CN115134216B - A heterogeneous IPSEC tunnel protection scheduling method, system and medium based on SDWAN - Google Patents

Abstract

The application relates to a method, a system and a medium for protecting and scheduling a heterogeneous IPSEC tunnel by an SDWAN, wherein the method is applied to single-side path protection and comprises the following steps: respectively creating an IPSEC service on the first communication device and the second communication device through the upper management and control platform; the IPSEC service on the first communication equipment is distributed to be a main service role, and the IPSEC service on the second communication equipment is distributed to be a standby service role; monitoring the first communication equipment and the second communication equipment through the upper management control platform, if the main service on the first communication equipment cannot be operated, enabling the standby service on the second communication equipment, and simultaneously disabling the main service.

Description

A heterogeneous IPSEC tunnel protection scheduling method, system and medium based on SDWAN

Technical Field

The present application relates to the field of computer communication technology, and in particular to a heterogeneous IPSEC tunnel protection scheduling method, system and medium based on SDWAN.

Background technique

At present, the protection scheme of IPSEC tunnel is mainly aimed at the protection between different IPSEC tunnels in a single device, that is, the single device itself monitors the connectivity of the configured tunnels, and automatically switches the service to the backup tunnel after the main tunnel is disconnected.

Currently, there is no effective solution to the problem that IPSEC tunnel protection solutions between multiple devices in related technologies lack efficient management.

Summary of the invention

The embodiments of the present application provide a heterogeneous IPSEC tunnel protection scheduling method, system and medium based on SDWAN, so as to at least solve the problem of lack of efficient management of IPSEC tunnel protection solutions between multiple devices in the related art.

In a first aspect, an embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN, the method being applied to unilateral path protection, including:

Creating an IPSEC service on the first communication device and the second communication device respectively through the upper-layer management and control platform;

Allocate the IPSEC service on the first communication device as a primary service role, and allocate the IPSEC service on the second communication device as a backup service role;

The first communication device and the second communication device are monitored by the upper-layer management and control platform. If it is detected that the primary service on the first communication device cannot be operated, the backup service on the second communication device is enabled and the primary service is disabled.

In some embodiments, creating an IPSEC service on a first communication device and a second communication device respectively through an upper-layer management and control platform includes:

An IPSEC service is created through an upper-level management and control platform, and it is determined whether the communication device is online. When the first communication device and the second communication service are online, an IPSEC service is respectively issued to the first communication device and the second communication device, and protection parameters of the IPSEC service are configured.

In some embodiments, allocating the IPSEC service on the first communication device to a primary service role and allocating the IPSEC service on the second communication device to a backup service role includes:

Allocating the IPSEC service on the first communication device to a primary service role, wherein the primary service is in an enabled state;

The IPSEC service on the second communication device is assigned as a backup service role, and the status of the backup service is a disabled status.

In some embodiments, monitoring the first communication device and the second communication device through the upper-layer control platform includes:

The upper-layer management and control platform monitors the first communication device and the second communication device, and determines the operation status of the communication device according to the return value of the protection parameter of the IPSEC service in the communication device.

In some embodiments, after enabling the backup service on the second communication device and disabling the primary service, the method further includes:

The first communication device is continuously monitored through the upper-layer management and control platform. If it is monitored that the primary service on the first communication device is restored, the primary service is enabled and the backup service on the second communication device is disabled.

In some of the embodiments, the role allocation data, service delivery data and parameter configuration data are persistently stored in a local database.

In some of the embodiments, the communication device is a communication device based on a software-defined wide area network.

In a second aspect, an embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN, which is applied to full-link path protection, including:

Creating a corresponding IPSEC global service between a first link and a second link through an upper-layer management and control platform, wherein the first link is composed of a plurality of communication devices, and the second link is also composed of a plurality of communication devices;

Allocating a primary global service role and a backup global service role for the IPSEC global service;

The first link and the second link are monitored by the upper-layer management and control platform. If it is monitored that the primary global service between the links cannot be operated, the backup global service between the links is enabled, and the primary global service is disabled at the same time.

In a third aspect, an embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling system based on SDWAN, the system is applied to unilateral path protection, and the system includes a service creation module and a service scheduling module;

The service creation module is used to create an IPSEC service on the first communication device and the second communication device respectively through the upper-layer management and control platform; assign the IPSEC service on the first communication device to the primary service role, and assign the IPSEC service on the second communication device to the backup service role;

The service scheduling module is used to monitor the first communication device and the second communication device through the upper-level management and control platform. If it is monitored that the main service on the first communication device cannot run, the backup service on the second communication device is enabled and the main service is disabled.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the heterogeneous IPSEC tunnel protection scheduling method based on SDWAN as described in the first and second aspects above.

Compared with the related art, the embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling method, system and medium based on SDWAN, wherein the method is applied to single-side path protection, and an IPSEC service is created on the first communication device and the second communication device respectively through the upper-level management and control platform; the IPSEC service on the first communication device is assigned as the main service role, and the IPSEC service on the second communication device is assigned as the backup service role; the first communication device and the second communication device are monitored by the upper-level management and control platform, and if it is monitored that the main service on the first communication device cannot run, the backup service on the second communication device is enabled, and the main service is disabled at the same time, thereby solving the problem of lack of efficient management of IPSEC tunnel protection schemes between multiple devices, realizing monitoring of the IPSEC tunnel status of different devices through the upper-level management and control platform, and improving the management efficiency of IPSEC tunnel protection in multi-device scenarios.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

FIG1 is a flowchart of a method for scheduling IPSEC tunnel protection for different machines based on SDWAN according to an embodiment of the present application;

FIG2 is a second flow chart of the steps of the heterogeneous machine IPSEC tunnel protection scheduling method based on SDWAN according to an embodiment of the present application;

3 is a structural block diagram of a heterogeneous IPSEC tunnel protection scheduling system based on SDWAN according to an embodiment of the present application;

FIG. 4 is a schematic diagram of the internal structure of an electronic device according to an embodiment of the present application.

Description of the drawings: 31. Business creation module; 32. Business scheduling module.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and/or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

The embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN. FIG1 is a flow chart of the steps of the heterogeneous IPSEC tunnel protection scheduling method based on SDWAN according to the embodiment of the present application. As shown in FIG1, the method is applied to unilateral path protection, including the following steps:

Step S102, creating an IPSEC service on the first communication device and the second communication device respectively through the upper layer management and control platform;

Specifically, an IPSEC service is created through the upper-level control platform, and it is determined whether the communication device is online. When the first communication device and the second communication service are online, an IPSEC service is issued to the first communication device and the second communication device respectively, and the protection parameters of the IPSEC service are configured. The protection parameter defines two return modes, one is to return the return value, and the other is not to return the return value. It is used by the upper-level control platform to determine the operating status of the IPSEC service in the communication device.

It should be noted that the first communication device and the second communication device are communication devices based on the Software Defined Wide Area Network (SDWAN). SDWAN is a service formed by applying SDN technology to the wide area network scenario. This service is used to connect enterprise networks, data centers, Internet applications and cloud services in a wide geographical range. In addition, IPSEC (Internet Protocol Security) is a group of secure communication protocols based on the network layer and applied cryptography. IPSEC does not refer to a specific protocol, but an open protocol family. The design goal of the IPSEC protocol: to provide flexible security services for network layer traffic in IPV4 and IPV6 environments. IPSECVPN: A secure virtual private network implemented at the IP layer based on the IPSEC protocol family. The security of OSI upper layer protocol data is guaranteed by inserting a predefined header into the data packet, which is mainly used to protect TCP, UDP, ICMP and tunnel IP data packets.

Step S104, assigning the IPSEC service on the first communication device to a primary service role, and assigning the IPSEC service on the second communication device to a backup service role;

Specifically, the IPSEC service on the first communication device is assigned to a primary service role, and the status of the primary service is enabled; the IPSEC service on the second communication device is assigned to a backup service role, and the status of the backup service is disabled.

Step S106, monitoring the first communication device and the second communication device through the upper-level management and control platform, if it is monitored that the primary service on the first communication device cannot run, the backup service on the second communication device is enabled, and the primary service is disabled.

Specifically, the upper-level control platform monitors the first communication device and the second communication device, and judges the operation status of the communication device according to the return value of the protection parameter of the IPSEC service in the communication device. If the return value of the protection parameter is information that the main service is disconnected or degraded, the operation status of the communication device is abnormal, that is, the main service on the communication device cannot run. In this case, the backup service on the second communication device is enabled, and the main service is disabled at the same time.

Preferably, after step S106, the first communication device is continuously monitored through the upper-layer management and control platform. If it is monitored that the primary service on the first communication device is restored, the primary service is enabled and the backup service on the second communication device is disabled.

Through steps S102 to S106 in the embodiment of the present application, the problem of lack of efficient management of IPSEC tunnel protection schemes between multiple devices is solved, and the IPSEC tunnel status of different devices is monitored through the upper-level management and control platform, thereby improving the management efficiency of IPSEC tunnel protection in multi-device scenarios.

The embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN. FIG. 2 is a flow chart of the steps of the heterogeneous IPSEC tunnel protection scheduling method based on SDWAN according to the embodiment of the present application. As shown in FIG. 2 , the method is applied to full-link path protection, including the following steps:

Step S202, creating a corresponding IPSEC global service between a first link and a second link through an upper-layer management and control platform, wherein the first link is composed of a plurality of communication devices, and the second link is also composed of a plurality of communication devices;

Specifically, a corresponding IPSEC global service is created between the first link and the second link through the upper-layer control platform, and the protection parameters of the IPSEC global service are configured. The protection parameters define two return modes, one is to return a return value, and the other is not to return a return value. The upper-layer control platform is used to judge the operation status of the IPSEC global service.

It should be noted that the IPSEC global service refers to an end-to-end service (i.e., two single-point services in pairs), such as: the company headquarters has communication equipment A and communication equipment B, and the company office has communication equipment C and communication equipment D; communication equipment A is connected to communication equipment C, and communication equipment B is connected to communication equipment D, and an IPSEC service is established on each of A, B, C, and D; then the two IPSEC services on communication equipment A and communication equipment C constitute the IPSEC global service, and the two IPSEC services on communication equipment B and communication equipment D constitute the IPSEC global service.

Step S204, allocating a primary global service role and a backup global service role for the IPSEC global service;

Specifically, the state of the primary global service is an enabled state; the state of the backup global service is a disabled state.

Step S206, monitoring the first link and the second link through the upper-layer management and control platform, if it is monitored that the primary global service between the links cannot run, the backup global service between the links is enabled, and the primary global service is disabled.

Specifically, the communication devices in the first link and the second link are monitored by the upper-layer control platform, and the operation status of the communication devices is determined according to the return value of the protection parameter of the IPSEC global service. If the return value of the protection parameter is information that the main global service is disconnected or degraded, the operation status of the communication device is abnormal, that is, the main global service on the communication device cannot run. In this case, the backup global service between the links is enabled, and the main global service is disabled at the same time.

Preferably, after step S106, the upper-layer management and control platform continues to monitor the communication devices in the first link and the second link. If it is monitored that the primary global service is restored, the primary global service is enabled and the backup global service between the links is disabled.

Through steps S202 to S206 in the embodiment of the present application, the problem of lack of efficient management of IPSEC tunnel protection schemes between multiple devices is solved, and the IPSEC tunnel status of different devices is monitored through the upper-level management and control platform, thereby improving the management efficiency of IPSEC tunnel protection in multi-device scenarios.

It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

The embodiment of the present application provides a heterogeneous IPSEC tunnel protection scheduling system based on SDWAN. FIG3 is a structural block diagram of the heterogeneous IPSEC tunnel protection scheduling system based on SDWAN according to the embodiment of the present application. As shown in FIG3, the system is applied to single-side path protection, including a service creation module 31 and a service scheduling module 32;

The service creation module 31 is used to create an IPSEC service on the first communication device and the second communication device respectively through the upper-layer management and control platform; assign the IPSEC service on the first communication device to the primary service role, and assign the IPSEC service on the second communication device to the backup service role;

The service scheduling module 32 is used to monitor the first communication device and the second communication device through the upper management and control platform. If it is monitored that the main service on the first communication device cannot run, the backup service on the second communication device is enabled and the main service is disabled.

Through the service creation module 31 and the service scheduling module 32 in the embodiment of the present application, the problem of lack of efficient management of IPSEC tunnel protection schemes between multiple devices is solved, and the IPSEC tunnel status of different devices is monitored through the upper-level management and control platform, thereby improving the management efficiency of IPSEC tunnel protection in multi-device scenarios.

It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

This embodiment further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

Optionally, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

In addition, in combination with the heterogeneous IPSEC tunnel protection scheduling method based on SDWAN in the above embodiment, the embodiment of the present application can provide a storage medium for implementation. The storage medium stores a computer program; when the computer program is executed by the processor, any heterogeneous IPSEC tunnel protection scheduling method based on SDWAN in the above embodiment is implemented.

In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN is implemented. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

In one embodiment, FIG4 is a schematic diagram of the internal structure of an electronic device according to an embodiment of the present application. As shown in FIG4, an electronic device is provided, which may be a server, and its internal structure diagram may be as shown in FIG4. The electronic device includes a processor, a network interface, an internal memory, and a non-volatile memory connected through an internal bus, wherein the non-volatile memory stores an operating system, a computer program, and a database. The processor is used to provide computing and control capabilities, the network interface is used to communicate with an external terminal through a network connection, the internal memory is used to provide an environment for the operation of the operating system and the computer program, and the computer program is executed by the processor to implement a heterogeneous IPSEC tunnel protection scheduling method based on SDWAN, and the database is used to store data.

Those skilled in the art will understand that the structure shown in FIG. 4 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

Those skilled in the art should understand that the technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims (9)

1. The method is characterized by being applied to single-side path protection and comprises the following steps:

respectively creating an IPSEC service on the first communication device and the second communication device through the upper management and control platform;

distributing IPSEC service on the first communication equipment as a main service role, wherein the state of the main service is an enabled state; the IPSEC service on the second communication equipment is distributed to be a standby service role, the state of the standby service is a non-starting state, wherein the first communication equipment communicates with third communication equipment through the IPSEC service of the main service role, and the second communication equipment communicates with fourth communication equipment through the IPSEC service of the standby service role;

monitoring a first communication device and a second communication device through the upper management and control platform, and if the monitoring that the main service on the first communication device cannot run, starting the standby service on the second communication device and simultaneously stopping the main service.

2. The method of claim 1, wherein creating, by the upper management platform, one IPSEC service on the first communication device and the second communication device respectively comprises:

and establishing IPSEC service through an upper management and control platform, judging whether the communication equipment is on line, respectively issuing an IPSEC service for the first communication equipment and the second communication equipment after the first communication equipment and the second communication equipment are on line, and configuring protection parameters of the IPSEC service.

3. The method of claim 2, wherein listening to the first communication device and the second communication device through the upper management platform comprises:

and monitoring the first communication equipment and the second communication equipment through the upper management and control platform, and judging the running state of the communication equipment according to the return value of the protection parameters of the IPSEC service in the communication equipment.

4. The method of claim 1, wherein after enabling the backup service on the second communication device while disabling the active service, the method further comprises:

and continuing to monitor the first communication equipment through the upper management and control platform, and if the primary service on the first communication equipment is monitored to resume operation, starting the primary service, and simultaneously stopping the standby service on the second communication equipment.

5. The method according to any of claims 1-4, characterized in that the role assignment data, the traffic delivery data and the parameter configuration data are persisted in a local database.

6. The method of any of claims 1-4, wherein the communication device is a software defined wide area network (ww an) based communication device.

7. The method is characterized by being applied to full-link path protection and comprises the following steps:

the first link comprises a communication device A and a communication device B, and the second link comprises a communication device C and a communication device D, wherein the communication device A and the communication device C are connected and communicated by means of a software-defined wide area network SDWAN, and the communication device B and the communication device D are connected and communicated by means of the software-defined wide area network SDWAN;

creating IPSEC services on the communication device a and the communication device C respectively through an upper management and control platform to form a first IPSEC global service, and creating IPSEC services on the communication device B and the communication device D respectively through an upper management and control platform to form a second IPSEC global service;

distributing a main global service role for the first IPSEC global service, and distributing a standby global service role for the second IPSEC global service, wherein the state of the main global service is an enabled state; the state of the standby global service is an inactive state;

and monitoring the first link and the second link through the upper management and control platform, and if the active global service between the links cannot be operated, enabling the standby global service between the links and simultaneously disabling the active global service.

8. The system is characterized by being applied to single-side path protection and comprises a service creation module and a service scheduling module;

the business creation module is used for creating an IPSEC business on the first communication equipment and the second communication equipment through the upper management and control platform respectively; distributing IPSEC service on the first communication equipment as a main service role, wherein the state of the main service is an enabled state; the IPSEC service on the second communication equipment is distributed to be a standby service role, the state of the standby service is a non-starting state, wherein the first communication equipment communicates with third communication equipment through the IPSEC service of the main service role, and the second communication equipment communicates with fourth communication equipment through the IPSEC service of the standby service role;

the service scheduling module is configured to monitor, through the upper management and control platform, the first communication device and the second communication device, and if it is monitored that the primary service on the first communication device cannot operate, enable the standby service on the second communication device, and simultaneously disable the primary service.

9. A computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the SDWAN-dependent heterogeneous IPSEC tunnel protection scheduling method according to any of claims 1 to 7.