WO2016082412A1 - 实现数据可靠传输的方法、装置及计算机存储介质 - Google Patents

实现数据可靠传输的方法、装置及计算机存储介质 Download PDF

Info

Publication number
WO2016082412A1
WO2016082412A1 PCT/CN2015/075843 CN2015075843W WO2016082412A1 WO 2016082412 A1 WO2016082412 A1 WO 2016082412A1 CN 2015075843 W CN2015075843 W CN 2015075843W WO 2016082412 A1 WO2016082412 A1 WO 2016082412A1
Authority
WO
WIPO (PCT)
Prior art keywords
tunnel
standby
primary
established
base station
Prior art date
Application number
PCT/CN2015/075843
Other languages
English (en)
French (fr)
Inventor
梁琳
杨智奇
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016082412A1 publication Critical patent/WO2016082412A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition

Definitions

  • the invention relates to a network security transmission channel technology in the field of mobile communication, in particular to a method, a related device and a computer storage medium for realizing reliable transmission of control/service data by a base station.
  • LTE Long Term Evolved
  • the embodiments of the present invention are directed to a method, a device, and a computer storage medium for realizing reliable transmission of control/service data by a base station, and seamlessly switching between base stations in a communication process can be realized without deploying multiple sets of redundant devices.
  • an embodiment of the present invention provides a method for a base station to implement reliable transmission of control/service data, where the method includes:
  • a standby tunnel with a normal state is started, and the control/service data is transmitted by using the activated standby tunnel.
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the tunnel information of the standby tunnel is deleted, and the standby tunnel is attempted to be established.
  • the method further includes:
  • the established tunnel is kept live, so that two or more tunnels remain established.
  • the embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores a computer program for performing the above-mentioned base station implementation control/service data reliable transmission method.
  • an embodiment of the present invention provides a device for implementing reliable transmission of control/service data by a base station, where the device includes:
  • a tunnel establishment module is configured to establish a tunnel between the base station and at least two security gateways, and use one tunnel as the primary tunnel and the other tunnel as the standby tunnel;
  • a fault detection module configured to perform fault detection on the primary tunnel
  • a tunnel switching module configured to start a failure when detecting that the primary tunnel fails A standby tunnel in a normal state, and uses the activated standby tunnel to transmit control/service data.
  • the tunnel establishment module is further configured to: set a priority for the established tunnel, and use the tunnel with the highest priority as the primary tunnel and the other tunnels as the standby tunnel.
  • the tunnel establishment module is further configured to attempt to establish the primary tunnel, and after the primary tunnel is established And the tunnel switching module transmits the control/service data by using the established primary tunnel.
  • the fault detection module is further configured to perform fault detection on the standby tunnel, and if it is detected that the standby tunnel fails, the tunnel switching module deletes tunnel information of the standby tunnel, and the tunnel is The setup module attempts to establish the alternate tunnel.
  • the device further comprises:
  • the tunnel keep-alive module is configured to keep the established tunnels in accordance with a predetermined keep-alive policy, so that two or more tunnels remain established.
  • the secure transmission redundancy technology implemented on the radio base station side does not need to deploy multiple sets of redundant devices. Specifically, from the perspective of the base station side, seamless handover without dropped calls can be realized; from the perspective of the transmission group network, not only redundancy can be realized. And the load balancing of transmission devices such as remote/same security gateways can be realized, and the maximum load balancing of the transmission equipment can be realized by the configuration of the base station without changing the configuration of the transmission device such as the security gateway, and the operation is simple and easy. maintain.
  • FIG. 1 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a first embodiment of the present invention
  • FIG. 2 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a second embodiment of the present invention
  • FIG. 3 is a schematic diagram of a base station implementing reliable transmission of control/service data according to a third embodiment of the present invention. Method flow chart;
  • FIG. 4 is a schematic structural diagram of a base station implementing control/service data reliable transmission according to a fourth embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a fifth embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a device for implementing reliable transmission of control/service data by a base station according to a sixth embodiment of the present invention.
  • FIG. 7 is a network diagram of transmission security redundancy according to a sixth embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a first embodiment of the present invention. As shown in FIG. 1 , the method mainly includes the following steps:
  • Step S101 Establish a tunnel between the base station and at least two security gateways, and use one tunnel as the primary tunnel and the other tunnels as the standby tunnel.
  • the base station may set a priority for the established tunnel, and use the tunnel with the highest priority as the primary tunnel and the other tunnels as the standby tunnel.
  • the base station preferentially uses its own active line.
  • the base station 1 uses the tunnel 11 between the base station 1 and its associated security gateway 1 as the primary tunnel for data communication, and the primary tunnel can be set as the highest priority tunnel;
  • the base station 2 performs data communication between the base station 2 and the tunnel 22 between the base station 2 and the security gateway 2 as the primary tunnel, and the primary tunnel can be set to the highest priority;
  • the base station 1 uses the tunnel 12 between the base tunnel 1 and the security gateway 2 as a backup tunnel.
  • the standby tunnel 12 can be started to transmit control/service data; the base station 2 uses the tunnel 21 between it and the security gateway 1 as a backup tunnel, and when the base station 2 detects the primary tunnel 22 In the event of a failure, the standby tunnel 21 can be started to transmit control/data services.
  • base station 1 can be more Other security gateways similar to the security gateway 2 establish a tunnel, and the base station 2 can also establish tunnels with a plurality of other security gateways similar to the security gateway 1.
  • Step S102 Perform fault detection on the primary tunnel.
  • Step S103 If it is detected that the primary tunnel fails, start a standby tunnel with normal status, and use the activated standby tunnel to transmit control/service data.
  • the base station may detect that the primary tunnel is faulty, and enable the tunnel with the highest priority among the standby tunnels with the normal state. In other words, the base station switches the highest priority tunnel to the second highest priority tunnel with the normal state.
  • the invention can ensure that the base station automatically switches the control/data service to the standby tunnel when the primary tunnel fails during the communication process, and switches back the control/data service to the active tunnel when the primary tunnel fails.
  • This method of establishing a secure tunnel and switching is also applicable to other devices that support the establishment of a secure tunnel on the network.
  • FIG. 2 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a second embodiment of the present invention. As shown in FIG. 2, compared with the first embodiment shown in FIG. 1, the embodiment further includes the following steps:
  • Step 104 Try to establish an active tunnel during the startup of a normal standby tunnel and use the activated standby tunnel to transmit control/service data, and use the established primary tunnel transmission control after the primary tunnel is established. /Business data.
  • control/service data is transmitted using the recovered primary tunnel.
  • the base station uses an automatic trigger mechanism to periodically establish the primary tunnel.
  • the base station can guarantee to use the highest priority tunnel transmission control/data service whenever possible.
  • FIG. 3 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a third embodiment of the present invention. As shown in FIG. 3, the method mainly includes the following steps:
  • Step S201 Establish a tunnel between the base station and at least two security gateways, and use one tunnel as the primary tunnel and the other tunnels as the standby tunnel.
  • the base station may set a priority for the established tunnel, and use the tunnel with the highest priority as the primary tunnel and the other tunnels as the standby tunnel.
  • Step S202 Perform fault detection on the standby tunnel.
  • Step S203 If it is detected that the standby tunnel fails, delete the tunnel information of the standby tunnel and try to establish the standby tunnel.
  • the base station uses an automatic trigger mechanism to periodically attempt to establish the alternate tunnel and tunnel information for seamless handover.
  • the device includes a tunnel establishment module 10, a fault detection module 20, and a tunnel switching module 30. ;among them,
  • the tunnel establishment module 10 is configured to establish a tunnel between the base station and at least two security gateways, and use one tunnel as the primary tunnel and the other tunnels as the standby tunnel.
  • the fault detection module 20 is configured to perform fault detection on the primary tunnel
  • the tunnel switching module 30 is configured to start a standby tunnel with a normal state when detecting that the primary tunnel fails, and transmit control/service data by using the activated standby tunnel.
  • the tunnel establishment module 10 is further configured to: set a priority for the established tunnel, and use the tunnel with the highest priority as the primary tunnel and the other tunnels as the standby tunnel.
  • the tunnel switching module 30 When the fault detecting module 20 detects that the primary tunnel fails, the tunnel switching module 30 starts a standby tunnel with a normal state, and transmits control/service data by using the activated standby tunnel; During the standby tunnel and utilizing the initiated alternate tunnel to transmit control/service data, the tunnel establishment module 10 is further configured to attempt to establish the primary tunnel And after the primary tunnel is established, the tunnel switching module 30 transmits the control/service data by using the established primary tunnel; the fault detecting module 20 is further configured to perform fault detection on the standby tunnel.
  • the tunnel switching module 30 deletes the tunnel information of the standby tunnel, and the tunnel establishment module 10 attempts to establish the standby tunnel, so that after the standby tunnel fault is eliminated, After the standby tunnel and tunnel information is re-established, the standby tunnel can be seamlessly switched.
  • the apparatus for implementing reliable transmission of control/service data by the base station may be applied to the communication field; the tunnel establishment module 10, the fault detection module 20, and the tunnel switching module 30 may implement control/service data by the base station or the base station.
  • the device that is reliably transmitted is implemented by a central processing unit (CPU), a digital signal processor (DSP), or a Field Programmable Gate Array (FPGA).
  • FIG. 5 is a flowchart of a method for implementing reliable transmission of control/service data by a base station according to a fifth embodiment of the present invention. As shown in FIG. 5, the method mainly includes the following steps:
  • Step S301 A tunnel is established between the base station and at least two security gateways, and one tunnel is used as the primary tunnel, and the other tunnels are used as the standby tunnel.
  • Step S302 Perform keep-alive processing on the established tunnel according to the predetermined keep-alive policy, so that two or more tunnels remain established.
  • a regular or irregular maintenance policy is required to protect two or more tunnels from being established.
  • the tunnel is abnormally discovered and the tunnel is re-triggered in time.
  • FIG. 6 is a schematic structural diagram of a device for implementing reliable transmission of control/service data by a base station according to a sixth embodiment of the present invention.
  • the tunnel keep-alive module is added in this embodiment. 40.
  • the tunnel keep-alive module 40 is configured to perform a keep-alive process on the established tunnel according to a predetermined keep-alive policy after the tunnel is established, so that two or more tunnels are maintained. State to ensure seamless switching.
  • the tunnel keep-alive module 40 can be implemented by a CPU, a DSP, or an FPGA in a terminal to which the device or the base station implements control/service data reliable transmission.
  • the embodiment of the present invention further describes a computer storage medium, wherein the computer storage medium stores a computer program for executing the base station shown in FIG. 1, FIG. 2, FIG. 3, and FIG. 5 in the embodiment of the present invention.
  • a method of achieving reliable transmission of control/business data is described in FIG. 1, FIG. 2, FIG. 3, and FIG. 5 in the embodiment of the present invention.
  • FIG. 7 is a network diagram of a transmission security redundancy according to a sixth embodiment of the present invention.
  • the tunnel established in this embodiment is a security tunnel, which is hereinafter referred to as a security tunnel.
  • IPSec IP Security
  • the security tunnel provided in this embodiment is based on the framework agreement established by the Internet Engineering Task Force (IETF) to ensure the security and confidentiality of data transmitted over the Internet.
  • the Key Exchange Protocol (IKE Internet Key Exchange) dynamically negotiates the protocol of the Security Association (SA), that is, negotiates the IPSec tunnel information.
  • SA Security Association
  • the transmission security redundancy networking mode is as follows:
  • the redundant IPSec tunnel implemented by the base station side is established in the same place or in the same place.
  • the base station 1 preferentially uses its own primary line
  • the base station 2 preferentially uses its own primary line.
  • the networking of the embodiment can satisfy the redundant networking of the line of the base station 1 switching to the line on the SeGw2 of the B when the security gateway SeGw1 fails, and can satisfy the normal use of both SeGw1 and SeGw2.
  • Load balancing networking This networking scenario can also be applied to different carriers to achieve the purpose of jointly using the same base station for service forwarding and jointly managed base stations.
  • the redundant security tunnel establishment mode is as follows: To achieve seamless handover, it takes time to establish an IPSec tunnel. If an IPSec tunnel establishment is established when a link is broken, a short-lived link may occur. In this embodiment, an IPSec tunnel is established with two or more security gateways SeGw (the same security policy is used for two/multiple tunnels), and a regular or irregular maintenance policy is implemented to protect the base station. Two/multiple tunnels have been The state is established, and the tunnel state is monitored. If the tunnel is abnormal, the tunnel establishment is re-triggered in time to ensure seamless handover.
  • SeGw security gateways
  • the redundant secure tunnel switching mode is specifically as follows.
  • the base station side has already implemented a method of encrypting and decrypting using hardware.
  • this embodiment implements a redundant tunnel switching mode to ensure high-speed forwarding rate after seamless handover. The specific steps are as follows:
  • Step 1 The two security gateways of the base station and the remote site are networked according to FIG. 1;
  • Step 2 The base station and the two remote security gateways (which may be in the same place or one different place in the same place) respectively establish two IPSec tunnels, which are respectively primary and standby tunnels;
  • Step 3 Keep the two active and standby tunnels in step 2 in a keep alive, using a regular or irregular life-saving strategy
  • Step 4 If the backup tunnel in step 2 fails, the base station uses the automatic trigger mechanism to periodically establish an IPSec tunnel. The purpose is to implement seamless handover of the IPSec tunnel.
  • Step 5 If the primary tunnel fails, the automatic detection mechanism and trigger mechanism of the base station automatically switch to the available standby tunnel, and the detection mechanism may use, for example, Bidirectional Forwarding Detection (BFD) or Digital Pre-Distortion (Digital Pre-Distortion, DPD) and other methods.
  • BFD Bidirectional Forwarding Detection
  • DPD Digital Pre-Distortion
  • Step 6 After the primary tunnel fails, the base station switches the control/data service from the standby tunnel back to the active tunnel according to the detection mechanism and the trigger mechanism to ensure that the base station performs best under the primary tunnel.
  • the mobile communication BSS system is taken as an example to further illustrate a specific implementation manner of establishing and switching redundant redundant tunnels in the present invention to ensure reliable transmission of control/service data.
  • the BSS is an abbreviation of the Base Station Subsystem, and is called a base station subsystem, which is also called a base station device.
  • IPSec tunnel management On the base station side, software management implements IPSec tunnel management, tunneling, update, and deletion.
  • the synchronization of the information to the hardware enables the hardware to implement high-speed forwarding of the message for the tunnel information.
  • multiple IPSec tunnel information is established by the software module, but only the highest priority IPSec tunnel encryption direction information is synchronized to the hardware, and the remaining decryption direction information is all synchronized to the hardware.
  • the purpose of this is to use the highest priority tunnel for high-speed forwarding.
  • the second is to ensure that if there are other incoming packets that do not come and switch from the core network side during the handover, the data service can also be guaranteed. Normal forwarding.
  • the tunnel detection mode used in this embodiment has two detection modes: DPD and BFD. Both methods have advantages and disadvantages, and are only available for users to use.
  • the detection is performed by using the DPD method.
  • the period is long, the chain-break warning is not timely, and the flashing may occur when the channel is switched.
  • the DPD mode is supported by default in the current IKEv1 and IKEv2 protocols. can.
  • the BFD method is used for detection, the period is short, the detection time is generally in the millisecond (ms) level, the chain-break alarm is timely, and the possibility of channel disconnection during handover is greatly reduced; however, the BFD function is a separate protocol function. You need to support the BFD function on the device that supports the transmission security protocol. The device requirements are high and may not be sufficient for all application scenarios.
  • the switching mode of this embodiment is based on the establishment of a redundant security tunnel.
  • the switching mode of this embodiment includes the following two types, one is high cut low, and the other is low cut high.
  • High-cut-low mode If the DPD/BFD function detects that there is a tunnel disconnection, if the high-priority IPSec tunnel is faulty, you need to switch to the next-highest-priority IPSec tunnel. In this case, the software needs to give the next highest priority.
  • the IPSec tunnel information is synchronized to the hardware. The software deletes the high-priority tunnels maintained by the software and deletes the high-priority tunnel information saved in the hardware. If the IPSec tunnel is faulty, the software directly deletes the low-priority IPSec tunnel information. .
  • the base station has a timing mechanism to try to establish the faulty IPSec tunnel information, so that the tunnel is ready to be backed up in time after the tunnel fault is recovered.
  • Low-cut-high mode If the DPD/BFD function detects that an IPSec tunnel is restored and the priority is higher than the current tunnel priority, the software synchronizes the recovered high-priority IPSec tunnel information to the hardware. The sub-priority IPSec tunnel is replaced to restore the service to the active tunnel.
  • a tunnel is established between a base station and at least two security gateways, and one tunnel is used as a primary tunnel, and other tunnels are used as backup tunnels; fault detection is performed on the primary tunnel; if the primary is detected In the event of a tunnel failure, a normal standby tunnel is started and the control/service data is transmitted using the activated standby tunnel.
  • seamless handover without dropped calls can be realized.
  • the transmission group network not only redundancy but also load balancing of transmission devices such as remote/same security gateways can be realized, through the base station. Configuration, to achieve the maximum load balancing of the transmission device, without changing the configuration of the transmission device such as the security gateway, easy to operate, easy to maintain.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种基站实现控制/业务数据可靠传输的方法、装置、及计算机存储介质，其中，所述方法包括：在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；对所述主用隧道进行故障检测；若检测到所述主用隧道发生故障，则启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。

Description

实现数据可靠传输的方法、装置及计算机存储介质 技术领域
本发明涉及移动通信领域中的网络安全传输通道技术，特别涉及一种基站实现控制/业务数据可靠传输的方法、相关的装置及计算机存储介质。
背景技术
在无线传输领域，长期演进(Long Terms Evolved，LTE)要求高速率传输的场景下，如果由于中间物理线路或者其他干扰，基站和核心网断链，会导致该基站覆盖下的所有用户不能正常使用数据通话等功能。
为了解决上述问题，目前有多种冗余方法，比如在安全网关、路由器等器件上实现冗余方式。但是，采用虚拟路由冗余协议(Virtual Router Redundancy Protocol，VRRP)等协议这类通用方式，一般需要在同一个地方部署多套冗余设备，比较浪费资源。
发明内容
有鉴于此，本发明实施例期望提供一种基站实现控制/业务数据可靠传输的方法、装置及计算机存储介质，无需部署多套冗余设备，即可实现基站在通信过程中的无缝切换。
为达到上述目的，本发明实施例的技术方案是这样实现的：
根据本发明的一个方面，本发明实施例提供了一种基站实现控制/业务数据可靠传输的方法，所述方法包括：
在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；
对所述主用隧道进行故障检测；
若检测到所述主用隧道发生故障，则启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
优选地，所述方法还包括：
为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
优选地，所述方法还包括：
在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，尝试建立所述主用隧道，并在所述主用隧道建立后，利用已建立的所述主用隧道传输控制/业务数据。
优选地，所述方法还包括：
对所述备用隧道进行故障检测；
若检测到所述备用隧道发生故障，则删除所述备用隧道的隧道信息，并尝试建立所述备用隧道。
优选地，所述方法还包括：
按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建立状态。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机程序，所述计算机程序用于执行以上所述的基站实现控制/业务数据可靠传输方法。
根据本发明的另一方面，本发明实施例提供了一种基站实现控制/业务数据可靠传输的装置，所述装置包括：
隧道建立模块，配置为在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；
故障检测模块，配置为对所述主用隧道进行故障检测；
隧道切换模块，配置为在检测到所述主用隧道发生故障时，启动一个 状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
优选地，所述隧道建立模块还配置为：为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
优选地，在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，所述隧道建立模块还配置为尝试建立所述主用隧道，并在所述主用隧道建立后，所述隧道切换模块利用已建立的所述主用隧道传输控制/业务数据。
优选地，所述故障检测模块还配置为对所述备用隧道进行故障检测，若检测到所述备用隧道发生故障，则所述隧道切换模块删除所述备用隧道的隧道信息，并由所述隧道建立模块尝试建立所述备用隧道。
优选地，所述装置还包括：
隧道保活模块，配置为按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建立状态。
与现有技术相比较，本发明实施例所述技术方案的有益效果在于：
在无线基站侧实现的安全传输冗余技术，无需部署多套冗余设备，具体地，从基站侧来看，可以实现不掉话的无缝切换；从传输组网上来看，不仅能实现冗余，而且能实现异地/同地安全网关等传输设备的负载均衡，通过基站的配置，来实现传输设备最大限度的负载均衡的使用，而无需改变安全网关等传输设备的配置，操作简单，易于维护。
附图说明
图1是本发明第一实施例提供的基站实现控制/业务数据可靠传输的方法流程图；
图2是本发明第二实施例提供的基站实现控制/业务数据可靠传输的方法流程图；
图3是本发明第三实施例提供的基站实现控制/业务数据可靠传输的方 法流程图；
图4是本发明第四实施例提供的基站实现控制/业务数据可靠传输的组成结构示意图；
图5是本发明第五实施例提供的基站实现控制/业务数据可靠传输的方法流程图；
图6是本发明第六实施例提供的基站实现控制/业务数据可靠传输的装置的组成结构示意图；
图7是本发明第六实施例提供的传输安全冗余组网图。
具体实施方式
以下结合附图对本发明的优选实施例进行详细说明，应当理解，以下所说明的优选实施例仅用于说明和解释本发明，并不用于限定本发明。
图1是本发明第一实施例提供的基站实现控制/业务数据可靠传输的方法流程图，如图1所示，所述方法主要包括以下步骤：
步骤S101：在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道。
进一步地，基站可以为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
一般情况下，基站优先使用自己的主用线路，例如，基站1将基站1与其所属安全网关1之间的隧道11作为主用隧道进行数据通信，可以设置该主用隧道为最高优先级隧道；基站2将基站2与其所属安全网关2之间的隧道22作为主用隧道进行数据通信，可以设置该主用隧道为最高优先级；基站1将其与安全网关2之间的隧道12作为备用隧道，当基站1检测到主用隧道11故障时，可以启动备用隧道12传输控制/业务数据；基站2将其与安全网关1之间的隧道21作为备用隧道，当基站2检测到主用隧道22故障时，可以启动备用隧道21传输控制/数据业务。同理，基站1可以与多 个类似于安全网关2的其它安全网关建立隧道，基站2也可以与多个类似于安全网关1的其它安全网关建立隧道。
步骤S102：对主用隧道进行故障检测。
步骤S103：若检测到主用隧道发生故障，则启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
进一步地，基站可以在检测到主用隧道发生故障，启用状态正常的备用隧道中优先级最高的隧道，换句话说，基站将最高优先级隧道切换至状态正常的次高优先级隧道。
本发明能够保证基站在通信过程中，当主用隧道故障时，自动把控制/数据业务等切换到备用隧道，当主用隧道故障恢复时把控制/数据业务等回切到主用隧道。
这种建立安全隧道和切换的方式在网络上支持建立安全隧道等其他设备也同样适用。
图2是本发明第二实施例提供的基站实现控制/业务数据可靠传输的方法流程图，如图2所示，与图1所示第一实施例比较，本实施例进一步包括以下步骤：
步骤104：在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，尝试建立主用隧道，并在主用隧道建立后，利用已建立的所述主用隧道传输控制/业务数据。
也就是说，如果主用隧道故障消除，则利用已恢复的主用隧道传输控制/业务数据。
进一步地，主用隧道故障后，基站使用自动触发机制，定期尝试建立该主用隧道。
通过这种方式，基站能够保证尽可能使用优先级最高的隧道传输控制/数据业务。
图3是本发明第三实施例提供的基站实现控制/业务数据可靠传输的方法流程图，如图3所示，所述方法主要包括以下步骤：
步骤S201：在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道。
进一步地，基站可以为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
步骤S202：对备用隧道进行故障检测。
步骤S203：若检测到备用隧道发生故障，则删除该备用隧道的隧道信息，并尝试建立该备用隧道。
与主用隧道类似的，基站使用自动触发机制，定期尝试建立该备用隧道及隧道信息，以供无缝切换。
图4是本发明第四实施例提供的基站实现控制/业务数据可靠传输的装置的组成结构示意图，如图4所示，所述装置包括隧道建立模块10、故障检测模块20和隧道切换模块30；其中，
所述隧道建立模块10，配置为在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道。
所述故障检测模块20，配置为对所述主用隧道进行故障检测；
所述隧道切换模块30，配置为在检测到所述主用隧道发生故障时，启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
优选地，所述隧道建立模块10，还可以配置为：为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
当所述故障检测模块20检测到所述主用隧道发生故障时，所述隧道切换模块30启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据；在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，所述隧道建立模块10还配置为尝试建立所述主用隧 道，并在所述主用隧道建立后，所述隧道切换模块30利用已建立的所述主用隧道传输控制/业务数据；所述故障检测模块20还配置为对所述备用隧道进行故障检测，若检测到备用隧道发生故障，则所述隧道切换模块30删除所述备用隧道的隧道信息，并由所述隧道建立模块10尝试建立所述备用隧道，这样，该备用隧道故障消除后，即重新建立该备用隧道及隧道信息后，该备用隧道可供后续无缝切换。
实际应用中，所述基站实现控制/业务数据可靠传输的装置可应用于通信领域；所述隧道建立模块10、故障检测模块20和隧道切换模块30均可由基站或所述基站实现控制/业务数据可靠传输的装置所属终端中的中央处理器(CPU，Central Processing Unit)、数字信号处理器(DSP，Digital Signal Processor)或现场可编程门阵列(FPGA，Field Programmable Gate Array)实现。
图5是本发明第五实施例提供的基站实现控制/业务数据可靠传输的方法流程图，如图5所示，所述方法主要包括以下步骤：
步骤S301：在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道。
步骤S302：按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建立状态。
为保证无缝切换，需要进行定期或不定期的保活策略，以保护两个或以上隧道一直是建立状态，通过监控隧道状态，及时发现隧道异常，并及时的重新触发隧道建立。
图6是本发明第六实施例提供的基站实现控制/业务数据可靠传输的装置的组成结构示意图，如图6所示，与图4所示实施例比较，本实施例增加了隧道保活模块40，所述隧道保活模块40，配置为在隧道建立后，按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建 立状态，以保证无缝切换。
实际应用中，所述隧道保活模块40均可由基站或所述基站实现控制/业务数据可靠传输的装置所属终端中的CPU、DSP或FPGA实现。
本发明实施例还记载一种计算机存储介质，所述计算机存储介质中存储有计算机程序，所述计算机程序用于执行本发明实施例中图1、图2、图3、图5所示的基站实现控制/业务数据可靠传输的方法。
图7是本发明第六实施例提供的传输安全冗余组网图，如图7所示，在对安全性要求日益提高的今天，本实施例中建立的隧道是一种安全隧道，以下简称IPSec(IP Security)隧道，本实施例提供的安全隧道是在互联网工程任务组(Internet Engineering Task Force，IETF)制定的为保证在Internet上传送数据的安全保密性能的框架协议基础上，使用因特网密钥交换协议(IKE Internet Key Exchange)动态协商安全关联(Security Association，SA)的协议，也就是协商出IPSec隧道信息。
图7中，传输安全冗余组网方式具体如下：基站侧实现的冗余IPSec隧道建立在异地，也可以是同地。根据优先级等策略不同，基站1优先使用自己的主用线路，基站2优先使用自己的主用线路。本实施例的这种组网，既能满足A地当安全网关SeGw1发生故障时，基站1切换到B地SeGw2上的线路的冗余组网，又能当满足SeGw1和SeGw2都正常使用时候的负载均衡组网，这种组网场景同样也能应用到不同的运营商之间，实现共同使用同一个基站进行业务转发以及共同管理的基站的目的。
图7中，冗余的安全隧道建立方式具体如下：要实现无缝切换，考虑到建立IPSec隧道需要时间，如果发生断链进行切换时再建立IPSec隧道建立，则可能出现短暂掉链的情况。本实施例在保证基站初始建链阶段就和两个或者多个安全网关SeGw建立起IPSec隧道(两个/多个隧道使用相同的安全策略)，并进行定期或不定期的保活策略，保护两个/多个隧道一直是 建立状态，并且监控该隧道状态，如果隧道异常，及时的重新触发隧道建立，以此来保证无缝切换。
图7中，冗余安全隧道切换方式具体如下，为了实现高速的转发速率，基站侧早已实现使用硬件进行加解密的方式。本实施例在硬件加解密的基础上，实现了一种冗余隧道切换方式，保证无缝切换后依然能满足高速的转发速率。具体操作步骤见下：
步骤1：基站和异地两个安全网关按照附图一进行组网；
步骤2：基站和两个异地安全网关(也可以是同地的，或一个同地一个异地)分别建立两个IPSec隧道，分别为主备隧道；
步骤3：对步骤2中的建好的主备两条隧道进行保活，采用定期或不定期的保活策略；
步骤4：如果步骤2的备用隧道故障，基站使用自动触发机制，定期尝试建立IPSec隧道，目的是为了实现IPSec隧道的无缝切换。
步骤5：如果主用隧道故障，基站的自动检测机制以及触发机制自动切换到可用的备用隧道，检测机制可以使用诸如双向转发检测(Bidirectional Forwarding Detection，BFD)或者数字预失真(Digital Pre-Distortion，DPD)等方式。
步骤6：当主用隧道故障恢复后，基站会根据检测机制以及触发机制把控制/数据业务等从备用隧道切回到主用隧道，保证基站在主用隧道下性能最佳。
下面以移动通信BSS系统为例，进一步说明本发明中冗余的安全隧道的建立和切换以保证控制/业务数据可靠传输的具体实施方式。其中，BSS是Base Station Subsystem的简称，称为基站子系统，又称基站设备。
1、冗余安全隧道的建立：
在基站侧，由软件实现IPSec隧道的管理，建立、更新、删除等隧道信 息同步给硬件，能够使硬件针对隧道信息实现报文的高速转发。本实施例由软件模块建立多个IPSec隧道信息，但是只把最高优先级的IPSec隧道加密方向信息同步给硬件，其余解密方向的信息全部同步给硬件。这样做的目的，一是为了使用最高优先级的隧道进行高速转发；二是为了在切换的时候，如果有其他入向报文没来的及从核心网侧做切换，同样可以保证数据业务的正常转发。
2、冗余安全隧道切换：
本实施例使用的隧道检测方式有DPD和BFD两种检测方式，两种方式各有利弊，仅供用户自行选择使用。
使用DPD方式进行检测，周期较长，断链警告不及时，有可能出现切换通道时发生闪断的情况；但是DPD方式在现行的IKEv1、IKEv2协议中是默认支持的，只需打开该配置即可。相比之下，使用BFD方式进行检测，周期短，检测时间一般在毫秒(ms)级，断链告警及时，切换时通道断的可能性就大大降低；但是BFD功能是一个单独的协议功能，需要在支持传输安全协议的设备上同时支持BFD功能，对设备要求较高，不一定能够满足所有应用场景。
本实施例的切换方式是在冗余安全隧道建立的基础上，本实施例的切换方式包含以下两种，一种是由高切低，一种是由低切回高。
1.高切低的方式：如果DPD/BFD功能检测到有隧道断开，如果是高优先级的IPSec隧道故障，则需切换到次高优先级的IPSec隧道，此时软件需要把次高优先级的IPSec隧道信息同步给硬件，同时软件删除自己维护的高优先级隧道以及删除硬件中保存的高优先级隧道信息；如果是低优先级IPSec隧道故障，则软件直接删除低优先级IPSec隧道信息。
在切换删除过程中，基站一直有定时机制尝试建立已故障的IPSec隧道信息，使得保证在隧道故障恢复后能够及时做好回切的准备。
2.低切高的方式：如果DPD/BFD功能检测到某个IPSec隧道恢复了，且优先级比当前使用的隧道优先级高，则软件把恢复的高优先级的IPSec隧道信息同步给硬件来替代次优先级的IPSec隧道，使得业务恢复到主用隧道上。
尽管上文对本发明进行了详细说明，但是本发明不限于此，本技术领域技术人员可以根据本发明的原理进行各种修改。因此，凡按照本发明原理所作的修改，都应当理解为落入本发明的保护范围。
工业实用性
本发明实施例中，在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；对所述主用隧道进行故障检测；若检测到所述主用隧道发生故障，则启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。如此，从基站侧来看，可以实现不掉话的无缝切换，从传输组网上来看，不仅能够实现冗余，而且能实现异地/同地安全网关等传输设备的负载均衡，通过基站的配置，来实现传输设备最大限度的负载均衡的使用，而无需改变安全网关等传输设备的配置，操作简单，易于维护。

Claims (11)

  1. 一种实现数据可靠传输的方法，所述方法包括：
    在基站与至少两个安全网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；
    对所述主用隧道进行故障检测；
    若检测到所述主用隧道发生故障，则启动一个状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
  2. 根据权利要求1所述的方法，其中，为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
  3. 根据权利要求1或2所述的方法，其中，所述方法还包括：
    在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，尝试建立所述主用隧道，并在所述主用隧道建立后，利用已建立的所述主用隧道传输控制/业务数据。
  4. 根据权利要求1或2所述的方法，其中，所述方法还包括：
    对所述备用隧道进行故障检测；
    若检测到所述备用隧道发生故障，则删除所述备用隧道的隧道信息，并尝试建立所述备用隧道。
  5. 根据权利要求1至4任意一项所述的方法，其中，所述方法还包括：
    按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建立状态。
  6. 一种实现数据可靠传输的装置，所述装置包括：
    隧道建立模块，配置为在基站与至少安全两个网关之间建立隧道，并将一个隧道作为主用隧道，其它隧道作为备用隧道；
    故障检测模块，配置为对所述主用隧道进行故障检测；
    隧道切换模块，配置为在检测到所述主用隧道发生故障时，启动一个 状态正常的备用隧道，并利用所启动的备用隧道传输控制/业务数据。
  7. 根据权利要求6所述的装置，其中，所述隧道建立模块为已建立的隧道设置优先级，并将优先级最高的隧道作为主用隧道，其它隧道作为备用隧道。
  8. 根据权利要求6或7所述的装置，其中，在启动一个状态正常的备用隧道并利用所启动的备用隧道传输控制/业务数据期间，所述隧道建立模块还配置为尝试建立所述主用隧道，并在所述主用隧道建立后，所述隧道切换模块利用已建立的所述主用隧道传输控制/业务数据。
  9. 根据权利要求6或7所述的装置，其中，所述故障检测模块，还配置为对所述备用隧道进行故障检测，若检测到所述备用隧道发生故障，则所述隧道切换模块删除所述备用隧道的隧道信息，并由所述隧道建立模块尝试建立所述备用隧道。
  10. 根据权利要求6至9任意一项所述的装置，其中，所述装置还包括：
    隧道保活模块，配置为按照预定保活策略，对已建立的隧道进行保活处理，使两个或以上隧道保持建立状态。
  11. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至5任一项所述的方法。
PCT/CN2015/075843 2014-11-25 2015-04-03 实现数据可靠传输的方法、装置及计算机存储介质 WO2016082412A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410690814.2 2014-11-25
CN201410690814.2A CN105704747A (zh) 2014-11-25 2014-11-25 一种基站实现控制/业务数据可靠传输的方法及装置

Publications (1)

Publication Number Publication Date
WO2016082412A1 true WO2016082412A1 (zh) 2016-06-02

Family

ID=56073462

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/075843 WO2016082412A1 (zh) 2014-11-25 2015-04-03 实现数据可靠传输的方法、装置及计算机存储介质

Country Status (2)

Country Link
CN (1) CN105704747A (zh)
WO (1) WO2016082412A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190281530A1 (en) * 2016-11-29 2019-09-12 Huawei Technologies Co., Ltd. X2 service transmission method and network device
CN111698142A (zh) * 2020-05-26 2020-09-22 新华三信息安全技术有限公司 一种报文转发方法、装置、电子设备及存储介质
CN112511422A (zh) * 2020-11-18 2021-03-16 平安普惠企业管理有限公司 数据的传输方法、装置、计算机设备及存储介质
CN113114528A (zh) * 2017-09-22 2021-07-13 华为技术有限公司 一种通信连接检测方法及装置
WO2023070572A1 (en) * 2021-10-29 2023-05-04 Telefonaktiebolaget Lm Ericsson (Publ) Communication device and method therein for facilitating ipsec communications

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107948041B (zh) * 2017-11-22 2020-12-18 锐捷网络股份有限公司 构建vxlan集中式多活网关的方法和设备
CN111031612B (zh) * 2018-10-09 2022-04-29 中国移动通信有限公司研究院 一种建立5g数据传输的冗余路径的方法、装置及计算机可读存储介质
CN110166325B (zh) * 2019-06-12 2022-10-04 首钢京唐钢铁联合有限责任公司 一种通信网络故障的确定方法及装置
CN113645117B (zh) * 2021-07-08 2023-04-07 郑州信大捷安信息技术股份有限公司 基于IPSec协议的多通道智能选路方法及系统
CN115134216B (zh) * 2022-05-30 2024-04-12 杭州初灵信息技术股份有限公司 一种依托于sdwan的异机ipsec隧道保护调度方法、系统和介质
CN115499297A (zh) * 2022-09-07 2022-12-20 北京国领科技有限公司 一种ipsec加密隧道无延迟热备份的方法
CN115460070A (zh) * 2022-09-09 2022-12-09 京信网络系统股份有限公司 网关容灾系统
CN116545922B (zh) * 2023-07-05 2023-12-05 国网浙江省电力有限公司宁波供电公司 一种多通道通信方法与系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102571458A (zh) * 2012-03-05 2012-07-11 中兴通讯股份有限公司 隧道保护组的切换方法及装置
WO2013071988A1 (en) * 2011-11-16 2013-05-23 Telefonaktiebolaget L M Ericsson (Publ) Technique for network routing
CN103581025A (zh) * 2013-10-23 2014-02-12 华为技术有限公司 路由信息处理方法、设备及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1980224A (zh) * 2005-12-01 2007-06-13 华为技术有限公司 基于主备网关设备状态切换后业务恢复的方法及系统
US7715309B2 (en) * 2006-05-24 2010-05-11 At&T Intellectual Property I, L.P. Method and apparatus for reliable communications in a packet network

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013071988A1 (en) * 2011-11-16 2013-05-23 Telefonaktiebolaget L M Ericsson (Publ) Technique for network routing
CN102571458A (zh) * 2012-03-05 2012-07-11 中兴通讯股份有限公司 隧道保护组的切换方法及装置
CN103581025A (zh) * 2013-10-23 2014-02-12 华为技术有限公司 路由信息处理方法、设备及系统

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190281530A1 (en) * 2016-11-29 2019-09-12 Huawei Technologies Co., Ltd. X2 service transmission method and network device
US11006346B2 (en) * 2016-11-29 2021-05-11 Huawei Technologies Co., Ltd. X2 service transmission method and network device
CN113114528A (zh) * 2017-09-22 2021-07-13 华为技术有限公司 一种通信连接检测方法及装置
US11303528B2 (en) * 2017-09-22 2022-04-12 Huawei Technologies Co., Ltd. Communications connection detection method and apparatus
CN111698142A (zh) * 2020-05-26 2020-09-22 新华三信息安全技术有限公司 一种报文转发方法、装置、电子设备及存储介质
CN111698142B (zh) * 2020-05-26 2023-03-31 新华三信息安全技术有限公司 一种报文转发方法、装置、电子设备及存储介质
CN112511422A (zh) * 2020-11-18 2021-03-16 平安普惠企业管理有限公司 数据的传输方法、装置、计算机设备及存储介质
CN112511422B (zh) * 2020-11-18 2024-06-07 厦门华秦信息科技有限公司 数据的传输方法、装置、计算机设备及存储介质
WO2023070572A1 (en) * 2021-10-29 2023-05-04 Telefonaktiebolaget Lm Ericsson (Publ) Communication device and method therein for facilitating ipsec communications

Also Published As

Publication number Publication date
CN105704747A (zh) 2016-06-22

Similar Documents

Publication Publication Date Title
WO2016082412A1 (zh) 实现数据可靠传输的方法、装置及计算机存储介质
JP6491745B2 (ja) 仮想ネットワーク機能プールと制御エンティティとの間におけるインターフェース・エレメントのための方法、およびシステム
US10375609B2 (en) Operation of a serving node in a network
CN110800275B (zh) Ipsec地理冗余的解耦控制和数据平面同步
US9426678B2 (en) Implementing dual-homed node protection
US20100306572A1 (en) Apparatus and method to facilitate high availability in secure network transport
CN101577725B (zh) 一种防重放机制中的信息同步方法、装置和系统
WO2011063757A1 (zh) 一种备份方法、设备和系统
EP2744259B1 (en) Method and network element to limit service disruption due to a failure on a layer 2 interface
CN102833167B (zh) 局域网间数据传输方法和系统
EP2733907B1 (en) Method, local gateway, and system for local voice survivability
US20160080424A1 (en) Apparatus and method for reestablishing a security association used for communication between communication devices
CN101917294A (zh) 主备切换时更新防重放参数的方法和设备
WO2014206207A1 (zh) 一种路由撤销方法和网络设备
CN110855508A (zh) 一种基于区块链技术的分布式sdn同步方法
JP2019511861A (ja) 基本サービスセット識別子ｂｓｓｉｄ更新
EP3035609B1 (en) Data transmission method and device
CN116195353A (zh) Rrc重建
CN101753401A (zh) 一种实现IPSec虚拟专用网隧道备份和负载的方法
WO2011147152A1 (zh) 一种实现接入层安全算法同步的方法及系统
WO2022066070A1 (en) Control plane function associating with and performing control plane functions for one or more user equipments
WO2011060677A1 (zh) 主备倒换的方法、装置及系统
CN101605060B (zh) 一种单板级的IPSec主备方法及装置
US10887207B2 (en) System and method for determining branch gateway device availability in computer networks
JP5481685B2 (ja) 時刻同期方法及び計算機システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15863124

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15863124

Country of ref document: EP

Kind code of ref document: A1