WO2013056628A1

WO2013056628A1 - Method, application server, network database, and system for achieving heartbeat mechanism

Info

Publication number: WO2013056628A1
Application number: PCT/CN2012/082714
Authority: WO
Inventors: 吴强; 江华; 符涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-10-21
Filing date: 2012-10-10
Publication date: 2013-04-25
Also published as: CN103067215B; CN103067215A

Abstract

Disclosed are a method, an application server, a network database and a system for achieving a heartbeat mechanism. A secure mechanism is established by an application server and a network database; a mapping relationship between user network layer identifiers is established by the application server and the network database; when a network terminal user activates a service application by logging into the application server via an application client, the heartbeat mechanism is established between the application server and the network database. The solution can effectively reduce the transmission frequency of short packets between the network and the terminal, and decrease the network load; in addition, it simplifies the service flow of application service servers.

Description

Method for realizing heartbeat mechanism, application server, network database and system

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method, an application server, a network database, and a system for implementing a heartbeat mechanism. Background technique

In some business areas, such as instant messaging and long-distance remote monitoring, most of them use short data packets for data transmission, using TCP (Transmission Control Protocol) / IP protocol based Internet or GPRS (General Packet Radio Service, General Packet Radio Access Technology, and CDMA (Code Division Multiple Access) perform data transmission. Communication reliability is the key to ensuring service quality. In order to maintain the speed and stability of remote communication based on TCP/IP protocol, the heartbeat packet mechanism is usually used. The so-called heartbeat packet mechanism is a mechanism for sending and receiving heartbeat packets (referred to as heartbeat packets). It is actually a custom protocol, a specific, cyclically transmitted data packet, which is mainly used to determine whether a network node is still connected. This protocol needs to be supported by each node. It is generally used to determine whether the peer (device, process, or other network element) is running normally. It uses a timed to send a simple communication packet. If the response is not received within the specified time period, it is judged. The connection to the other party has been interrupted.

In various client-server-based technical solutions, after logging in to the server, the client needs to maintain a connection between the client and the server to ensure that: 1. The server and the client can know each other at the time. The status determines whether the other party can receive and process the message; 2. The server can correctly locate the address of the client and send a message to the client.

In the published patent document, the Chinese Patent Application No. 200710140469 discloses "a method, a server and a system for implementing a heartbeat mechanism", and aims to provide a method, a server and a system for implementing a heartbeat mechanism, The above technical problem of not being able to perform targeted client identification on the heartbeat request message is solved.

In addition, the Chinese Patent Application No./Patent No. CN200880127966.4 discloses "A Method and Apparatus for Implementing a Heartbeat Mechanism in a Communication Network", which is completed by introducing a proxy device between a control device and an execution device of the communication network. Work status monitoring between the device and the execution device Processing, thereby greatly reducing the burden of controlling device processing status monitoring related information. Specifically, the proxy device obtains the working status information of the multiple execution devices, and reports the information to the control device by using one or more uplink report messages. After receiving the uplink report message reported by the proxy device, the control device is based on the uplink report message. , Get the working status information of multiple execution devices. The invention is particularly applicable to device state monitoring based on a heartbeat mechanism in a softswitch network.

In the related art solution, after the client logs in, the correspondence between the client account and the address information (for example, the IP address and the port number) is established. Each heartbeat message interaction requires the network terminal device to collect its own state information at regular intervals, and then send it to the network address translation server through the network through the heartbeat data packet; the network address translation server performs address translation processing on the heartbeat packet information. Afterwards, the heartbeat data packet is forwarded to the central heartbeat server; for the heartbeat data packet that has passed the check, the relevant record information is written; if the check fails, the current heartbeat data packet is discarded; and the central task manager according to the related record information The processing of transmitting the corresponding feedback information heartbeat data packet to the client system is performed, and the network address translation server sends the data packet to the corresponding network terminal device.

In the related art method for implementing a heartbeat connection between a client and a server, there is a network heartbeat monitoring method based on a UDP (User Datagram Protocol) protocol, the method comprising the following steps:

(1) The network terminal equipment collects and compresses its own state information at regular intervals, and then sends the UDP heartbeat data packet to the network address translation server through the network using the UDP protocol;

(2) The network address translation server performs address translation processing on the UDP heartbeat packet information sent by the network terminal device, that is, converts the IP address and port of the network terminal device into the IP address and port of the network address translation server, and then the UDP The heartbeat packet information is forwarded to the central heartbeat server through the network;

(3) After receiving the corresponding UDP heartbeat packet information, the central heartbeat server sends the heartbeat manager through the network;

(4) The heartbeat manager performs decompression verification processing on the UDP heartbeat packet information, and then performs format translation processing on the corresponding information. If the information format is incorrect, the heartbeat manager discards the current UDP heartbeat packet and sends the packet to the client. The system sends the UDP heartbeat packet information to retransmit the required feedback information UDP packet; if the information format is correct, the related record information is forwarded to the central Write to the database in the database server;

(5) The central task manager performs processing for transmitting the corresponding feedback information UDP heartbeat data packet to the client system according to the related record information written in the central database server;

(6) The network address translation server receives the feedback information UDP data packet of the central server system through the network, and performs reverse address translation processing on the network address conversion server, that is, the IP address and port of the network address translation server, and the IP address and port of the network terminal device. ;

(7) The network address translation server sends the feedback information UDP data packet to the corresponding network terminal device;

(8) The network terminal device performs corresponding subsequent processing according to the feedback information UDP data packet. Therefore, after the HTTP login by the client, the server performs the heartbeat data packet transmission on the IP address and the port number corresponding to the client account according to the correspondence between the account and the address information in the related record information of the client. Receive, that is, the interaction of heartbeat connections. These heartbeat messages are short data packets sent by the server and client application layer and forwarded by the IP network bearer layer.

Because the frequency of heartbeat messages is very high and the user base is large, it will affect the performance of the IP network bearer layer, especially the wireless bearer layer such as the wireless cellular network, which is manifested in the following aspects:

On the one hand, when the application layer message (such as heartbeat) interval is larger than the inactivity timer, the following problems occur:

1) The wireless terminal frequently switches between idle (Idle) and active (Active) states; 2) increases control plane signaling, and increases signaling overhead of the radio access network RAN and the packet core network;

3) Reduce the standby/working time of the mobile phone battery and affect the user experience;

On the other hand, when the application layer message (such as heartbeat) interval is smaller than the inactivity timer, the following problems occur:

1) Wireless terminals will always occupy wireless resources;

2) waste wireless resources and reduce utilization;

3) Reduce the standby/working time of the mobile phone battery and affect the user experience.

In addition, given the deteriorating network environment, a variety of malicious attacks are emerging. In particular, it is more harmful to the behavior of the web server attack on the client side. Therefore, it is also necessary to provide a technical solution for the safety of heartbeat interaction.

In addition, the following problems exist in the prior art: The application server needs to maintain a dynamic mapping relationship between the service account and the IP address and the port number, and needs to implement registration address information, such as an IP address and a port number, in the login process of the client; The security login in the case where the registered address information of the client belongs to the change; there is also the problem of secondary login caused by the change of the address information; the application service server needs to handle the service addressing function, thereby making the business process too complicated.

Summary of the invention

The technical problem solved by the present invention is to provide a method, an application server, a network database and a system for realizing a heartbeat mechanism, which can effectively reduce the transmission frequency of short data packets between the network and the terminal, and reduce the network load.

To solve the above technical problem, the present invention provides a method for implementing a heartbeat mechanism, the method comprising:

The application server establishes a security mechanism with the network database;

Establishing, by the application server, a mapping relationship between the user network layer identity and the network database;

When the network terminal user activates the service application by logging in to the application server by using the application client, a heartbeat mechanism is established between the application server and the network database.

Preferably, the method further includes:

The network database maintains a mapping relationship between the identity identification and the location identification of the terminal user, and locates the application client where the terminal user is located according to the mapping relationship.

Preferably, the method further includes: the network database is based on information that is reported by the network access device or that is queried by other network elements in the network, and maintains status information of the terminal user; the status information includes: Online status, offline status.

Preferably, the method further includes:

Establishing a state reservation mechanism between the application server and the network database, the number of the network The database notifies the application server of the status change of the terminal user. Preferably, the method further includes:

An inquiry mechanism is established between the application server and the network database, and the application server queries the network database for terminal user status information and/or terminal user information according to service requirements.

Preferably, the method further includes: when the application client stops the service application, the application server notifies the network database to stop the heartbeat mechanism.

Preferably, the manner in which the application server establishes a security association with the network database includes, but is not limited to, Internet Protocol Security (IPsec), two-way authentication authorization, and virtual private network (VPN) access.

The present invention also provides an application server for implementing a heartbeat mechanism, the application server comprising: an application client user identity management module, configured to: establish a mapping relationship between a user network layer identity and a network database;

The application client login status maintenance module is configured to: maintain whether the application client is in the login state, and request the establishment of the heartbeat mechanism to the network database when the application client logs in and activates the service application;

a heartbeat mechanism module, configured to: perform heartbeat interaction with the network database to determine state information of the application client;

a security mechanism module, configured to: perform secure interaction with the network database, complete two-way authentication between the application server and the network database, establish a security association between the application server and the network database; and, with the application The client performs a secure interaction and completes the authentication of the application client.

Preferably, the application server further includes a user status query module, configured to: establish a state reservation mechanism with the network database, and notify the network database to notify the application server of the state change of the terminal user.

Preferably, the user status query module is further configured to: establish a query mechanism with the network database, and query the network database for terminal user status information and/or terminal user information according to service requirements.

Preferably, the application client login status maintenance module is further configured to: the application client When the business application is stopped, the network database is notified to stop the heartbeat mechanism. The present invention further provides a network database for implementing a heartbeat mechanism, the network database comprising: a heartbeat mechanism unit, configured to: perform a heartbeat interaction with an application server, so that the application server can determine status information of the application client;

The security mechanism unit is configured to: perform secure interaction with the application server, complete two-way authentication between the application server and the network database, and establish a security association between the application server and the network database. Preferably, the network database further includes:

The user status maintenance unit is configured to: according to the information that is reported by the network access device or that is queried by other network elements in the network, and maintains the status information of the terminal user; the status information includes: online status, offline State

The user status query unit is configured to: when the application server initiates the query, return corresponding terminal user status information and/or terminal user information to the application server.

Preferably, the user status query unit is further configured to: establish a state reservation mechanism with the network database, and notify the application server of a status change of the terminal user.

Preferably, the network database further includes:

The service addressing unit is configured to: maintain a mapping relationship between the identity identification and the location identification of the terminal user, and locate the application client where the terminal user is located according to the mapping relationship.

The present invention also provides a system for implementing a heartbeat mechanism, the system comprising: an application server, an application client, and a network database, wherein:

The application server is configured to: after the application client logs in, activate the service application, establish a heartbeat mechanism with the network user database, obtain the online status information of the user, and establish a correspondence between the client account and the network layer user identification;

The application client is configured to: send a heartbeat request message according to the login response information or a heartbeat response message;

The network database is configured to save network layer user identification information, maintain user online status, and establish a heartbeat mechanism with the application server, and provide user online status information to the application server. Preferably, the application server side further includes:

The application client user identity management module is configured to: establish a mapping relationship between the user network layer identity and the network database;

The application client login status maintenance module is configured to: maintain the application client is in a login state, and request the establishment of a heartbeat mechanism to the network database when the application client logs in and activates the service application;

Preferably, the application server further includes a user status query module, configured to: establish a state reservation mechanism with the network database, and notify the network database to notify the application server of a status change of the terminal user; And/or establishing a query mechanism with the network database, and querying the network database for terminal user status information and/or terminal user information according to service requirements.

Preferably, the application client login state maintenance module is further configured to: notify the network database to stop the heartbeat mechanism when the application client stops the service application.

Preferably, the network database comprises:

a heartbeat mechanism unit, configured to: perform heartbeat interaction with an application server, so that the application server can determine status information of the application client;

The security mechanism unit is configured to: perform secure interaction with the application server, complete two-way authentication between the application server and the network database, and establish a security association between the application server and the network database.

Preferably, the network database further includes:

The user status maintenance unit is configured to: maintain the status information of the terminal user according to the information that is reported by the network access device or that is queried by other network elements in the network; Including: online status, offline status;

The user status query unit is configured to: when the application server initiates the query, return corresponding terminal user status information and/or terminal user information to the application server; and establish a state reservation mechanism with the network database, Notifying the application server of the status change of the end user.

Preferably, the network database further includes:

BRIEF abstract

The drawings are intended to provide a further understanding of the invention, and are intended to be illustrative of the invention. In the drawing:

1 is a schematic diagram of a server for implementing a heartbeat mechanism according to an embodiment of the present invention;

2 is a schematic diagram of a network database for implementing a heartbeat mechanism according to an embodiment of the present invention;

Figure 3 is a schematic diagram of a network architecture of an identity location separation scheme of a network;

4 is a schematic flow chart of a method for implementing a heartbeat mechanism according to an embodiment of the present invention;

5 is a schematic diagram of a host protocol stack of a host-based identity location separation scheme according to an embodiment of the present invention;

Figure 6 is a schematic diagram of a host-based identity location separation scheme.

Preferred embodiment of the invention

The present embodiment provides a technical solution for implementing a heartbeat mechanism: The network database stores user state information required by the application server, and the network database replaces the terminal, and establishes a heartbeat mechanism with the application server to report the connection state between the terminal and the application server.

Specifically, the embodiment provides a method for implementing a heartbeat mechanism, where the method includes at least the following steps: Step 1. The application server establishes a security mechanism with the network database; Step 2. Establish a mapping relationship between the network layer user identity between the application server and the network database;

Step 3. When the application client, that is, the network terminal user activates the service application, a heartbeat mechanism is established between the application server and the network database. Further, the method further includes one or more of the following steps:

Step 4. The network database queries other network elements in the network for the status information of the maintenance terminal host. Step 5. The application server establishes a state reservation mechanism with the network database. For example, the application server makes an appointment to the network database: The service application is actively notified when the user status changes, including the status notification process of the user going online and offline.

Step 6. When the application client, that is, the network terminal user stops using the service, the application server notifies the network database to stop the heartbeat mechanism. Step 7. Establish a query mechanism between the application server and the network database. The application server can query the user status and user information when needed according to the business process.

It should be noted that there is no strict sequence of timing between the above steps.

The embodiment further provides a server for implementing a heartbeat mechanism. As shown in FIG. 1, the server mainly includes:

The application client user identity management module is configured to: the corresponding application server does not need to maintain a dynamic binding relationship between the IP address and the port number corresponding to the client account, and establish a relationship between the client account and the network layer user identification. Static correspondence

The application client login status maintenance module is configured to: maintain whether the application client is in the login state, and interact with the network database to notify the application client whether it is in the login state; the heartbeat mechanism module is configured to: interact with the network database To determine the current state of the client, whether it can receive and process messages;

a security mechanism module, configured to: perform secure interaction with a network database, complete two-way authentication between the application server and the network database, establish a security association between the application server and the network database; and perform secure interaction with the application client to complete Authentication of the application client.

User status query module, used for: The application server can query according to the business process when needed User status and user information. For example: The network database stores the location information of the application client, and when the application server needs it, it can initiate a query to the network database.

In addition, the embodiment further provides a network database for implementing a heartbeat mechanism. As shown in FIG. 2, the network database mainly includes:

a heartbeat mechanism unit, configured to: interact with an application server, so that the application server can determine a current state of the client, and the application server can determine whether the message can be received and processed;

The security mechanism unit is configured to: perform secure interaction with the application server, complete two-way authentication between the application server and the network database, and establish a security association between the application server and the network database. Further, the foregoing network database may further include one or more of the following units: a user status query unit, configured to: the application server may query the user status and user information when needed according to the business process, and the network database provides the query interface to the network database. . For example: The location information of the application client is saved in the network database, and the query can be initiated to the network database when the application server needs the business;

The user status maintenance unit is configured to: query, according to the needs of the application server, the network database to query the status information of the maintenance application client, that is, the network terminal host, to other network elements in the network. These status information includes, but is not limited to, user network terminal host location information, network terminal host arrears status, online status, etc.;

The service addressing unit is configured to: the network database real-time maintenance application client, that is, the corresponding mapping relationship between the network terminal host identity identifier and the location identifier. The address of the network terminal host, that is, the application client, can be located by the identity of the network terminal host.

When the data communication network is routed based on the IP address, the Internet application layer user account, such as the instant communication number and the email address, does not have the function of identifying the location of the application layer client, and cannot be directly used for addressing and routing at the network layer. When the Internet application layer service client communicates, the input communication peer is identified as an application layer user account. In order to realize the end-to-end communication process between the Internet application layer service clients, a function module is required to query the network layer routable location identifier through the application layer user account, and the network layer routes the data packet to the routable location identifier. The location of the communication peer. The application server and the network database establish a static mapping relationship between the application layer user account and the network layer user identification, or the network layer user identification can be directly used as the application layer user account. No. The application layer server can realize the end-to-end communication process between the application clients of the Internet application layer through the network layer service addressing function.

In addition, the embodiment further provides a system for implementing a heartbeat mechanism, the system comprising: an application server, a client, and a network database,

The application server is mainly used for: after the client is online, the application service is activated, and the corresponding application server establishes a heartbeat mechanism with the network user database to obtain the online status information of the user. The corresponding application server does not maintain the dynamic binding relationship between the IP address and the port number corresponding to the client account, and establishes a static correspondence between the client account and the network layer user identification.

The client is mainly configured to: send a heartbeat request message according to the login response information or a heartbeat response message.

The network database stores the identity information of the network user, and is mainly used to: cooperate with the access management device in the network, save the network layer user identification information, maintain the online state of the user; and interface with the application server, and the application server Establish a heartbeat mechanism to provide user online status information to the application layer.

Further, the application server specifically includes the following functional modules:

The application client login status maintenance module is configured to: maintain whether the application client is in a login state, and request the establishment of a heartbeat mechanism to the network database when the application client logs in and activates the service application;

a heartbeat mechanism module, configured to: perform a heartbeat interaction with the network database to determine state information of the application client;

Further, the application server further includes a user status query module, configured to: establish a state reservation mechanism with the network database, and reserve the terminal user with the network database. Notifying the application server of the status change; and/or establishing a query mechanism with the network database to query the network database for terminal user status information and/or terminal user information according to service requirements.

Further, the application client login state maintenance module is further configured to: when the application client stops the service application, notify the network database to stop the heartbeat mechanism.

Further, the network database specifically includes the following units:

And a security mechanism unit, configured to: perform secure interaction with the application server, complete two-way authentication between the application server and the network database, and establish a security association between the application server and the network database.

Further, the network database further includes:

The user status maintenance unit is configured to: maintain the status information of the terminal user according to the information that is reported by the network access device or that is queried by other network elements in the network; and the status information includes: online status, offline State

a user status query unit, configured to: when the application server initiates the query, return corresponding terminal user status information and/or terminal user information to the application server; and establish a state reservation mechanism with the network database, Notifying the application server of the status change of the end user.

Further, the network database further includes:

The IP address in the TCP/IP protocol widely used in the existing Internet has a dual function, which serves as both the location identifier of the communication terminal host network interface of the network layer in the network topology and the identity of the transport layer host network interface. The TCP/IP protocol was not designed at the beginning of the host. However, as host mobility becomes more prevalent, the semantic overload defects of such IP addresses are becoming increasingly apparent. When the IP address of the host changes, not only the route changes, but also the identity of the host of the communication terminal changes.

In the related art, a network router-based implementation method and a host-based implementation method are related. Two mainstream solutions for identity and location separation. After the identity and location are separated, the network layer identity of the terminal host can be fixed. It does not need to be changed due to the change of the terminal host location. The basic network maintains the dynamic mapping relationship between the terminal identity and the location identifier of the terminal, and completes the data packet. The process of identifying the location identifier by the identity identifier completes the process of addressing and forwarding the data packet.

Embodiment 1

This embodiment describes the specific implementation of the present invention based on the identity identification and location separation solution of the network router:

As shown in Figure 3, the network element included in the network-based solution can be abstracted from the logical function: host, network database, mapping encapsulation execution node/forwarding device. Hosts in the network have two types of identity: host identity and location route identity. The host identity indicates the user identity, and is used to identify the communication peer end when the end-to-end communication is used; the location identifier indicates the current location of the terminal user, and is used for routing the data packet. The network database stores the correspondence between the identity identifier of the terminal host and the location identifier through the mapping table.

The identity is kept static as the host account information. The location identifier is assigned by the currently accessed mapping encapsulation node based on the host location. The mapping encapsulation execution node cooperates with the network database, and through the registration update process, the mapping relationship between the host identity and the location identifier saved in the network database is updated in real time.

When the host 1 initiates communication with the host 2, the mapping encapsulation executing node 1 queries the network database for the location identifier of the host 2 according to the communication peer identity identifier, and saves the query result in the mapping routing table of the mapping encapsulation execution node 1, The mapping table maintains the identity/location identification mapping information of the host 2 in real time, and implements data packet encapsulation processing, routing, and forwarding according to the mapping routing table. After receiving the data packet sent by the encapsulating execution node 1, the mapping encapsulation execution node 2 performs location identification decapsulation processing, and sends the decapsulated data to the communication peer.

When the location of the host on the communication end changes, the mapping encapsulation execution node registers a new location identifier with the network database and notifies the communication peer. Thereafter, both ends of the communication will communicate with the new location identifier.

The above network-based identity location separation scheme provides a unified and unique identity for the host.

In this embodiment, based on the above identity location separation scheme, the network database saves the terminal master The identity of the machine, and dynamically maintain the mapping relationship between the identity and the location identity. The method for implementing the heartbeat mechanism in this embodiment, as shown in FIG. 4, mainly includes the following steps: Step S101. The application server establishes a security mechanism with the network database.

The application server establishes a security association with the network database. Because of the security association between the network-side devices, the processing efficiency, the convenience of the device management upgrade, the professional level, the security strength, and the flexibility of the security mechanism are all largely Upgrade. The ways to establish security associations include but are not limited to: IPsec, two-way authentication and authorization, and VPN access.

Step S102: The application server establishes a mapping relationship between the user identification and the network database. Through the application client user identification management unit in the application server, the corresponding application server does not need to maintain the dynamic binding relationship between the IP address and the port number corresponding to the client account, and establish a client account and a network layer user identification. Static correspondence between the two. The static correspondence between the client account and the network layer user identification can be entered when the client account is opened, or can be obtained through the application service layer signaling interaction when the user first logs in. When the business process is necessary, the application server and the network database should have an interaction confirmation mechanism to ensure that the client account and the network layer user identification correspond to the same user.

Step S103. The application client, that is, the network terminal user starts to use the service, and the heartbeat mechanism is established between the application server and the network database. The application server receives the login request from the client, and after successful verification, returns a login response message to the client. The application server initiates a heartbeat request to the network database and establishes a heartbeat mechanism with the network database.

The network database performs application server identification, and the network database returns a heartbeat response message, and a heartbeat mechanism is established between the application server and the network database. Otherwise the process ends.

Step S104. The application server makes a reservation to the network database, and actively notifies the service application when the user status changes, including the status notification process of the user going online or offline.

The network database stores state information of the application client, that is, the network terminal user, and the information includes whether the user is online or the like. The application server can initiate an appointment to the network database, and the network database actively notifies the service application when the user state changes. Step S105. Establish a query mechanism between the application server and the network database. The application server can query the user status and user information when needed according to the business process.

Step S106. The network database queries other network elements in the network for maintaining the status information of the terminal host.

Step S107. The application client, that is, the network terminal user stops using the service, and the application server notifies the network database to stop the heartbeat mechanism. In the above steps, step S101 and step S102 have no strict sequence in sequence. Step S104, step S105, and step S106 also have no strict sequence in sequence.

According to the above description, the method of the embodiment has at least the following beneficial effects:

1. The network can know whether the terminal is online, the connection status information with the network, and the information exchange between the network database and other network elements of the network, and the network database can maintain and store the connection status information. The heartbeat mechanism for confirming the connection state between the terminal (application client) and the application server is implemented by a heartbeat mechanism between the application server and the network user database, and the terminal (application client) no longer participates in the heartbeat between the application server and the application server. mechanism. It effectively reduces the frequency of sending short packets between the network and the user, and reduces the data load on the user's access to the network. In particular, wireless methods such as wireless cellular networks can effectively improve the utilization of wireless resources, improve the battery standby/working time of wireless terminals such as mobile phones, and enhance the user experience.

2. The technical solution provided by the embodiment of the present invention replaces the heartbeat mechanism between the application server and the terminal by using a heartbeat mechanism between the application server and the network database. A network attack initiated by a heartbeat mechanism between the terminal and the application server will be effectively controlled. The security mechanism between the terminal and the application server translates into a security mechanism between the application server and the network database. Comparing the terminal, the application server and the network database are network-side devices. Because of the security association between the network-side devices, both the processing efficiency, the convenience of device management upgrade, the professional level, the security strength, and the flexibility of the security mechanism are all Great improvement. Through the trusted mechanism between the application server and the network database, the purposeful security guarantee of the heartbeat interaction process can be realized, which will greatly improve the security of the system, reduce potential hidden dangers, and realize the organic unification of network security and efficiency.

Embodiment 2

This embodiment is based on the identity identification and location separation solution of the host, and is specific to the present invention. Description:

As shown in Figure 5, the basic idea of a host-based identity and location separation solution is to introduce a host identity layer between the network layer and the transport layer of the host. The host identification layer separates the originally tightly coupled transport layer from the network layer. The IP address no longer acts as the identity host. It is only responsible for the routing and forwarding of packets, that is, it is only used as a location identifier. The host name is represented by the host identifier. . The host identification layer is logically located between the network layer and the transport layer, and the host completes the host identifier and IP address translation in the packet. The network layer is shielded from the transport layer, and any changes in the network layer (for example, changes in the host IP address during communication) do not affect the transport layer link unless the quality of service changes. The transport layer connection is established on top of the host ID. The IP address can only be used for network layer routing and is no longer used to identify the host identity.

As shown in Figure 6, the host-based solution includes network elements abstracted from logical functions: host, network database. Through the process of "authentication registration update" between the host and the network database, the network database saves the mapping relationship between the host identifier and the terminal IP address in real time. When the initiator communicates with the responder, the initiator host 4 queries the network database for the IP address of the responder host according to the host ID of the responder, and obtains the host ID/IP address mapping of the responder, and the initiator and the responder establish security. Associate and communicate. When the host at the communication end changes, register a new IP address with the network database and notify the communication peer. After that, both ends of the communication will communicate with the new IP address.

The above host-based identity location separation scheme provides a unified and unique identity for the host.

In this embodiment, based on the solution of the above identity location separation, the network database stores the identity of the terminal host, and dynamically maintains the mapping relationship between the identity identifier and the location identifier.

The method for implementing the heartbeat mechanism in this embodiment mainly includes the following steps:

Step S201. The application server establishes a security mechanism with the network database.

The application server establishes a security association with the network database. Because of the security association between the network-side devices, the processing efficiency, the convenience of the device management upgrade, the professional level, the security strength, and the flexibility of the security mechanism are all largely Upgrade. Ways to establish security associations include, but are not limited to, Internet Protocol Security (IPsec), two-way authentication, and virtual private network (VPN) access.

Step S202: The application server establishes a mapping relationship between the user identification and the network database. Through the application client user identification management unit in the application server, the corresponding application server does not need to maintain the dynamic binding relationship between the IP address and the port number corresponding to the client account, and establish a client account and a network layer user identification. Static correspondence between the two. The static correspondence between the client account and the network layer user identification may be entered when the client account is opened, or may be obtained through application service layer signaling interaction when the user first logs in. When the business process is necessary, the application server and the network database should have an interaction confirmation mechanism to ensure that the client account and the network layer user identification correspond to the same user.

Step S203. The application client, that is, the network terminal user starts to use the service, and the heartbeat mechanism is established between the application server and the network database. The application server receives the login request from the client, and after successful verification, returns a login response message to the client. The application server initiates a heartbeat request to the network database and establishes a heartbeat mechanism with the network database.

Step S204. The application server makes a reservation to the network database, and actively notifies the service application when the user status changes, including the status notification process of the user going online or offline.

The network database stores state information of the application client, that is, the network terminal user, and the information includes whether the user is online or the like. The application server can initiate an appointment to the network database, and the network database actively notifies the service application when the user state changes.

Step S205. A query mechanism is established between the application server and the network database. The application server can query user status and user information as needed based on business processes.

Step S206. The network database queries other network elements in the network for maintaining the status information of the terminal host.

Step S207. The application client, that is, the network terminal user stops using the service, and the application server notifies the network database to stop the heartbeat mechanism. In the above steps, step S201 and step S202 have no strict sequence in sequence. There is no strict sequence in sequence between step S204, step S205, and step S206. According to the above description, the method of the embodiment has at least the following beneficial effects:

2. In this embodiment, the heartbeat mechanism between the application server and the network database is used instead of the heartbeat mechanism between the application server and the terminal. Network attacks using the heartbeat mechanism between the terminal and the application server will be effectively controlled. The security mechanism between the terminal and the application server translates into a security mechanism between the application server and the network database. Comparing the terminal, the application server and the network database are network-side devices. Because of the security association between the network-side devices, both the processing efficiency, the convenience of device management upgrade, the professional level, the security strength, and the flexibility of the security mechanism are all Great improvement. Through the trusted mechanism between the application server and the network database, the purposeful security of the heartbeat interaction process can be achieved, which will greatly improve the security of the system, reduce potential risks, and achieve organic integration of network security and efficiency.

Embodiment 3

This embodiment mainly describes a specific implementation of using a network database for service addressing.

Another function of the existing heartbeat mechanism between the application client and the application server is to register the address information of the application client account, such as an IP address and a port number, after the application client logs in, and maintain the application client on the application server. The real-time correspondence between the end account and the IP address port number. It can be used to address service flow when applying a client account when a service occurs.

In an identity-based location separation solution, the underlying network assigns each user a unique host identity that remains constant throughout the network and does not change over time. There are two types of identity in the underlying network: host identity and location route identity. The basic network database stores the mapping relationship between the host identity and the location identifier. The basic network maintains the mapping relationship in real time through processes such as registration update and handover. The underlying network is unique through the user The host identity is always able to find the corresponding location identifier in the network database, and realize the correct routing of user data streams and service flows.

Through the steps S101 and S102 shown in FIG. 4, the application server maintains a static mapping relationship between the service account and the user network identity identification, and the basic network provides a unique network layer user identity identification to the application service, and the service addressing function is provided by the basic network. . The application server no longer maintains the dynamic mapping between the service account and the IP address and port number.

The method of the embodiment is used to effectively simplify the following business processes of the application service server: For the login process of the client, the address information, such as the IP address and the port number, is registered. On the basis of the secure implementation of the heartbeat connection, the secure login in the case where the registered address information of the client is changed is realized, and the problem of secondary login due to the change of the address information is also avoided.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. The present invention may be embodied in various other embodiments without departing from the spirit and scope of the invention. Various changes and modifications may be made to the invention, and such changes and modifications are intended to be included within the scope of the appended claims.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any particular combination of hardware and software.

Industrial Applicability 4 The embodiments of the present invention have the following beneficial effects:

The heartbeat mechanism for confirming the connection state between the terminal and the application server in the embodiment of the present invention is implemented by a heartbeat mechanism between the application server and the network user database, thereby effectively reducing the network. The frequency of sending short packets between the network and the user reduces the data load on the user's access network. In particular, wireless methods such as wireless cellular networks can effectively improve the utilization of wireless resources, improve the battery standby/working time of wireless terminals such as mobile phones, and improve the user experience.

2. The application server maintains a static mapping relationship between the service account and the user's network identity. It does not need to maintain the dynamic mapping between the service account and the IP address. The network provides unique network layer user identification to the application service, and the service addressing function is provided by the network, which effectively simplifies the business process of the application service server.

3. The embodiment of the present invention utilizes the heartbeat mechanism between the application server and the network database to replace the heartbeat mechanism between the application server and the terminal, and the purpose of the heartbeat interaction process can be achieved through the trusted mechanism between the application server and the network database. The security guarantee will greatly improve the security of the system, reduce potential hidden dangers, and achieve the organic unification of network security and efficiency.

Claims

Claim

A method for implementing a heartbeat mechanism, the method comprising:

2. The method according to claim 1, wherein the method further comprises:

3. The method according to claim 1, wherein the method further comprises:

The network database is based on information reported by the network access device or queried by other network elements in the network, and maintains status information of the terminal user;

The status information includes: an online status and an offline status.

4. The method of claim 3, wherein the method further comprises:

A state reservation mechanism is established between the application server and the network database, and the network database notifies the application server of a change in state of the terminal user.

5. The method of claim 1, wherein the method further comprises:

The method of claim 1, wherein the method further comprises:

When the application client stops the service application, the application server notifies the network database to stop the heartbeat mechanism.

7. The method of claim 1, wherein

The manner in which the application server establishes a security association with the network database includes, but is not limited to, Internet Protocol Security (IPsec), two-way authentication authorization, and virtual private network (VPN) access.

8. An application server for implementing a heartbeat mechanism, the application server comprising: an application client user identity management module, configured to: establish a mapping relationship between a user network layer identity and a network database;

9. The application server according to claim 8, wherein

The application server further includes a user status query module, configured to: establish a state reservation mechanism with the network database, and notify the network database to notify the application server of the state change of the terminal user.

10. The application server according to claim 9, wherein

The user status query module is further configured to: establish a query mechanism with the network database, and query the network database for terminal user status information and/or terminal user information according to service requirements.

11. The application server according to claim 9, wherein

The application client login status maintenance module is further configured to: notify the network database to stop the heartbeat mechanism when the application client stops the service application.

12. A network database implementing a heartbeat mechanism, the network database comprising:

The security mechanism unit is configured to: perform secure interaction with the application server, complete two-way authentication between the application server and the network database, and establish the application server and the network number According to the security association between the libraries.

The network database of claim 12, wherein the network database further comprises: a user status maintenance unit, configured to: according to information reported by the network access device or queried by other network elements in the network, And maintaining status information of the terminal user; the status information includes: an online status and an offline status;

14. The network database according to claim 13, wherein

The user status query unit is further configured to: establish a state reservation mechanism with the network database, and notify the application server of a status change of the terminal user.

The network database of claim 12, wherein the network database further comprises: a service addressing unit, configured to: maintain a mapping relationship between the identity identification and the location identification of the terminal user, and according to the mapping relationship Targeting the application client where the end user is located.

16. A system for implementing a heartbeat mechanism, the system comprising: an application server, an application client, and a network database, wherein:

The network database is configured to save network layer user identification information, maintain user online status, and establish a heartbeat mechanism with the application server, and provide user online status information to the application server.

The system of claim 16, wherein the application server further comprises: an application client user identity management module, configured to: establish a mapping relationship between the user network layer identity and the network database;

The application client login status maintenance module is configured to: maintain whether the application client is in the login state, and request the establishment of the network database when the application client logs in and activates the service application. Heartbeat mechanism

18. The system of claim 17, wherein

The application server side further includes a user status query module, configured to: establish a state reservation mechanism with the network database, and notify the network database to notify the application server of a status change of the terminal user; and/or Establishing a query mechanism with the network database, and querying the network database for terminal user status information and/or terminal user information according to service requirements.

19. The system of claim 17 or 18, wherein

20. The system of claim 16, 17 or 18, wherein the network database comprises: a heartbeat mechanism unit, configured to: perform heartbeat interaction with an application server to enable the application server to determine status information of an application client ;

The system of claim 20, wherein the network database further comprises: a user status maintenance unit, configured to: according to information reported by the network access device or queried to other network elements in the network, and Maintaining status information of the terminal user; the status information includes: an online status and an offline status;

The system of claim 20, wherein the network database further comprises: a service addressing unit, configured to: maintain a mapping relationship between the identity identification and the location identification of the terminal user, and locate the mapping according to the mapping relationship Go to the application client where the end user is located.