual-machine hot standby process: This invention uses the VRRP protocol to group several network platforms into a VRRP group. Based on the network platform's priority and virtual IP address, the devices within the group are divided into Master devices and Backup devices. During normal operation, only the Master device provides encryption / decryption and forwarding services, while the Backup devices remain in standby mode. The Master and Backup devices monitor each other's status via a heartbeat interface. If the Master device's status monitoring fails or it fails to receive a synchronization message from the Master device, the highest-priority backup device is selected to replace the Master device. The specific hot standby mechanism is detailed below.

[0018] Furthermore, the network platform is deployed at the connection point between the internal and external network domains.

[0019] Secondly, the key negotiation process: In the information exchange process between the Master device and the Backup device, the present invention uses encrypted communication. Each of the Master device and the Backup device starts a dedicated thread to handle the dual-machine hot standby service. During the information exchange process, the devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different from each other and are recorded using different sessions. In this way, the information synchronization process between the master and backup machines is protected.

[0020] Furthermore, key negotiation includes: key negotiation between the Master device and the Backup device, and key negotiation between Backup devices.

[0021] Example 1:

[0022] The following detailed description of the dual-machine hot standby process and negotiation process based on the VRRP protocol of the present invention, with reference to specific embodiments, further illustrates this invention.

[0023] During dual-machine hot standby, this invention designs the network platform as follows:

[0024] 1. Masters device (host): Under normal circumstances, the Masters device is responsible for ARP response and providing business functions, and by default, it notifies other Backup devices of the current host status information every 1 second.

[0025] 2. Backup devices: These are the standby network platforms for the Master devices and do not provide service functions under normal circumstances. When a Master device fails, the highest priority Backup device becomes the new Master device, taking over the service functions of the primary device, thus ensuring uninterrupted service.

[0026] 3. The default priority of devices in a VRRP group is 100, with a value range of 0 to 255. Priority 0 is reserved by the system, while 255 is reserved for the IP address owner, who has the highest priority. During operation, the device first negotiates a key and exchanges priorities through the heartbeat interface. The device with the highest priority is elected as the Master device. If the priorities are the same, the IP address of the interface is compared, and the device with the larger IP address becomes the Master device. Other network platforms in the backup group become Backup devices.

[0027] The workflow for dual-machine hot standby is as follows:

[0028] S11. When the network platform powers on, a Master device is elected in the VRRP group. After VRRP is enabled, the device sends VRRP messages via its multicast address and exchanges VRRP information. The device with the highest priority is selected as the Master.

[0029] S12. The internal and external network units of the Master device send gratuitous ARP packets to notify devices or hosts in the internal and external network domains connected to it of the virtual MAC address, and undertake packet forwarding and encryption / decryption tasks.

[0030] S13. The Master device periodically sends VRRP notification messages to all Backup devices in the group. If the Master device fails and the Backup device does not receive the notification message from the Master device within 3 seconds, after a short preemption delay, the Backup device with the higher priority is selected as the Master device.

[0031] S14. The internal and external network units of the new Master device will immediately send gratuitous ARP packets containing VRRP packets with the virtual IP address and virtual MAC address of the device to refresh the MAC table entries in the devices and host devices connected to the VRRP group, thereby directing user traffic to the new Master device. The whole process is completely transparent to the user.

[0032] S15. When the original Master device recovers from a failure, if the original Master device is the IP address owner (priority of 255), restore it to the Master device; if its priority is less than 255, switch it to the Backup device and restore its priority to the previous priority of 255.

[0033] The above describes the overall process of dual-machine hot standby. Key negotiation will be described below.

[0034] Key negotiation process:

[0035] The key negotiation process is conducted via multicast messages sent by the Master device. This involves cyclically sending multicast key negotiation messages and negotiating according to the order of response time until negotiation is completed with all Backup devices in the VRRP group. The following example illustrates the key negotiation process between two network platform devices. Figure 2 In terms of structure, the network platform can be roughly divided into three modules to achieve encrypted hot backup: system management module, resource management module, and isolation FPGA.

[0036] 1. Assuming network platform 1's IP is set to 192.168.0.100 and network platform 2's IP is set to 192.168.0.200, after both devices are powered on, network platforms 1 and 2 respectively issue negotiation strategies for dual-machine hot standby data synchronization keys to their own resource management modules. The strategy content roughly includes the source and destination IP addresses for outbound and inbound modes, encryption protocol, transmission method (tunnel or transport), and negotiated and encapsulated IP.

[0037] 2. The Master host initiates a key negotiation command, which is sent to the resource management module through the system management module. The key negotiation process is then carried out by the resource management module after passing through the isolated FPGA.

[0038] 3. When the data packet generated by the resource management module arrives at the system management module after passing through the isolated FPGA, the data is encapsulated and a checksum is calculated. After encapsulation, it is sent to the other end. During the negotiation process, both communicating parties will verify the integrity of the data. If the verification fails, the negotiation fails, the data is discarded, and the negotiation is restarted.

[0039] After key negotiation, the synchronous data exchange in the dual-machine hot standby is encrypted, and the exchanged content mainly includes heartbeat information, policy information, system configuration, etc. The specific process is as follows.

[0040] Data synchronization process:

[0041] a. Encryption process

[0042] S21. The system management module sends the plaintext data to be synchronized during the dual-machine hot standby process to the resource management module through the isolated FPGA.

[0043] S22. The resource management module encrypts the data using the negotiated key and then sends the data to the system management module via the isolated FPGA.

[0044] S23. The system management module encapsulates the ciphertext, adds an IP header, performs NAT traversal encapsulation, and calculates the checksum. It also adds an Ether header, adds the local and peer MAC addresses and protocol type from the ARP table, and completes the encapsulation operation.

[0045] b. Decryption process

[0046] S31. After receiving encrypted data, the dual-machine hot standby thread of the system management module decrypts the data, verifies and judges the header information, and does not process messages that do not meet the format requirements.

[0047] S32. Send the decapsulated data to the resource management module for decryption.

[0048] S33. The resource management module sends the decrypted plaintext to the system management module for processing via the isolated FPGA.

[0049] At this point, the information exchange process is complete, and the effective time and number of uses of the negotiated key can be set independently. During data synchronization, both parties will perform verification and checks. If data integrity verification fails, the system management module will re-initiate the data synchronization process.

[0050] This invention improves upon the VRRP protocol, increasing the number of standby machines during dual-machine hot standby and enhancing stability and master-slave switching speed through a series of mechanisms. Furthermore, while traditional dual-machine hot standby heartbeat interfaces use plaintext for communication, this invention uses encrypted communication, significantly improving security. This invention provides a more robust and secure solution for dual-machine hot standby on network platforms, enhancing platform stability and disaster recovery capabilities.

[0051] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A dual-machine hot standby method for a network platform based on the VRRP protocol, characterized in that, The method includes: Dual-machine hot standby process: Based on the VRRP protocol, several network platforms are grouped into a VRRP group. The devices in the group are divided into Master devices and Backup devices according to the priority of the network platforms and virtual IPs. During normal operation, only the Master device provides encryption, decryption and forwarding services, while the Backup devices are in standby mode. The Master device and the Backup device detect each other's status through a heartbeat interface. If the status of the Master device is abnormal or no synchronization message is received from the Master device, the highest priority backup device is selected to replace the Master device to perform the work. Key negotiation process: During the information exchange process between the Master device and the Backup device, encrypted communication is used. Each of the Master device and the Backup device starts a dedicated thread to handle the dual-machine hot standby service. During the information exchange process, the devices in the VRRP group negotiate keys with other devices in the group through multicast communication. The negotiated keys are different from each other and are recorded using different sessions. This method protects the information synchronization process between the master and backup devices. in, The workflow for dual-machine hot standby is as follows: S11. When the network platform is powered on, a Master device is elected in the VRRP group. After VRRP is enabled, the device sends VRRP messages via its multicast address and exchanges VRRP information. The device with the higher priority is selected as the Master. S12. The internal and external network units of the Master device send gratuitous ARP packets to notify the virtual MAC address of the devices or hosts in the internal and external network domains connected to it, and undertake the tasks of packet forwarding and encryption / decryption. S13. The Master device periodically sends VRRP notification messages to all Backup devices in the group. If the Master device fails and the Backup device does not receive the notification message from the Master device within 3 seconds, after a short preemption delay, the Backup device with the higher priority is selected as the Master device. S14. The internal and external network units of the new Master device will immediately send gratuitous ARP packets containing VRRP packets with the virtual IP address and virtual MAC address of the device to refresh the MAC table entries in the devices and host devices connected to the VRRP group, thereby directing user traffic to the new Master device. The whole process is completely transparent to the user. S15. When the original Master device recovers from a failure, if the original Master device is owned by the IP address owner, restore it to the Master device. If its priority is less than 255, switch it to the Backup device and restore its priority to the previous priority of 255.

2. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 1, characterized in that, The network platform is deployed at the connection point between the internal and external network domains.

3. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 1, characterized in that, Key negotiation includes: key negotiation between the Master device and the Backup device, and key negotiation between Backup devices.

4. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 1, characterized in that, The Masters device is responsible for ARP responses and providing service functions, and by default, it notifies other Backup devices of the current host status information every 1 second. The Backup device is the backup network platform for the Masters device and does not provide service functions under normal circumstances. When the Masters device fails, the highest priority Backup device becomes the new Master device and takes over the service functions of the master device, thereby ensuring uninterrupted service.

5. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 1, characterized in that, The default priority of devices in a VRRP group is 100, with a value range of 0 to 255. Priority 0 is reserved by the system, while 255 is reserved for the IP address owner, who has the highest priority. During operation, the device first negotiates the key through the heartbeat interface and exchanges the priorities of each device. The device with the higher priority is elected as the Master device. If the priorities are the same, the IP address of the interface is compared, and the device with the larger IP address becomes the Master device. Other network platforms in the backup group become Backup devices.

6. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 1, characterized in that, The key negotiation process is conducted by multicasting information from the Master device. Multicast key negotiation messages are sent in a loop, and negotiation is carried out according to the order of response time until negotiation is completed with all Backup devices in the VRRP group.

7. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 6, characterized in that, The network platform includes: a system management module, a resource management module, and an isolated FPGA; Assuming the IP address of network platform 1 is set to 192.168.0.100 and the IP address of network platform 2 is set to 192.168.0.200, after both devices are powered on, network platforms 1 and 2 respectively issue negotiation strategies for dual-machine hot standby data synchronization keys to their own resource management modules; the strategy content includes the source and destination IP addresses for outbound and inbound modes, encryption protocols, transmission methods, and negotiated and encapsulated IP addresses; The Master host initiates a key negotiation command, which is sent to the resource management module through the system management module. The key negotiation process is then carried out by the resource management module after passing through the isolated FPGA. When the data packet generated by the resource management module arrives at the system management module after passing through the isolated FPGA, the data is encapsulated and a checksum is calculated. After encapsulation, it is sent to the other end. During the negotiation process, both communicating parties will verify the integrity of the data. If the verification fails, the negotiation will be rejected, the data will be discarded, and the negotiation will be re-initiated. After key negotiation, the synchronous data exchange in dual-machine hot standby is in encrypted form, and the exchange content includes heartbeat information, policy information and system configuration.

8. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 7, characterized in that, The data encryption process includes: S21. The system management module sends the plaintext data to be synchronized during the dual-machine hot standby process to the resource management module through the isolated FPGA. S22. The resource management module encrypts the data according to the negotiated key and sends the data to the system management module through the isolated FPGA; S23. The system management module encapsulates the ciphertext, adds an IP header, performs NAT traversal format encapsulation, calculates the checksum, adds an ether header, adds the local and peer MAC addresses and protocol type through the ARP table, and completes the encapsulation operation.

9. The dual-machine hot standby method for a network platform based on the VRRP protocol as described in claim 7, characterized in that, The data decryption process includes: S31. After receiving encrypted data, the dual-machine hot standby thread of the system management module decrypts the data, verifies and judges the header information, and does not process messages whose format does not meet the requirements. S32. Send the decapsulated data to the resource management module for decryption; S33. The resource management module sends the decrypted plaintext to the system management module for processing via the isolated FPGA.

Images