WO2015139433A1 - 静态IPSec虚接口负载均衡的方法、装置及主处理器 - Google Patents

静态IPSec虚接口负载均衡的方法、装置及主处理器 Download PDF

Info

Publication number
WO2015139433A1
WO2015139433A1 PCT/CN2014/086760 CN2014086760W WO2015139433A1 WO 2015139433 A1 WO2015139433 A1 WO 2015139433A1 CN 2014086760 W CN2014086760 W CN 2014086760W WO 2015139433 A1 WO2015139433 A1 WO 2015139433A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
virtual interface
allocated
load balancing
coprocessor
Prior art date
Application number
PCT/CN2014/086760
Other languages
English (en)
French (fr)
Inventor
靳康
臧亮
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2015139433A1 publication Critical patent/WO2015139433A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, an apparatus, and a main processor for static IPSec virtual interface load balancing.
  • IPsec is a set of IP security protocols established by the IPsec group of the Internet Engineering Task Force (IETF). IPsec defines the security services used at the Internet layer. Its functions include data encryption and access to network elements. Control, data source address verification, data integrity checking, and protection against replay attacks.
  • IETF Internet Engineering Task Force
  • CP coprocessor
  • the method of dynamically allocating coprocessors for static virtual interfaces can solve the problem of method (1), but different virtual interfaces may have different IPSec traffic sizes, even if the number of static virtual interfaces allocated on each coprocessor is different. The same, can not achieve the purpose of load balancing.
  • the allocation method of the coprocessor is relatively fixed, and the IPSec traffic factor is not considered. Therefore, even if the number of static virtual interfaces allocated to each coprocessor is the same, the load balancing cannot be achieved.
  • the present invention provides a static IPSec virtual interface load balancing method, device, and main processor, which are used to at least solve the related art, even if the number of static virtual interfaces allocated to each coprocessor is the same, load balancing cannot be achieved.
  • the purpose of the problem is not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to the related art, even if the number of static virtual interfaces allocated to each coprocessor is the same, load balancing cannot be achieved. The purpose of the problem.
  • an embodiment of the present invention provides a static IPSec virtual interface load balancing method, which includes: obtaining a traffic size corresponding to a virtual interface; and performing the virtual interface according to the traffic size corresponding to each virtual interface. Assigned to each coprocessor such that the difference in traffic handled by the respective coprocessors is within a preset range.
  • Allocating the virtual interface to each coprocessor according to the traffic size corresponding to the virtual interface includes: setting a weight value of each virtual interface according to the traffic size corresponding to the virtual interface; and sorting each virtual interface according to the weight value, The virtual interface is allocated to each coprocessor according to the sorting result.
  • Allocating the virtual interface to each coprocessor according to the sorting result includes: assigning each of the virtual interfaces to each coprocessor according to a weight value from highest to lowest, wherein each of the allocated virtual interfaces The number is not greater than the number of coprocessors; the weight values corresponding to the virtual interfaces assigned to the respective coprocessors are arranged in ascending order from low to high, and the unassigned virtual interfaces are assigned in descending order of weight values. Up to each of the coprocessors; performing the ascending ordering according to the sum of the weight values corresponding to the virtual interfaces allocated by the respective coprocessors, and continuing to allocate the virtual interfaces according to the sorting result until the virtual interfaces are allocated .
  • the method further includes: when the size of the traffic corresponding to the virtual interface is changed, reconfiguring the weight value of each virtual interface; and performing load balancing according to the reconfigured weight value.
  • Another embodiment of the present invention further provides a static IPSec virtual interface load balancing device, comprising: an obtaining module, configured to obtain a traffic size corresponding to a virtual interface; and a load balancing module, configured to correspond to each virtual interface
  • the traffic size allocates the virtual interface to each coprocessor such that the difference in traffic handled by the respective coprocessors is within a preset range.
  • the load balancing module includes: a configuration unit, configured to set a weight value of each virtual interface according to a traffic size corresponding to the virtual interface; and the load balancing unit is configured to sort each virtual interface according to the weight value, according to the sorting result
  • the virtual interface is assigned to each coprocessor.
  • the load balancing unit includes: an allocation subunit, configured to allocate each of the virtual interfaces to each coprocessor according to a weight value from highest to lowest, wherein the number of allocated virtual interfaces is not greater than coprocessing The number of the devices; the sorting subunits are set to be in ascending order according to the weight values corresponding to the virtual interfaces assigned to the respective coprocessors; the allocation subunits are further configured to follow the virtual interfaces that are not allocated according to The weight values are assigned to each of the coprocessors in descending order, and the sorting subunit is further configured to continue ascending sorting according to the sum of the weight values corresponding to the virtual interfaces to which the respective coprocessors are assigned, and The allocation subunit is triggered to continue to allocate the virtual interface according to the sorting result until the virtual interface is allocated.
  • the configuration unit is further configured to reconfigure the weight value of each virtual interface when the traffic size corresponding to the virtual interface is changed; the load balancing unit is further configured to perform load balancing according to the reconfigured weight value.
  • a further embodiment of the present invention further provides a main processor, comprising: the static IPSec virtual interface load balancing device according to any one of the preceding claims.
  • the coprocessor is allocated according to the virtual interface traffic size, and the virtual interface corresponding to each virtual interface is allocated to each coprocessor, and the load balancing of each coprocessor is controlled by the distribution of the traffic, and the solution is solved.
  • the problem of load balancing cannot be achieved.
  • FIG. 1 is a flowchart of a method for load balancing of a static IPSec virtual interface in an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of an apparatus for load balancing of a static IPSec virtual interface according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a static IPSec virtual interface load balancing module according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of a static IPSec virtual interface load balancing unit according to an embodiment of the present invention
  • FIG. 5 is a flowchart of a method for load balancing of a static IPSec virtual interface in a preferred embodiment of the present invention.
  • the present invention provides a static IPSec virtual interface load balancing method, device, and main The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
  • the embodiment of the invention provides a static IPSec virtual interface load balancing method.
  • the process is as shown in FIG. 1 and includes steps S102 to S104:
  • the main processor can monitor the traffic generated by the virtual interface corresponding to the virtual interface for a certain period of time, and obtain the traffic volume corresponding to each virtual interface in the time range, and obtain the historical traffic of each virtual interface. Get it according to actual needs.
  • the virtual interface is allocated to each coprocessor according to the traffic size corresponding to each virtual interface, so that the difference of the traffic processed by each coprocessor is within a preset range.
  • each virtual interface it is allocated to each coprocessor, so that the traffic handled by each coprocessor is within a controllable range, that is, the difference of the traffic processed by each coprocessor is in advance.
  • the preset range can be set according to the actual situation.
  • the coprocessor is allocated according to the virtual interface traffic size, and the virtual interface corresponding to each virtual interface is allocated to each coprocessor, and the load balancing of each coprocessor is controlled by the distribution of the traffic, and the solution is solved.
  • the problem of load balancing cannot be achieved.
  • the process of assigning a virtual interface to each coprocessor according to the traffic size of each virtual interface may be: setting a traffic-related reference value as the traffic size identifier according to the traffic size, for example, according to the traffic volume corresponding to the virtual interface. Set the weight value of each virtual interface; then sort each virtual interface according to the weight value, and assign the virtual interface to each coprocessor according to the sorting result.
  • each virtual interface is allocated to each coprocessor according to the weight value from high to low, wherein the number of allocated virtual interfaces is not greater than the number of coprocessors;
  • the weight values corresponding to the virtual interfaces are arranged in ascending order from low to high, and the unassigned virtual interfaces are allocated to the respective coprocessors in descending order of weight values; corresponding to the virtual interfaces allocated by the respective coprocessors
  • the sum of the weight values continues to be sorted in ascending order, and the virtual interface continues to be allocated according to the sorting result until the virtual interface is allocated.
  • the above method can also be set in reverse to perform allocation.
  • each virtual interface is allocated to each coprocessor according to the weight value from low to high, and the weight values obtained by each coprocessor are ascending from high to low.
  • the embodiment of the present invention further provides a static IPSec virtual interface load balancing device.
  • the structure of the device is as shown in FIG. 2, and includes: an obtaining module 10, coupled with the load balancing module 20, configured to obtain traffic corresponding to the virtual interface.
  • the load balancing module 20 is configured to allocate the virtual interface to each coprocessor according to the traffic size corresponding to each virtual interface, so that the difference of the traffic processed by each coprocessor is within a preset range.
  • FIG. 3 is a schematic structural diagram of the device load balancing module, and includes: a configuration unit 210 configured to set a weight value of each virtual interface according to a traffic size corresponding to the virtual interface; and the load balancing unit 220 is coupled to the configuration unit 210, and configured to Each virtual interface is sorted according to the weight value, and the virtual interface is allocated to each coprocessor according to the sorting result.
  • FIG. 4 is a schematic structural diagram of the above-described load balancing unit 220.
  • the load balancing unit 220 includes:
  • the allocation subunit 2202 is configured to allocate each virtual interface to each coprocessor according to a weight value from high to low, wherein the number of allocated virtual interfaces is not greater than the number of coprocessors; 2204, coupled to the allocation sub-unit 2202, configured to perform an ascending order according to a weight value corresponding to the virtual interface allocated by each coprocessor from low to high; the allocation sub-unit 2202 is further configured to weight the un-assigned virtual interface according to the weight The values are assigned to the respective coprocessors in descending order; the sorting subunit 2204 is further configured to continue ascending sorting according to the sum of the weight values corresponding to the virtual interfaces to which the respective coprocessors are assigned, and trigger the sorting subunits to be sorted according to As a result, the virtual interface continues to be allocated until the virtual interface is allocated.
  • the configuration unit 210 is further configured to reconfigure the weight values of the virtual interfaces when the traffic size corresponding to the virtual interface changes.
  • the load balancing unit 220 is further configured to perform load balancing according to the reconfigured weight values.
  • the embodiment of the present invention further provides a main processor, where the main processor includes the static IPSec virtual interface load balancing device, and the functional modules included in the corresponding static IPSec virtual interface load balancing device are shown in FIG. 2 and FIG. 3 .
  • the functional modules shown in FIG. 4 are the same and will not be described here.
  • the allocation can be performed only according to the number of links of the IPSec static virtual interface.
  • the embodiment of the invention provides a method for load balancing of a static IPSec virtual interface, which can conveniently solve the above problems.
  • the method configures different weights according to the traffic volume of each static virtual interface, and calculates the sum of link weights on different coprocessors. In this way, load balancing of the IPSec static virtual interface can be implemented.
  • the flow of the embodiment of the present invention is as shown in FIG. 5, and includes steps S501 to S505.
  • the main processor, the coprocessor, the unit processor, etc. communicate through the internal communication network of the device; when the device starts, the main processor acquires related information of the online coprocessor; the main processor processes each coprocessor The sum of the link weights on the device is in ascending order.
  • the main processor is arranged in descending order (high to low) according to the weight of the virtual interface, and sequentially allocates a virtual interface on each coprocessor.
  • step S504. Determine whether there is an unallocated virtual interface. If yes, step S502 is performed until all virtual interfaces are allocated; otherwise, step S505 is performed.
  • the weights of the three virtual interfaces configured in advance are 1, 2, and 3.
  • the number of coprocessors that the main processor acquires online is 2; the virtual interfaces of weights 3 and 2 are respectively assigned to coprocessors 1 and 2; and the coprocessing is sorted in ascending order according to the obtained weight values. (ie coprocessors 2 and 1), leaving the weight 1 virtual interface assigned to the previous coprocessor 2.
  • the weights of four virtual interfaces configured in advance are 1, 2, 3, and 4.
  • the number of coprocessors that the main processor acquires online is 2; the virtual interfaces of weights 4 and 3 are respectively assigned to coprocessors 1 and 2; and the co-processing is arranged in ascending order according to the obtained weight values.
  • the coprocessors 2 and 1 are left, and the virtual interfaces with the remaining weights 1 and 2 are assigned to coprocessors 2 and 1, respectively.
  • the weights of the five virtual interfaces configured in advance are 1, 2, 4, 5, and 6, respectively.
  • the number of coprocessors that the main processor acquires online is 2; the virtual interfaces of weights 6 and 5 are respectively assigned to coprocessors 1 and 2; the coprocessors (ie, coprocessors are arranged in ascending order) 2 and 1); arrange the remaining virtual interfaces in descending order (ie, virtual interface weights 4, 2, 1); assign virtual interfaces of weights 4 and 2 to co-processing 2 and 1, the weights after the assignment are: the sum of the coprocessor 2 weights is 9, the sum of the coprocessor 1 weights is 8; the coprocessors (ie coprocessors 1 and 2) are arranged in ascending order; the remaining weights are The virtual interface of 1 is assigned to coprocessor 1.
  • the embodiment of the present invention allocates the coprocessor according to the virtual interface traffic size, and The traffic corresponding to each virtual interface allocates a virtual interface to each coprocessor, and controls the load balancing of each coprocessor through the allocation of traffic, and solves the related art, even if the number of static virtual interfaces allocated on each coprocessor is The same, can not achieve the purpose of load balancing purposes.

Abstract

本发明公开了一种静态IPSec虚接口负载均衡的方法、装置及主处理器，其中，该方法包括：获取虚接口对应的流量大小；根据各个虚接口对应的流量大小将虚接口分配至各个协处理器，以使得各个协处理器处理的流量的差别在预设范围内。本发明根据虚接口流量大小来进行协处理器的分配，将各个虚接口对应的流量将虚接口分配至各个协处理器，通过流量的分配来控制各个协处理器的负载均衡，解决了相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题。

Description

静态IPSec虚接口负载均衡的方法、装置及主处理器 技术领域
本发明涉及通讯领域，特别是涉及一种静态IPSec虚接口负载均衡的方法、装置及主处理器。
背景技术
IPsec是IETF(Internet Engineering Task Force，简称为Internet工程任务组)的IPsec小组建立的一组IP安全协议集，IPsec定义了在网际层使用的安全服务，其功能包括数据加密、对网络单元的访问控制、数据源地址验证、数据完整性检查和防止重放攻击。
由于IPSec处理流程复杂，实时要求性高，对设备处理能力提出较高的要求。单个主处理器(main processor，简称为MP)的处理能力有限，而且设备通常不仅仅处理IPSec报文，还需要承担其他功能，因此严重影响了IPSec报文的处理能力。为解决该问题，可以用增加协处理器(coprocessor，简称为CP),替代主处理器的专门进行IPSec报文处理，同时，协处理器可以存在多个，这样，就大大提高了设备的IPSec报文处理能力。当存在多个协处理器时，如何使多个协处理器上的负载均衡，以充分发挥多处理器的优势？相关技术中通常有以下做法：
(1)为每一个静态虚接口指定一个协处理器。该实现方法简单，但是如果某个协处理器不处于工作状态，则配置在该协处理器上的虚接口无法工作；
(2)为静态虚接口采用动态分配协处理器的方法，可以解决方法(1)的问题，但是不同的虚接口可能IPSec流量大小不同，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的。
相关技术中，协处理器的分配方法较为固定，且没有考虑到IPSec流量因素，因此，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的。
发明内容
本发明提供了一种静态IPSec虚接口负载均衡的方法、装置及主处理器，用以至少解决相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题。
为解决上述技术问题，本发明的一个实施例提供了一种静态IPSec虚接口负载均衡的方法，包括：获取虚接口对应的流量大小；根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器，以使得所述各个协处理器处理的流量的差别在预设范围内。
根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器包括：根据虚接口对应的流量大小设置各个虚接口的权重值；根据所述权重值将各个虚接口进行排序，根据所述排序结果将所述虚接口分配至各个协处理器。
根据所述排序结果将所述虚接口分配至各个协处理器包括：将各个所述虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列，再将未进行分配的虚接口按照权重值由高到低的顺序分配至各个所述协处理器；根据各个所述协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并根据排序结果继续分配所述虚接口，直至所述虚接口被分配完。
所述方法还包括：当所述虚接口对应的流量大小改变时，重新配置所述各个虚接口的权重值；根据重新配置的权重值进行负载均衡。
本发明的另一实施例还提供了一种静态IPSec虚接口负载均衡的装置，包括：获取模块，设置为获取虚接口对应的流量大小；负载均衡模块，设置为根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器，以使得所述各个协处理器处理的流量的差别在预设范围内。
所述负载均衡模块包括：配置单元，设置为根据虚接口对应的流量大小设置各个虚接口的权重值；负载均衡单元，设置为根据所述权重值将各个虚接口进行排序，根据所述排序结果将所述虚接口分配至各个协处理器。
所述负载均衡单元包括：分配子单元，设置为将各个所述虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；排序子单元，设置为根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列；所述分配子单元，还设置为将未进行分配的虚接口按照权重值由高到低的顺序分配至各个所述协处理器；所述排序子单元，还设置为根据各个所述协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并触发所述分配子单元根据排序结果继续分配所述虚接口，直至所述虚接口被分配完。
所述配置单元，还设置为当所述虚接口对应的流量大小改变时，重新配置所述各个虚接口的权重值；所述负载均衡单元，还设置为根据重新配置的权重值进行负载均衡。
本发明的再一实施例还提供了一种主处理器，包括：上述任一项所述的静态IPSec虚接口负载均衡的装置。
本发明实施例根据虚接口流量大小来进行协处理器的分配，将各个虚接口对应的流量将虚接口分配至各个协处理器，通过流量的分配来控制各个协处理器的负载均衡，解决了相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题。
附图说明
图1是本发明实施例中静态IPSec虚接口负载均衡的方法的流程图；
图2是本发明实施例中静态IPSec虚接口负载均衡的装置的结构示意图；
图3是本发明实施例中静态IPSec虚接口负载均衡模块的结构示意图；
图4是本发明实施例中静态IPSec虚接口负载均衡单元的结构示意图；
图5是本发明优选实施例中静态IPSec虚接口负载均衡的方法的流程图。
具体实施方式
为了解决相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题，本发明提供了一种静态IPSec虚接口负载均衡的方法、装置及主处理器，以下结合附图以及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不限定本发明。
本发明实施例提供了一种静态IPSec虚接口负载均衡的方法，其流程如图1所示，包括步骤S102至步骤S104：
S102，获取虚接口对应的流量大小。
主处理器可以对某一段时间的虚接口对应链路产生的流量大小进行监测，然后获取得到该时间段各个虚接口对应的流量大小，也可以获取各个虚接口的历史流量，本领域技术人员可以根据实际需求进行获取。
S104，根据各个虚接口对应的流量大小将虚接口分配至各个协处理器，以使得各个协处理器处理的流量的差别在预设范围内。
实现过程中，按照各个虚接口的流量大小，将其分配到各个协处理器上，使各个协处理器处理的流量在一个可控的范围内，即各个协处理器处理的流量的差别在预设范围内，该预设范围可以根据实际情况进行设定。
本发明实施例根据虚接口流量大小来进行协处理器的分配，将各个虚接口对应的流量将虚接口分配至各个协处理器，通过流量的分配来控制各个协处理器的负载均衡，解决了相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题。
根据各个虚接口对应的流量大小将虚接口分配至各个协处理器的过程可以是：根据流量大小设置一些与流量相关的参考值来作为流量大小的标识，例如，可以根据虚接口对应的流量大小设置各个虚接口的权重值；再根据权重值将各个虚接口进行排序，根据排序结果将虚接口分配至各个协处理器。
实现时，将各个虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列，再将未进行分配的虚接口按照权重值由高到低的顺序分配至各个协处理器；根据各个协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并根据排序结果继续分配虚接口，直至虚接口被分配完。上述方法也可以反向设置来进行分配，例如，将各个虚接口按照权重值由低到高的顺序分配到各个协处理器上，根据各个协处理器已得到的权重值由高到低进行升序排列，再将未进行分配的虚接口按照权重值由低到高的顺序分配至各个协处理器，根据各个协处理器得到的权重值继续进行降序排序，并根据排序结果继续分配虚接口，直至虚接口被分配完。
如果虚接口对应的流量大小改变时，可以重新配置各个虚接口的权重值；在根据重新配置的权重值重新进行负载均衡。
本发明实施例还提供了一种静态IPSec虚接口负载均衡的装置，该装置的结构示意如图2所示，包括：获取模块10，与负载均衡模块20耦合，设置为获取虚接口对应的流量大小；负载均衡模块20，设置为根据各个虚接口对应的流量大小将虚接口分配至各个协处理器，以使得各个协处理器处理的流量的差别在预设范围内。
图3示出了上述装置负载均衡模块的结构示意图，包括：配置单元210，设置为根据虚接口对应的流量大小设置各个虚接口的权重值；负载均衡单元220，与配置单元210耦合，设置为根据权重值将各个虚接口进行排序，根据排序结果将虚接口分配至各个协处理器。
图4示出了上述负载均衡单元220的结构示意图，负载均衡单元220包括：
分配子单元2202，设置为将各个虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；排序子单元2204，与分配子单元2202耦合，设置为根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列；分配子单元2202，还设置为将未进行分配的虚接口按照权重值由高到低的顺序分配至各个协处理器；排序子单元2204，还设置为根据各个协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并触发分配子单元根据排序结果继续分配虚接口，直至虚接口被分配完。
实施过程中，配置单元210，还设置为当虚接口对应的流量大小改变时，重新配置各个虚接口的权重值；负载均衡单元220，还设置为根据重新配置的权重值进行负载均衡。
本发明实施例还提供了一种主处理器，该主处理器包括上述的静态IPSec虚接口负载均衡的装置，对应的静态IPSec虚接口负载均衡的装置所包括的功能模块与图2、图3或图4示出的功能模块相同，此处不进行赘述。
优选实施例
相关技术中，仅能单纯根据IPSec静态虚接口的链路条数来进行分配。本发明实施例提供了一种静态IPSec虚接口负载均衡的方法，可以方便的解决以上问题。该方法根据每个静态虚接口的流量大小，配置不同的权重，计算不同协处理器上的链路权重之和。这样，可以较好的实现IPSec静态虚接口的负载均衡。
本发明实施例的流程如图5所示，包括步骤S501至步骤S505。
S501，配置各静态虚接口的权重。
在设备中增加对于每个IPSec静态虚接口的权重配置功能，当改变某个IPSec静态虚接口的权重配置时，触发负载均衡的动态调整，来保证每个协处理器上的虚接口权重之和相等或者接近。
S502，将各协处理器上链路权重之和按升序(由低到高)排列。
实现过程中，主处理器、协处理器、单元处理器等通过设备的内部通信网络进行通信；当设备启动时，主处理器获取在线的协处理器的相关信息；主处理器对各协处理器上链路权重之和按升序排列。
S503，主处理器根据虚接口权重按降序(由高到低)排列，并依次将虚接口在各协处理器上分配一条。
S504，判断是否存在未分配的虚接口。如果是，则执行步骤S502，直至所有虚接口分配完毕；否则执行步骤S505。
S505，流程结束。
下面结合具体实例来对上述方法进行说明。
实例一
事先配置3条虚接口的权重分别是1，2，3。
当设备启动时，主处理器获取在线的协处理器的个数为2；先将权重3和2的虚接口分别分配给协处理器1和2；根据已得到的权重值按升序排列协处理器(即协处理器2和1)，剩下权重1虚接口分配给前面的协处理器2。
实例二
事先配置4条虚接口的权重分别是1，2，3，4。
当设备启动时，主处理器获取在线的协处理器的个数为2；先将权重4和3的虚接口分别分配给协处理器1和2；根据已得到的权重值按升序排列协处理器(即协处理器2和1)，剩下权重1和2的虚接口依次分配给协处理器2和1。
实例三
事先配置5条虚接口的权重分别是1，2，4，5，6。
当设备启动时，主处理器获取在线的协处理器的个数为2；先将权重6和5的虚接口分别分配给协处理器1和2；按升序排列协处理器(即协处理器2和1)；按降序排列剩余虚接口(即虚接口权重4，2，1)；将权重4和2的虚接口依次分配给协处理 器2和1，分配后权重为：协处理器2权重之和为9，协处理器1权重之和为8；按升序排列协处理器(即协处理器1和2)；将剩余权重为1的虚接口分配给协处理器1。
尽管为示例目的，已经公开了本发明的优选实施例，本领域的技术人员将意识到各种改进、增加和取代也是可能的，因此，本发明的范围应当不限于上述实施例。
工业实用性
如上所述，本发明实施例提供的一种静态IPSec虚接口负载均衡的方法、装置及主处理器，具有以下有益效果：本发明实施例根据虚接口流量大小来进行协处理器的分配，将各个虚接口对应的流量将虚接口分配至各个协处理器，通过流量的分配来控制各个协处理器的负载均衡，解决了相关技术中，即使分配在每个协处理器上的静态虚接口数量相同，也不能达到负载均衡的目的的问题。

Claims (9)

  1. 一种静态IP安全协议集IPSec虚接口负载均衡的方法，包括：
    获取虚接口对应的流量大小；
    根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器，以使得所述各个协处理器处理的流量的差别在预设范围内。
  2. 如权利要求1所述的方法，其中，根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器包括：
    根据虚接口对应的流量大小设置各个虚接口的权重值；
    根据所述权重值将各个虚接口进行排序，根据所述排序结果将所述虚接口分配至各个协处理器。
  3. 如权利要求2所述的方法，其中，根据所述排序结果将所述虚接口分配至各个协处理器包括：
    将各个所述虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；
    根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列，再将未进行分配的虚接口按照权重值由高到低的顺序分配至各个所述协处理器；
    根据各个所述协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并根据排序结果继续分配所述虚接口，直至所述虚接口被分配完。
  4. 如权利要求2或3所述的方法，其中，所述方法还包括：
    当所述虚接口对应的流量大小改变时，重新配置所述各个虚接口的权重值；
    根据重新配置的权重值进行负载均衡。
  5. 一种静态IP安全协议集IPSec虚接口负载均衡的装置，包括：
    获取模块，设置为获取虚接口对应的流量大小；
    负载均衡模块，设置为根据各个所述虚接口对应的流量大小将所述虚接口分配至各个协处理器，以使得所述各个协处理器处理的流量的差别在预设范围内。
  6. 如权利要求5所述的装置，其中，所述负载均衡模块包括：
    配置单元，设置为根据虚接口对应的流量大小设置各个虚接口的权重值；
    负载均衡单元，设置为根据所述权重值将各个虚接口进行排序，根据所述排序结果将所述虚接口分配至各个协处理器。
  7. 如权利要求6所述的装置，其中，所述负载均衡单元还包括：
    分配子单元，设置为将各个所述虚接口按照权重值由高到低的顺序分配到各个协处理器上，其中，被分配的虚接口的个数不大于协处理器的个数；
    排序子单元，设置为根据各个协处理器被分配的虚接口对应的权重值由低到高进行升序排列；
    所述分配子单元，还设置为将未进行分配的虚接口按照权重值由高到低的顺序分配至各个所述协处理器；
    所述排序子单元，还设置为根据各个所述协处理器被分配的虚接口对应的权重值之和继续进行升序排序，并触发所述分配子单元根据排序结果继续分配所述虚接口，直至所述虚接口被分配完。
  8. 如权利要求6或7所述的装置，其中，
    所述配置单元，还设置为当所述虚接口对应的流量大小改变时，重新配置所述各个虚接口的权重值；
    所述负载均衡单元，还设置为根据重新配置的权重值进行负载均衡。
  9. 一种主处理器，包括：权利要求5至8中任一项所述的静态IPSec虚接口负载均衡的装置。
PCT/CN2014/086760 2014-03-19 2014-09-17 静态IPSec虚接口负载均衡的方法、装置及主处理器 WO2015139433A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410101866.1 2014-03-19
CN201410101866.1A CN104935522B (zh) 2014-03-19 2014-03-19 静态IPSec虚接口负载均衡的方法、装置及主处理器

Publications (1)

Publication Number Publication Date
WO2015139433A1 true WO2015139433A1 (zh) 2015-09-24

Family

ID=54122496

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/086760 WO2015139433A1 (zh) 2014-03-19 2014-09-17 静态IPSec虚接口负载均衡的方法、装置及主处理器

Country Status (2)

Country Link
CN (1) CN104935522B (zh)
WO (1) WO2015139433A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107547508B (zh) * 2017-06-29 2021-07-30 新华三信息安全技术有限公司 一种报文发送、接收方法、装置及网络设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040153866A1 (en) * 2002-11-15 2004-08-05 Microsoft Corporation Markov model of availability for clustered systems
CN1979423A (zh) * 2005-11-30 2007-06-13 迈普（四川）通信技术有限公司 多处理器负载分配调整方法
CN101335709A (zh) * 2008-08-07 2008-12-31 杭州华三通信技术有限公司 在流量分析服务器之间实现负载分担的方法和分流设备
CN101668005A (zh) * 2009-09-25 2010-03-10 东南大学 一种基于发送端多接入通道的数据传输加速引擎方法
CN103139065A (zh) * 2011-11-22 2013-06-05 上海博腾信息科技有限公司 一种基于Ipsec的数据连接方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101098305B (zh) * 2007-03-28 2010-06-16 秦勇 一种宽带网络接入及流量管理调度系统
CN101184049B (zh) * 2007-12-12 2010-06-16 中兴通讯股份有限公司 一种动态负荷分担方法及系统
CN102868629B (zh) * 2012-08-30 2016-01-06 汉柏科技有限公司 利用ipsec实现负载分担的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040153866A1 (en) * 2002-11-15 2004-08-05 Microsoft Corporation Markov model of availability for clustered systems
CN1979423A (zh) * 2005-11-30 2007-06-13 迈普（四川）通信技术有限公司 多处理器负载分配调整方法
CN101335709A (zh) * 2008-08-07 2008-12-31 杭州华三通信技术有限公司 在流量分析服务器之间实现负载分担的方法和分流设备
CN101668005A (zh) * 2009-09-25 2010-03-10 东南大学 一种基于发送端多接入通道的数据传输加速引擎方法
CN103139065A (zh) * 2011-11-22 2013-06-05 上海博腾信息科技有限公司 一种基于Ipsec的数据连接方法

Also Published As

Publication number Publication date
CN104935522A (zh) 2015-09-23
CN104935522B (zh) 2019-08-27

Similar Documents

Publication Publication Date Title
US9967188B2 (en) Network traffic flow management using machine learning
CA2943250C (en) Method and system for ensuring an application conforms with security and regulatory controls prior to deployment
US9986061B2 (en) Programming a data network device using user defined scripts
EP3138263B1 (en) Method and system for providing reference architecture pattern-based permissions management
US10924298B2 (en) Network service chain construction
US9934057B2 (en) Shadow VNICs for the control and observability of IO virtual functions
CN105939279B (zh) 流量处理方法和装置
JP2016535337A5 (zh)
US20180062908A1 (en) Allocation of virtual interfaces to containers
CN104853001A (zh) 一种arp报文的处理方法和设备
EP2887602A1 (en) Session level mitigation of service disrupting attacks
TWI520002B (zh) Protection Method and System of Cloud Virtual Network Security
WO2015131612A1 (zh) 网络地址转换nat资源的分配方法及装置
CN105391634A (zh) 一种报文处理方法、装置及交换机
CN105245365B (zh) 一种虚拟网络的参数配置方法、设备和系统
WO2015139433A1 (zh) 静态IPSec虚接口负载均衡的方法、装置及主处理器
EP3087709A1 (en) Methods and apparatus for load balancing in a network
Vrijders et al. Reducing the complexity of virtual machine networking
JP6243859B2 (ja) フロー制御システムおよびフロー制御方法
JP2016162266A (ja) 通信装置及びそのプロセッサ割当方法
TW201517564A (zh) 傳輸路徑按需提供系統及方法
WO2016045394A1 (zh) 内部地址分配方法、装置、服务器及系统
JP6153903B2 (ja) サービスチェイニングシステム、サービスチェイニングポリシ制御装置、及びサービスチェイニング方法
CN105530192B (zh) 一种多协处理器负载均衡的方法、装置及主处理器
CN103220227B (zh) Ezvpn的QoS实现方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14885989

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14885989

Country of ref document: EP

Kind code of ref document: A1