A method of determining a master gateway in a gateway group

Abstract

The application discloses a method for determining a master gateway in a gateway group, the gateway group comprising n gateway devices, the gateway group serving m subnets, wherein n>m, the method comprising: determining first to m master gateways respectively serving the m subnets from the gateway group; configuring the first to m master gateways with first to m virtual gateway addresses VIP1 to VIPm; the remaining (n-m) gateway devices in the gateway group listening to the m master gateways, when a communication fault of an s-th master gateway is detected, determining a gateway device from the remaining (n-m) gateway devices as a new s-th master gateway; the new s-th master gateway acquiring an s-th virtual gateway address VIPs configured on the original s-th master gateway and taking over all services of the original s-th master gateway.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a method for determining the master gateway in a gateway group. Background Technology

[0002] In the field of network security communications, gateway devices are critical nodes connecting multiple endpoints for data interaction within a network, and their high availability is paramount. A gateway device failure can disrupt the connection between the entire local area network (LAN) and external networks, severely impacting the continuity and stability of business operations.

[0003] Currently, hot backup solutions for critical business systems are relatively mature. For example, at the database application layer, primary / backup switching can be achieved through the database's own data synchronization and failover functions; at the file or configuration level, real-time data mirroring can be achieved through triggered real-time synchronization mechanisms (rsync combined with inotify). However, at the network layer, traditional network services such as IPsec VPN (Internet Protocol Secure Virtual Private Network) typically rely on the IPsec module integrated into the operating system kernel. Leveraging its mature ecosystem, kernel-level session synchronization mechanisms are used to synchronize state information between primary and backup devices, thus ensuring high availability to a certain extent. Furthermore, existing network synchronization solutions often adopt a one-primary-one-backup deployment model. When the primary device is functioning correctly, the backup device may remain idle for extended periods, resulting in a lack of device utilization.

[0004] However, the aforementioned traditional hot standby solutions have significant limitations. On the one hand, solutions based on file synchronization or application layer configuration often focus on data recovery rather than real-time, lossless service switching of network sessions. During fault recovery, established network connections may be interrupted and need to be re-established. On the other hand, solutions relying on kernel modules for state synchronization (such as traditional IPsec VPNs) are highly specific, their implementation heavily dependent on the specific operating system kernel characteristics and inherent mechanisms of the network protocol stack, lacking universality.

[0005] With the development of network security technology, the functions and security mechanisms of gateway devices are becoming increasingly complex. In actual deployments, the core business programs and security logic of these new gateway devices run more in the user space of the operating system than in the kernel space. This makes it difficult to directly reuse or port existing hot standby synchronization mechanisms based on kernel-space modules. How to achieve efficient, stable, and seamless hot backup functionality on user-space gateway programs, while simultaneously improving the utilization rate of backup devices, has become a new technical challenge for those skilled in the art. Summary of the Invention

[0006] Purpose of the invention: This application provides a method for determining the primary gateway in a gateway group to solve the problems mentioned in the background art.

[0007] Technical Solution: This application proposes a method for determining a primary gateway in a gateway group, wherein the gateway group includes n gateway devices and serves m subnets, where n>m, and the method includes:

[0008] From the gateway group, determine the first to the m-th main gateways that serve the m subnets respectively;

[0009] Configure the first virtual gateway address VIP1 to the m-th virtual gateway address VIPm for the first main gateway to the m-th main gateway;

[0010] The remaining (nm) gateway devices in the gateway group monitor m main gateways. When a communication failure is detected in the s-th main gateway, a gateway device is selected from the remaining (nm) gateway devices as the new s-th main gateway.

[0011] The new s-th main gateway obtains the s-th virtual gateway address (VIPs) configured on the original s-th main gateway and takes over all services of the original s-th main gateway.

[0012] Furthermore, each of the n gateway devices is configured with a priority, and determining the first to the m-th main gateways serving the m subnets from the gateway group includes:

[0013] The n gateway devices are sorted according to priority, and the gateway devices ranked from the 1st to the mth position are extracted and a one-to-one service relationship is established with the m subnets.

[0014] Further, determining the first to the m-th main gateways serving the m subnets from the gateway group includes:

[0015] From the n gateway devices, at least two gateway devices serving the first subnet are determined, and a first main gateway is determined from the at least two gateway devices serving the first subnet. Other gateway devices that are not determined to be the first main gateway are released.

[0016] From the n-1 gateway devices that have been removed from the first main gateway, determine at least 2 gateway devices that serve the second subnet, determine the second main gateway from the at least 2 gateway devices that serve the second subnet, and release the other gateway devices that have not been determined as the second main gateway.

[0017] This process continues until the m-th main gateway is determined.

[0018] Further, determining at least two gateway devices serving the first subnet from the n gateway devices includes:

[0019] Based on the first geographical location of the first subnet, at least two gateway devices closest to the first geographical location are identified as gateway devices serving the first subnet; or, at least two devices with the fastest operating speed at this time are identified as gateway devices serving the first subnet.

[0020] Furthermore, each of the n gateway devices is configured with a priority, and determining the first primary gateway from at least two gateway devices serving the first subnet includes:

[0021] Assign at least two gateway devices serving the first subnet to the first virtual gateway group;

[0022] Each gateway device in the first virtual gateway group broadcasts its own priority to other gateway devices;

[0023] When the first device in the first virtual gateway group determines that its own priority a1 is higher than the priority of all other devices based on the received broadcast, it determines itself as the first main gateway.

[0024] When a second device in the virtual group determines, based on the received broadcast, that its own priority a2 is at least lower than the priority broadcast by one of the devices, it determines that it is not the first primary gateway.

[0025] Furthermore, the remaining (nm) gateway devices in the gateway group monitor m main gateways, including:

[0026] The main gateway sends heartbeat packets to the remaining (nm) gateway devices every preset first time interval;

[0027] If any of the remaining (nm) gateway devices receives the heartbeat packet within the waiting time, the waiting time is reset;

[0028] If none of the remaining (nm) gateway devices receive the heartbeat packet within the waiting time, it is determined that the main gateway that sent the heartbeat packet has experienced a communication failure.

[0029] Wherein, the first time interval is less than the waiting time.

[0030] Further, determining a gateway device from the remaining (nm) gateway devices as the new s-th main gateway includes: determining the gateway device with the highest priority among the remaining (nm) gateway devices as the new s-th main gateway.

[0031] Furthermore, the process by which the new s-th primary gateway obtains the s-th virtual gateway address (VIPs) configured on the original s-th primary gateway includes:

[0032] (a1) The new s-th main gateway configures the original s-th main gateway's virtual gateway address VIPs on its second network card eth2;

[0033] (a2) The new s-th primary gateway triggers the broadcast of ARP messages within the s-th subnet.

[0034] Furthermore, the takeover of all services of the original s-th main gateway includes: all terminals within the s-th subnet updating the device information of the new s-th main gateway corresponding to VIPs locally according to the broadcast received in (a2).

[0035] Furthermore, the method also includes: constructing a gateway group based on the deployment location of the gateway devices.

[0036] Beneficial effects:

[0037] This application extends the traditional one-to-one deployment of primary and backup devices to a group containing multiple gateway devices. By prioritizing the primary gateway serving each subnet, the remaining gateways in the group serve as slave gateway devices for each primary gateway device. This avoids the redundant deployment method of one-to-one. A slave gateway device can simultaneously serve as a backup for several primary gateway devices. This allows for monitoring of the primary gateway devices of each subnet with fewer slave gateway devices and ensures that in the event of a communication failure in the primary gateway device, the virtual gateway address (VIP) drift and gratuitous ARP announcement mechanism can be used to quickly replace the primary gateway device.

[0038] The proposed solution does not rely on the specific IPsec module or session synchronization mechanism of the operating system kernel. It effectively solves the problem that traditional kernel-mode hot standby solutions cannot be reused under new network security architectures (such as global quantum security) because network element programs run in user mode. The new master network element device can directly take over the communication needs of the original master network element device and directly perform service-level device switching, which greatly expands the application scope of high availability technology. Without modifying the kernel source code, it ensures the high reliability, high stability and high availability of the entire switching mechanism. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram illustrating the method for determining the main gateway device for each subnet in this application.

[0041] Figure 2 This is a flowchart illustrating the method described in this application;

[0042] Figure 3 This is a schematic diagram of Method 2 for determining the main gateway device for the first subnet in this application.

[0043] Figure 4 This is a schematic diagram illustrating the monitoring method used in this application;

[0044] Figure 5 A schematic diagram illustrating the construction of a gateway group for this application. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] In view of the problems mentioned in the background art, in the embodiments of the present invention, such as Figure 1 As shown, the gateway group includes n gateway devices, which serve m subnets, each containing multiple terminals. Here, n > m, to ensure that each subnet can be assigned a primary gateway device to provide communication services for the terminals within that subnet. In addition to the assigned primary gateway devices, other redundant gateway devices are reserved as backups.

[0047] like Figure 2 As shown, the present invention provides a method for determining the primary gateway in a gateway group, comprising:

[0048] From the gateway group, determine the first to the mth main gateways that serve the m subnets respectively.

[0049] In this embodiment, the m main gateways can be determined using one of the following two methods.

[0050] Method 1:

[0051] Each of the n gateway devices in the gateway group can have its priority configured in advance. For example, the priority of the first gateway device in the gateway group is configured as a1, the priority of the second gateway device is configured as a2, ..., and the priority of the nth gateway device is configured as an.

[0052] Sort the n gateways according to their priority from high to low, and extract the gateway devices with priorities from the 1st to the mth position. Figure 1 As shown, the m gateway devices constitute the main gateway subgroup, and the remaining (nm) gateway devices constitute the slave gateway subgroup. Then, a one-to-one service relationship is established between the m gateway devices in the main gateway subgroup and the m subnets.

[0053] Specifically, for example, a first gateway device included in the main gateway subgroup can be associated with a first subnet LAN1, and the first gateway device can provide network communication services to multiple terminals in the first subnet LAN1. This first gateway device can be referred to as the first main gateway. And so on, until the m-th gateway device included in the main gateway subgroup is associated with the m-th subnet LANm, and the m-th gateway device is referred to as the m-th main gateway.

[0054] Method 2:

[0055] like Figure 3 As shown, at least two gateway devices serving the first subnet are determined from among the n gateway devices in the gateway group.

[0056] Here, the method for determining at least two gateway devices may include: determining the at least two gateway devices closest to the first geographical location of the first subnet as gateway devices serving the first subnet; or determining the at least two devices with the fastest operating speed at that time as gateway devices serving the first subnet. For example, the first gateway device, the second gateway device, ..., the qth gateway device may be determined as gateway devices serving the first subnet, where q ≥ 2. Then, the first primary gateway is determined from the at least two gateway devices serving the first subnet, and the other gateway devices not determined as the first primary gateway are released.

[0057] Similar to Method 1, each gateway device in the gateway group can be pre-configured with a priority. The process of determining the first primary gateway among at least two gateway devices serving the first subnet may include:

[0058] The aforementioned first gateway device, second gateway device, ..., qth gateway device are classified into the first virtual gateway group.

[0059] In this group, the priorities of each gateway device are synchronized with other gateway devices within the group using a broadcast method. Specifically, each gateway device in the first virtual gateway group broadcasts its own priority to other gateway devices. For example, if the first gateway device has a priority of a1, it broadcasts its priority a1 to all other gateway devices in the first virtual gateway group, and at the same time, it also receives its own priority from all other gateway devices via broadcast.

[0060] When a first gateway device in the first virtual gateway group determines, based on the received broadcast, that its own priority a1 is higher than the priorities of all other gateway devices, it determines itself as the first primary gateway. For example, if a first gateway device determines that its own priority a1 is higher than the priorities of all other gateway devices, it determines itself as the gateway device with the highest priority in the first virtual gateway group, and thus determines itself as the first primary gateway serving the first subnet.

[0061] When a second gateway device in the virtual group determines, based on received broadcasts, that its own priority a2 is lower than the priority broadcast by at least one of the devices, it determines that it is not the first primary gateway. For example, if a second gateway device receives a priority a1 broadcast by the first gateway device and finds that a1 is higher than its own a2, then the second gateway device does not need to receive any subsequent priority broadcasts from other gateway devices or compare priorities with other gateway devices; it directly determines itself as a non-first primary gateway, i.e., a secondary gateway device in the first virtual gateway group.

[0062] Once the first primary gateway is determined, the first virtual gateway group can be disbanded, releasing the other gateways besides the first primary gateway, which in this embodiment are the second gateway device to the qth gateway device.

[0063] Then, repeat the above steps, except that the initial group of gateway devices is updated to include all gateway devices except the first primary gateway. That is, from the (n-1) gateway devices that exclude the first primary gateway, determine at least two gateway devices serving the second subnet; from these at least two gateway devices serving the second subnet, determine the second primary gateway; and release the other gateway devices that are not determined to be the second primary gateway; and so on, until the m-th primary gateway is determined.

[0064] Using Method 2 allows for full consideration of the service distance of gateway devices in actual deployment, rather than relying solely on device priority. In other words, among other gateway devices not assigned to the first virtual gateway group, there can be gateway devices with a higher priority (a1) than the first primary gateway.

[0065] Next, configure the first virtual gateway address (VIP1) to the m-th virtual gateway address (VIPm) for the previously determined first main gateway to the m-th main gateway. Taking the first main gateway as an example, configuring the first virtual gateway address VIP1 here can be done by binding the first virtual gateway address VIP1 to its own first network interface card eth1. Here, the virtual gateway address VIP1 is a communication address recognized and capable of communication by terminals in the first subnet LAN1. Terminals can include user terminal devices, service provider server devices, etc.

[0066] Currently, the n gateway devices in the gateway group have been divided into a main gateway subgroup consisting of m main gateways and a slave gateway subgroup consisting of (nm) slave gateways. While the m main gateways are providing normal communication services, the (nm) gateway devices in the slave gateway subgroup are monitoring the m main gateways. When a communication failure is detected in the s-th main gateway, a gateway device from the (nm) gateway devices in this group is selected as the new s-th main gateway.

[0067] Among these, monitoring can be performed using a heartbeat mechanism. Therefore, the remaining (nm) gateway devices in the gateway group monitor m main gateways, including:

[0068] The main gateway sends a heartbeat packet to each of the (nm) gateway devices in the subgroup of the secondary gateways at a preset first time interval; when the remaining (nm) gateway devices receive the heartbeat packet, the preset waiting time is reset; if the remaining (nm) gateway devices do not receive the heartbeat packet within the waiting time, it is determined that the main gateway that sent the heartbeat packet has a communication failure; wherein, the first time interval is less than the waiting time.

[0069] For example, such as Figure 4 As shown, the s-th master gateway sends heartbeat packets to (nm) slave gateway devices in the slave gateway subgroup every preset first time interval (e.g., 1 second). When any slave gateway receives a heartbeat packet, it resets its own waiting time (e.g., 10 seconds). The first time interval is less than the waiting time. This waiting time is the longest waiting time that the slave gateway allows the s-th master gateway to monitor for heartbeat packet timeouts. If all slave gateways fail to receive a heartbeat packet from the s-th master gateway within this waiting time, it is determined that the s-th master gateway is experiencing a communication failure, and a new s-th master gateway needs to be determined from the (nm) slave gateway devices to replace the failed original s-th master gateway.

[0070] In this embodiment, n can also satisfy n≤2m. Under such quantity constraints, a small number of slave gateway devices can monitor a large number of master gateway devices with less than a one-to-one redundant deployment, thereby reducing the idle rate of slave gateway devices.

[0071] In response to the fact that all gateway devices in the gateway group are configured with priorities, a gateway device can be determined from (nm) gateway devices in the gateway subgroup as the new s-th master gateway, including: determining the gateway device with the highest priority among the remaining (nm) gateway devices as the new s-th master gateway.

[0072] The new s-th main gateway obtains the s-th virtual gateway address (VIPs) configured on the original s-th main gateway and takes over all services of the original s-th main gateway.

[0073] Specifically, including:

[0074] (a1) The new s-th main gateway configures the original s-th main gateway's virtual gateway address VIPs on its second network card eth2; after the configuration is completed, the transfer of the virtual gateway address VIPs from the original s-th main gateway to the current s-th main gateway is completed.

[0075] (a2) The new s-th primary gateway triggers the broadcast of an ARP (Gratuitous Address Resolution Protocol) message within the s-th subnet. This ARP message is sent proactively by the s-th primary gateway system to clarify the identity information of the primary gateway device corresponding to the virtual gateway address VIPs (e.g., the MAC address of the current s-th primary gateway).

[0076] Furthermore, all terminals within the s-th subnet update the device information of the new s-th main gateway corresponding to the VIPs locally based on the broadcast received in (a2).

[0077] Upon receiving the packet, each terminal device within the corresponding s-th subnet updates its local ARP cache table. This ARP cache table records the mapping between the virtual gateway address (VIP) and its MAC address. The original mapping between the virtual gateway address (VIP) and the MAC address of the original s-th primary gateway is updated to a new mapping between the virtual gateway address (VIP) and the current s-th primary gateway's MAC address. Based on this update, subsequent data sent by terminal devices within subnets (LANs) using the virtual gateway address (VIP) will be forwarded to the current s-th primary gateway according to the new mapping.

[0078] In this embodiment, since the deployment of real-world gateway devices may not strictly follow the planned schedule, to improve the practicality of this application, the method further includes, in actual deployment scenarios, constructing a gateway group based on the deployment location of the gateways. For example, as... Figure 5 As shown, this solution needs to be applied to the first to fifth subnets. Based on the deployment locations of the first to fifth subnets and the deployment locations of nearby gateway devices, the x gateway devices closest to the first to fifth subnets can be constructed into a gateway group, where x>5. In this constructed gateway group, the main gateway serving each subnet is determined.

[0079] In summary, the proposed solution allows for a smooth and seamless data traffic switchover to the new primary gateway device when the primary device fails, even with a small number of secondary gateway devices deployed. This is achieved through virtual gateway address (VIP) migration, unlike data backup. The solution enables direct device switching at the service level. It completely avoids dependence on operating system kernel modules and is suitable for user-mode network element programs. Furthermore, the switching process requires no manual intervention and is transparent to terminal devices within the subnet LAN, ensuring business continuity.

Claims

1. A method for determining a primary gateway in a gateway group, characterized in that, The gateway group comprises n gateway devices, and the gateway group serves m subnets, where n > m. The method includes: From the gateway group, determine the first to the m-th main gateways that serve the m subnets respectively; Configure the first virtual gateway address VIP1 to the m-th virtual gateway address VIPm for the first main gateway to the m-th main gateway; The remaining (nm) gateway devices in the gateway group monitor m main gateways. When a communication failure is detected in the s-th main gateway, a gateway device is selected from the remaining (nm) gateway devices as the new s-th main gateway. The new s-th main gateway obtains the s-th virtual gateway address (VIPs) configured on the original s-th main gateway and takes over all services of the original s-th main gateway.

2. The method according to claim 1, characterized in that, Each of the n gateway devices is configured with a priority, and determining the first to the m-th main gateways serving the m subnets from the gateway group includes: The n gateway devices are sorted according to priority, and the gateway devices ranked from the 1st to the mth position are extracted and a one-to-one service relationship is established with the m subnets.

3. The method according to claim 1, characterized in that, The step of determining the first to the m-th main gateways serving the m subnets from the gateway group includes: From the n gateway devices, at least two gateway devices serving the first subnet are determined, a first main gateway is determined from the at least two gateway devices serving the first subnet, and other gateway devices not determined as the first main gateway are released; From the n-1 gateway devices that have been removed from the first main gateway, at least two gateway devices serving the second subnet are identified, and the second main gateway is identified from the at least two gateway devices serving the second subnet. Other gateway devices that have not been identified as the second main gateway are released. This process continues until the m-th main gateway is determined.

4. The method according to claim 3, characterized in that, The step of determining at least two gateway devices serving the first subnet from the n gateway devices includes: Based on the first geographical location of the first subnet, at least two gateway devices closest to the first geographical location are identified as gateway devices serving the first subnet; or, at least two devices with the fastest operating speed at this time are identified as gateway devices serving the first subnet.

5. The method according to claim 4, characterized in that, Each of the n gateway devices is configured with a priority, and the determination of the first primary gateway among the at least two gateway devices serving the first subnet includes: Assign at least two gateway devices serving the first subnet to the first virtual gateway group; Each gateway device in the first virtual gateway group broadcasts its own priority to other gateway devices; When the first device in the first virtual gateway group determines that its own priority a1 is higher than the priority of all other devices based on the received broadcast, it determines itself as the first main gateway. When a second device in the virtual group determines, based on the received broadcast, that its own priority a2 is at least lower than the priority broadcast by one of the devices, it determines that it is not the first primary gateway.

6. The method according to any one of claims 1 to 5, characterized in that, The remaining (nm) gateway devices in the gateway group monitor m main gateways, including: The main gateway sends heartbeat packets to the remaining (nm) gateway devices every preset first time interval; If any of the remaining (nm) gateway devices receives the heartbeat packet within the waiting time, the waiting time is reset; If none of the remaining (nm) gateway devices receive the heartbeat packet within the waiting time, it is determined that the main gateway that sent the heartbeat packet has experienced a communication failure. Wherein, the first time interval is less than the waiting time.

7. The method according to claim 2 or 5, characterized in that, The step of determining one gateway device from the remaining (nm) gateway devices as the new s-th main gateway includes: The gateway device with the highest priority among the remaining (nm) gateway devices is determined as the new s-th master gateway.

8. The method according to claim 6, characterized in that, The acquisition of the s-th virtual gateway address (VIPs) configured on the original s-th main gateway by the new s-th main gateway includes: (a1) The new s-th main gateway configures the original s-th main gateway's virtual gateway address VIPs on its second network card eth2; (a2) The new s-th primary gateway triggers the broadcast of ARP messages within the s-th subnet.

9. The method according to claim 8, characterized in that, The takeover of all services of the original s-th main gateway includes: All terminals within the s-th subnet update the device information of the new s-th main gateway corresponding to VIPs locally based on the broadcast received in (a2).

10. The method according to claim 1, characterized in that, The method further includes: Based on the deployment location of the gateway devices, construct a gateway group.

Images