Session backup method and device and related equipment

Abstract

The invention relates to the technical field of network communication, in particular to a session backup method and device and related equipment. The method is applied to a main firewall, and a UDP channel is established between the main firewall and a standby firewall. The method comprises the steps that after a corresponding session is established based on a received SYN message, a new session is backed up to a standby firewall through a UDP channel, and after the standby firewall successfully recovers the new session, a response used for representing successful backup of the new session is sent to a main firewall; based on a preset first period, whether a specified field of a session table item corresponding to the new session is set as a specified value used for identifying that the new session is successfully backed up on the standby firewall or not is judged, and after the main firewall receives the response, the specified field in the session table item corresponding to the new session is set as the specified value; and if it is judged that the specified field of the session table item corresponding to the new session is set as the specified value, determining that the new session is backed up successfully.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a session backup method, apparatus and related equipment. Background Technology

[0002] With the advent of the Internet of Things and the "cloud" era, the capabilities of network security devices have also improved, and the demand for the reliability of HA (High Availability) dual-machine clusters has increased.

[0003] Currently, sessions generated by the primary firewall are backed up to the backup firewall via TCP (Transmission Control Protocol) to ensure that when the primary firewall or its links fail, the backup firewall takes over and continues to operate, ensuring uninterrupted service.

[0004] However, backing up sessions via TCP protocol messages generates a large number of protocol acknowledgment messages, consuming bandwidth in the HA backup channel. Furthermore, both machines need to maintain a TCP connection, and disconnections will affect session backups. Summary of the Invention

[0005] This application provides a session backup method, apparatus, and related equipment.

[0006] Firstly, this application provides a session backup method applied to a primary firewall, wherein a UDP channel is established between the primary firewall and a backup firewall; the method includes: After establishing a corresponding session based on the received SYN packet, the newly established session is backed up to the backup firewall through the UDP channel. After the backup firewall successfully restores the newly established session, it sends a first response to the primary firewall to indicate that the backup of the newly established session was successful. Based on a preset first cycle, it is determined whether the first specified field of the session table entry corresponding to the newly created session is set to a first specified value used to identify that the newly created session has been successfully backed up on the backup firewall. The primary firewall sets the first specified field in the session table entry corresponding to the newly created session to the first specified value after receiving the first response. If it is determined that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then it is determined that the newly created session was successfully backed up on the backup firewall.

[0007] Preferably, the method further includes: If it is determined that the first specified field of the session table entry corresponding to the newly created session is not set to the first specified value, then the step of backing up the newly created session to the backup firewall through the UDP channel is repeated. The number of repeated executions is accumulated. If it is determined that the number of repeated executions has reached the first preset value, and it is still determined that the first specified field of the session table entry corresponding to the newly created session has not been set to the first specified value, then the process ends.

[0008] Preferably, the method further includes: When it is determined that a session needs to be deleted, the session deletion information corresponding to the session is sent to the backup firewall through the UDP channel. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. Based on a preset second cycle, it is determined whether the second specified field of the session table entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall. The main firewall, after receiving the second response, sets the first specified field in the session table entry corresponding to the session to the second specified value. If it is determined that the second specified field of the session table entry corresponding to the session is set to the second specified value, then it is determined that the session was successfully deleted on the backup firewall.

[0009] Preferably, the method further includes: If it is determined that the second specified field of the session table entry corresponding to the session is not set to the second specified value, then it is determined that the session was not successfully deleted on the backup firewall, and the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel is repeated. The number of repeated executions is accumulated. If it is determined that the number of repeated executions has reached the second preset value, and it is still determined that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

[0010] Preferably, the session deletion information corresponding to a session includes at least the five-tuple information of that session.

[0011] Secondly, this application provides a session backup device applied to a primary firewall, wherein a UDP channel is established between the primary firewall and a backup firewall; the device includes: The backup unit is used to establish a corresponding session based on the received SYN packet, and then back up the newly established session to the backup firewall through the UDP channel. After the backup firewall successfully restores the newly established session, it sends a first response to the primary firewall to indicate that the backup of the newly established session was successful. The judgment unit is used to determine, based on a preset first period, whether the first specified field of the session table entry corresponding to the new session is set to a first specified value used to indicate that the new session has been successfully backed up on the backup firewall, wherein, after receiving the first response, the main firewall sets the first specified field in the session table entry corresponding to the new session to the first specified value. If the determining unit determines that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then the determining unit is used to determine that the newly created session has been successfully backed up on the backup firewall.

[0012] Preferably, the device further includes an accumulation unit: If the determination unit determines that the first specified field of the session table entry corresponding to the new session is not set to the first specified value, the backup unit is further configured to repeatedly execute the step of backing up the new session to the backup firewall through the UDP channel. The accumulation unit is used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached a first preset value, and the judgment unit still determines that the first specified field of the session table entry corresponding to the new session has not been set to the first specified value, then the process ends.

[0013] Preferably, the device further includes: The deletion unit is used to send the session deletion information corresponding to the session to the backup firewall through the UDP channel when it is determined that a session needs to be deleted. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. The judgment unit is further configured to determine, based on a preset second period, whether the second specified field of the session entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall, wherein, after receiving the second response, the primary firewall sets the first specified field in the session entry corresponding to the session to the second specified value. If the judgment unit determines that the second specified field of the session table entry corresponding to the session is set to the second specified value, then the determination unit is used to determine that the session was successfully deleted on the backup firewall.

[0014] Preferably, if the determination determines that the second specified field of the session table entry corresponding to the session is not set to the second specified value, the deletion unit is further configured to repeatedly execute the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel; The accumulation unit is also used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached the second preset value, and the judgment unit still determines that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

[0015] Preferably, the session deletion information corresponding to a session includes at least the five-tuple information of that session.

[0016] Thirdly, embodiments of this application provide a session backup device, which includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.

[0017] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of the method as described in any of the first aspects above.

[0018] In summary, the session backup method provided in this application is applied to a primary firewall, and a UDP channel is established between the primary firewall and a backup firewall. The method includes: establishing a corresponding session based on a received SYN packet, and backing up the new session to the backup firewall through the UDP channel. After successfully restoring the new session, the backup firewall sends a first response to the primary firewall to indicate that the backup of the new session was successful. Based on a preset first period, it is determined whether a first specified field of the session table entry corresponding to the new session is set to a first specified value used to identify that the new session was successfully backed up on the backup firewall. After receiving the first response, the primary firewall sets the first specified field in the session table entry corresponding to the new session to the first specified value. If it is determined that the first specified field of the session table entry corresponding to the new session is set to the first specified value, then the backup of the new session on the backup firewall is confirmed to be successful.

[0019] The session backup method provided in this application establishes a UDP channel between the primary firewall and the backup firewall. The backup session is backed up via the UDP protocol. This method avoids the interaction of a large number of protocol messages, which can greatly reduce the bandwidth overhead of the HA backup channel, improve the bandwidth utilization of the HA backup channel, and enhance the performance of the backup session. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0021] Figure 1 A detailed flowchart of a session backup method provided in this application embodiment; Figure 2 A schematic diagram of a session entry format provided in an embodiment of this application; Figure 3 A schematic diagram illustrating a session backup process provided in this application embodiment; Figure 4 This is a schematic diagram of the structure of a session backup device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the hardware architecture of a session backup device provided in an embodiment of this application. Detailed Implementation

[0022] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0023] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0024] For example, see Figure 1 The diagram shown is a detailed flowchart of a session backup method provided in an embodiment of this application. This method is applied to a primary firewall, and a UDP channel is established between the primary firewall and a backup firewall. The method includes the following steps: Step 100: After establishing the corresponding session based on the received SYN packet, back up the newly established session to the backup firewall through the UDP channel.

[0025] After successfully restoring the newly created session, the backup firewall sends a first response to the primary firewall to indicate that the backup of the newly created session was successful.

[0026] In practical applications, operators use devices as network boundary security protection (firewall) equipment to connect the company's internal network and the Internet. To improve service stability, two devices are used in a high-availability (HA) dual-machine network, with Device A as the primary device (primary firewall) and Device B as the backup device (backup firewall). When Device A or its links fail, Device B takes over from Device A to continue working, ensuring uninterrupted service.

[0027] In this embodiment, a UDP (User Datagram Protocol) channel is pre-established between the primary firewall and the backup firewall. After receiving a TCP:SYN packet from the client, if the primary firewall determines that a session corresponding to the TCP:SYN packet does not exist locally, it will create a new session (the corresponding session entry in the session table). For example, see [link to example documentation]. Figure 2 The diagram shown is a schematic representation of a session entry format provided in an embodiment of this application.

[0028] In this embodiment of the application, in addition to conventional information such as 5-tuples, the session table entry also includes fields for retransmission counting, fields for indicating whether the session was successfully backed up on the backup firewall, and fields for indicating whether the session was successfully deleted on the backup firewall.

[0029] After establishing a new session, the primary firewall needs to back up the new session to the backup firewall. Specifically, the primary firewall packages the session and sends it to the backup firewall based on the UDP channel established with the backup firewall. Upon receiving the session, the backup firewall restores the session based on the session information (i.e., creates the session).

[0030] After confirming that the new session backup is successful, the backup firewall will send a first response to the primary firewall to indicate that the backup of the new session was successful.

[0031] Step 110: Based on the preset first cycle, determine whether the first specified field of the session table entry corresponding to the newly created session is set to the first specified value used to identify that the newly created session has been successfully backed up on the backup firewall.

[0032] Upon receiving the first response, the main firewall sets the first specified field in the session table entry corresponding to the newly created session to the first specified value.

[0033] In this embodiment of the application, after receiving the response from the backup firewall indicating that the new session backup was successful, the primary firewall marks the corresponding session table entry with a confirmation flag indicating that the new session backup was successful.

[0034] Step 120: If it is determined that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then it is determined that the newly created session has been successfully backed up on the backup firewall.

[0035] In this embodiment of the application, if it is determined that the first specified field of the session table entry corresponding to the newly created session is not set to the first specified value, the step of backing up the newly created session to the backup firewall through the UDP channel is repeated; the number of repeated executions is accumulated, and if it is determined that the number of repeated executions reaches a first preset value, and it is still determined that the first specified field of the session table entry corresponding to the newly created session is not set to the first specified value, the process ends.

[0036] In other words, the primary firewall periodically checks whether the session table entry corresponding to the newly created session has a confirmation flag indicating that the backup of the newly created session was successful. If it is determined that the flag has been set, the backup of the newly created session on the backup firewall is successful, and the process ends. If it is determined that the confirmation flag has not been set, the backup operation of the newly created session to the backup firewall is repeated, and the number of repetitions is recorded until the session table entry corresponding to the newly created session has a confirmation flag indicating that the backup of the newly created session was successful, or until the number of repetitions reaches a preset value and the session table entry corresponding to the newly created session still does not have a confirmation flag indicating that the backup of the newly created session was successful, the process ends and backup is no longer performed.

[0037] Furthermore, in this embodiment of the application, the above-mentioned session backup method may further include the following steps: When it is determined that a session needs to be deleted, the session deletion information corresponding to the session is sent to the backup firewall through the UDP channel. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. Based on a preset second cycle, it is determined whether the second specified field of the session table entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall. The main firewall, after receiving the second response, sets the first specified field in the session table entry corresponding to the session to the second specified value. If it is determined that the second specified field of the session table entry corresponding to the session is set to the second specified value, then it is determined that the session was successfully deleted on the backup firewall.

[0038] Furthermore, if it is determined that the second specified field of the session table entry corresponding to the session is not set to the second specified value, then it is determined that the session deletion on the backup firewall was unsuccessful, and the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel is repeated. The number of repeated executions is accumulated. If it is determined that the number of repeated executions has reached the second preset value, and it is still determined that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

[0039] In practical applications, the session deletion information corresponding to a session should include at least the five-tuple information of the session (e.g., source IP, destination IP, source port, destination port, and protocol type).

[0040] The session backup process provided in this application embodiment will be described in detail below with reference to specific application scenarios. For example, see [link to relevant documentation]. Figure 3 The diagram shown is a schematic representation of a session backup process provided in an embodiment of this application.

[0041] Step 1: Send the first packet [TCP:SYN] to the main firewall to establish a new session.

[0042] Step 2: The primary firewall backs up the newly created session to the backup firewall via the UDP channel, and the backup firewall restores the session.

[0043] Step 3: After the backup firewall successfully restores the session, it marks the session message with an acknowledgment and sends a reply to the primary firewall. The primary firewall then locates the corresponding session based on the content of the session message and marks it with an acknowledgment.

[0044] Step 4: The primary firewall checks the newly created session every second to see if it has been marked as successfully backed up. If the session is not marked with a confirmation tag, the session is forwarded to the backup firewall and the number of retransmissions is counted. If no confirmation tag is marked after 5 checks, the backup is stopped.

[0045] Step 5: Subsequent packets [TCP:SYN-ACK] are sent to the main firewall.

[0046] Step 6: Subsequent packets [TCP:ACK] are sent to the main firewall.

[0047] Step 7: When a session on the primary firewall needs to be deleted, a session deletion message is sent to the backup firewall via the UDP channel. Upon receiving the session deletion message, the backup firewall performs the deletion operation.

[0048] Step 8: After the backup firewall successfully deletes the session, it adds an acknowledgment tag to the session deletion message and sends a reply to the primary firewall. The primary firewall then locates the corresponding session based on the content of the session deletion message and adds a deletion acknowledgment tag.

[0049] Step 9: For sessions that need to be deleted, the primary firewall checks every second whether the session has a deletion confirmation tag. If the session does not have a deletion confirmation tag, the deletion message is sent to the backup firewall repeatedly, and the number of retransmissions is counted. If the deletion confirmation tag is not set after three checks, the session deletion message is no longer sent to the backup firewall. If the session has a deletion confirmation tag, the session is considered successfully deleted on the backup firewall. After determining that the session meets preset conditions (e.g., timeout aging), the primary firewall deletes the session locally.

[0050] For example, see Figure 4 The diagram shown is a schematic representation of a session backup device provided in an embodiment of this application. This device is applied to a primary firewall, and a UDP channel is established between the primary firewall and a backup firewall. The device includes: The backup unit is used to establish a corresponding session based on the received SYN packet, and then back up the newly established session to the backup firewall through the UDP channel. After the backup firewall successfully restores the newly established session, it sends a first response to the primary firewall to indicate that the backup of the newly established session was successful. The judgment unit is used to determine, based on a preset first period, whether the first specified field of the session table entry corresponding to the new session is set to a first specified value used to indicate that the new session has been successfully backed up on the backup firewall, wherein, after receiving the first response, the main firewall sets the first specified field in the session table entry corresponding to the new session to the first specified value. If the determining unit determines that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then the determining unit is used to determine that the newly created session has been successfully backed up on the backup firewall.

[0051] Preferably, the device further includes an accumulation unit: If the determination unit determines that the first specified field of the session table entry corresponding to the new session is not set to the first specified value, the backup unit is further configured to repeatedly execute the step of backing up the new session to the backup firewall through the UDP channel. The accumulation unit is used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached a first preset value, and the judgment unit still determines that the first specified field of the session table entry corresponding to the new session has not been set to the first specified value, then the process ends.

[0052] Preferably, the device further includes: The deletion unit is used to send the session deletion information corresponding to the session to the backup firewall through the UDP channel when it is determined that a session needs to be deleted. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. The judgment unit is further configured to determine, based on a preset second period, whether the second specified field of the session entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall, wherein, after receiving the second response, the primary firewall sets the first specified field in the session entry corresponding to the session to the second specified value. If the judgment unit determines that the second specified field of the session table entry corresponding to the session is set to the second specified value, then the determination unit is used to determine that the session was successfully deleted on the backup firewall.

[0053] Preferably, if the determination determines that the second specified field of the session table entry corresponding to the session is not set to the second specified value, the deletion unit is further configured to repeatedly execute the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel; The accumulation unit is also used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached the second preset value, and the judgment unit still determines that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

[0054] Preferably, the session deletion information corresponding to a session includes at least the five-tuple information of that session.

[0055] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0056] Furthermore, regarding the session backup device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the session backup device can be found in [reference needed]. Figure 5 As shown, the session backup device may include: a memory 50 and a processor 51. The memory 50 is used to store program instructions; the processor 51 calls the program instructions stored in the memory 50 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.

[0057] Optionally, this application also provides a main firewall device, including at least one processing element (or chip) for performing the above method embodiments.

[0058] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments.

[0059] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0060] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0061] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0062] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0063] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0064] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A session backup method, characterized in that, Applied to a primary firewall, wherein a UDP channel is established between the primary firewall and a backup firewall; the method includes: After establishing a corresponding session based on the received SYN packet, the newly established session is backed up to the backup firewall through the UDP channel. After the backup firewall successfully restores the newly established session, it sends a first response to the primary firewall to indicate that the backup of the newly established session was successful. Based on a preset first cycle, it is determined whether the first specified field of the session table entry corresponding to the newly created session is set to a first specified value used to identify that the newly created session has been successfully backed up on the backup firewall. The primary firewall sets the first specified field in the session table entry corresponding to the newly created session to the first specified value after receiving the first response. If it is determined that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then it is determined that the newly created session was successfully backed up on the backup firewall.

2. The method as described in claim 1, characterized in that, The method further includes: If it is determined that the first specified field of the session table entry corresponding to the newly created session is not set to the first specified value, then the step of backing up the newly created session to the backup firewall through the UDP channel is repeated. The number of repeated executions is accumulated. If it is determined that the number of repeated executions has reached the first preset value, and it is still determined that the first specified field of the session table entry corresponding to the newly created session has not been set to the first specified value, then the process ends.

3. The method as described in claim 1 or 2, characterized in that, The method further includes: When it is determined that a session needs to be deleted, the session deletion information corresponding to the session is sent to the backup firewall through the UDP channel. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. Based on a preset second cycle, it is determined whether the second specified field of the session table entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall. The main firewall, after receiving the second response, sets the first specified field in the session table entry corresponding to the session to the second specified value. If it is determined that the second specified field of the session table entry corresponding to the session is set to the second specified value, then it is determined that the session was successfully deleted on the backup firewall.

4. The method as described in claim 3, characterized in that, The method further includes: If it is determined that the second specified field of the session table entry corresponding to the session is not set to the second specified value, then it is determined that the session was not successfully deleted on the backup firewall, and the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel is repeated. The number of repeated executions is accumulated. If it is determined that the number of repeated executions has reached the second preset value, and it is still determined that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

5. The method as described in claim 3, characterized in that, The session deletion information corresponding to a session shall include at least the five-tuple information of that session.

6. A session backup device, characterized in that, The device is applied to a primary firewall, wherein a UDP channel is established between the primary firewall and a backup firewall; the device includes: The backup unit is used to establish a corresponding session based on the received SYN packet, and then back up the newly established session to the backup firewall through the UDP channel. After the backup firewall successfully restores the newly established session, it sends a first response to the primary firewall to indicate that the backup of the newly established session was successful. The judgment unit is used to determine, based on a preset first period, whether the first specified field of the session table entry corresponding to the new session is set to a first specified value used to indicate that the new session has been successfully backed up on the backup firewall, wherein, after receiving the first response, the main firewall sets the first specified field in the session table entry corresponding to the new session to the first specified value. If the determining unit determines that the first specified field of the session table entry corresponding to the newly created session is set to the first specified value, then the determining unit is used to determine that the newly created session has been successfully backed up on the backup firewall.

7. The apparatus as claimed in claim 6, characterized in that, The device also includes an accumulation unit: If the determination unit determines that the first specified field of the session table entry corresponding to the new session is not set to the first specified value, the backup unit is further configured to repeatedly execute the step of backing up the new session to the backup firewall through the UDP channel. The accumulation unit is used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached a first preset value, and the judgment unit still determines that the first specified field of the session table entry corresponding to the new session has not been set to the first specified value, then the process ends.

8. The apparatus as claimed in claim 6 or 7, characterized in that, The device further includes: The deletion unit is used to send the session deletion information corresponding to the session to the backup firewall through the UDP channel when it is determined that a session needs to be deleted. After the backup firewall successfully deletes the session, it sends a second response to the primary firewall to indicate that the session deletion was successful. The judgment unit is further configured to determine, based on a preset second period, whether the second specified field of the session entry corresponding to the session is set to a second specified value used to indicate that the session has been successfully deleted on the backup firewall, wherein, after receiving the second response, the primary firewall sets the first specified field in the session entry corresponding to the session to the second specified value. If the judgment unit determines that the second specified field of the session table entry corresponding to the session is set to the second specified value, then the determination unit is used to determine that the session was successfully deleted on the backup firewall.

9. The apparatus as claimed in claim 8, characterized in that, If the determination determines that the second specified field of the session table entry corresponding to the session is not set to the second specified value, the deletion unit is further configured to repeatedly execute the step of sending the session deletion information corresponding to the session to the backup firewall through the UDP channel; The accumulation unit is also used to accumulate the number of repeated executions. If it is determined that the number of repeated executions has reached the second preset value, and the judgment unit still determines that the second specified field of the session table entry corresponding to the session has not been set to the second specified value, then the process ends.

10. A session backup device, characterized in that, The session backup device includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of claims 1-5 according to the obtained program instructions.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing the computer to perform the steps of the method as described in any one of claims 1-5.

Images