WO2016138811A1

WO2016138811A1 - Redirection method and related device

Info

Publication number: WO2016138811A1
Application number: PCT/CN2016/073157
Authority: WO
Inventors: 曾信
Original assignee: 华为技术有限公司
Priority date: 2015-03-03
Filing date: 2016-02-02
Publication date: 2016-09-09
Also published as: CN104754672A

Abstract

Disclosed in an embodiment of the present invention is a redirection method, whereby a redirection operation can be guided by a historical redirection record of an initiator in the process of negotiation, so as to increase a negotiation efficiency. A method in an embodiment of the present invention comprises: in the process of a negotiation between an initiator and an original responder, if the initiator is redirected by the original responder to a first target responder, recording, by the initiator, corresponding redirection result information; when the initiator reinitiates negotiation with the original responder, carrying, by the initiator, the redirection result information in a negotiation message, such that the original responder executes a redirection operation according to the redirection result information.

Description

Redirection method and related equipment

The present application claims priority to Chinese Patent Application No. 201510094979.8, entitled "A Redirecting Method and Related Equipment", filed on March 3, 2015, the entire contents of in.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a redirection method and related devices.

Background technique

During the negotiation process of two communication network elements (including the initiator and the responder), the responder may initiate a redirect request based on the responder's load balancing or responder failure, etc., and redirect the initiator to other responders. Let the initiator negotiate with the new responder.

Taking the IPsec tunnel negotiation as an example, the RFC5685 protocol supports the IKE init/IKE AUTH/Information phase in the IPsec tunnel negotiation. The responder (that is, the security gateway) initiates a redirect request to the initiator (ie, the base station), so that the initiator and the new The target responder negotiates an IPsec tunnel. The following describes in detail the process of IPsec tunnel negotiation that supports redirection:

1) The initiator A sends an IKE_SA_INIT Request (IKE-Security-Association-Initial Request) message to the initial responder B1, and the IKE_SA_INIT Request message carries the redirection capability of the initiator A. (REDIRECT_SUPPORT);

2) The initial responder B1 determines whether the IPsec redirection condition is met, and if so, returns an IKE_SA_INIT Response message to the initiator A, where the IKE_SA_INIT Response message carries a redirection request, the redirection request includes the IP address of the target responder B2, and uses Instructing the initiator A to initiate a new IPsec tunnel negotiation to the target responder B2;

3) After receiving the redirect request, the initiator A starts a new IPsec tunnel negotiation with the target responder B2.

However, if the initiator A to the target responder B2 is unreachable due to a transmission failure or the like, the initiator A and the target responder B2 cannot establish a link in step 3), and initiate an IPsec tunnel with the initial responder B1. Negotiation, that is, returning to step 1), will cause initiator A to continually ring at the initial The link between the responder B1 and the target responder B2 establishes a link, and the ping-pong switching effect occurs, causing a heavy air interface burden between the initiator and the responder, and even if the link between the initiator A and the initial responder B1 is Also, due to the redirection operation, the initial responder B1 cannot provide the service to the initiator A, so that the initiator can not be provided with the available responders.

Summary of the invention

The embodiment of the invention provides a redirection method and related device, which can guide the redirection operation according to the redirection history record of the initiator in the negotiation process, so as to improve the negotiation efficiency.

A first aspect of the embodiments of the present invention provides a redirection method, where the method includes:

During the negotiation process between the initiator and the initial responder, if the initiator is redirected by the initial responder to the first target responder, the initiator records the corresponding redirect result information;

When the initiator initiates the negotiation with the initial responder, the initiator carries the redirection result information in the negotiation message, so that the initial responder performs a redirection operation according to the redirection result information, where The negotiation message refers to any one of the messages sent by the originating party to the initial responder during the negotiation process.

With reference to the first aspect of the embodiments of the present invention, in a first implementation manner of the first aspect of the embodiments, the redirection result information includes the identifier information of the first target responding party, and is used to indicate whether to negotiate Successful instructions;

And the performing, by the initiator, the redirection result information in the negotiation message, so that the initial responding party performs the redirection operation according to the redirection result information, including:

If the indication information indicates that the negotiation fails, the initiator carries the redirection result information in the negotiation message, so that the initial responder redirects the initiator to the second according to the redirection result information. The target responder or abandon the redirect operation, wherein the second target responder is different from the first target responder;

If the indication message indicates that the negotiation is successful, the initiator carries the redirection result information in the negotiation message, so that the initial responder preferentially redirects the initiator to the redirection result according to the redirection result information. The first target responder.

With reference to the first aspect of the embodiments of the present invention, in a second implementation manner of the first aspect of the embodiments, the redirection result information includes a correspondence relationship table, where the correspondence relationship table is established with at least one Corresponding relationship between the identification information of the first target responder and the priority value, wherein if the initial responder redirects the initiator to the first target responder, the improvement is a priority value corresponding to the identifier information of the target responder, if the initial responder fails to redirect the initiator to the first target responder, reducing the priority corresponding to the identifier information of the first target responder Level value

The initiator carries the redirection result information in the negotiation message, so that the initial responder preferentially redirects the initiator to the first target responder with a high priority value according to the redirection result information.

With reference to the first aspect of the embodiment of the present invention, any one of the first to the second implementation manners of the first aspect, in the third implementation manner of the first aspect of the embodiment of the present invention, the negotiation is IPsec tunnel negotiation between the base station and the security gateway;

The negotiation message includes an Internet Key Exchange-Security Association-Initialization Request IKE_SA_INIT Request message or an Internet Key Exchange-Authentication Request IKE_AUTH Request message during IPsec tunnel negotiation.

A second aspect of the embodiments of the present invention provides a redirection method, where the method includes:

When the initiator initiates the negotiation with the initial responder, the initial responder receives the negotiation message sent by the initiator, and the negotiation message carries the redirect result information, where the redirect result information is initiated by the initiator. Recording is obtained when the initiator is redirected to the first target responder by the initial responder during the negotiation with the initial responder; the negotiation message is sent by the initial responder by the originating direction during the negotiation process. Any one of the messages, the initial responder may be the same as the initial responder, or may be different;

The initial responder performs a redirection operation according to the redirection result information.

With reference to the second aspect of the embodiments of the present invention, in a first implementation manner of the second aspect of the embodiment, the redirection result information includes the identifier information of the first target responding party, and is used to indicate whether to negotiate Successful instructions;

And performing, by the initial responder, the redirection operation according to the redirection result information includes:

If the indication information indicates that the negotiation fails, the initial responder is based on the redirect result letter. Redirecting the initiator to a second target responder or abandoning a redirect operation, wherein the second target responder is different from the first target responder;

If the indication message indicates that the negotiation is successful, the initial responder preferentially redirects the initiator to the first target responder according to the redirect result information.

With reference to the second aspect of the embodiments of the present invention, in a second implementation manner of the second aspect of the embodiment, the redirection result information includes a correspondence relationship table, where the correspondence relationship table is configured with at least one of the foregoing Corresponding relationship between the identification information of the target responder and the priority value, wherein if the initial responder redirects the initiator to the first target responder successfully, the first target responder is raised The priority value corresponding to the identifier information, if the initial responder fails to redirect the initiator to the first target responder, reducing the priority value corresponding to the identifier information of the first target responder;

The initial responder preferentially redirects the initiator to a first target responder with a high priority value according to the redirect result information.

With reference to the second aspect of the embodiment of the present invention, the first to the second implementation manner of the second aspect, in the third implementation manner of the second aspect of the embodiment of the present invention, the negotiation is IPsec tunnel negotiation between the base station and the security gateway;

The negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during an IPsec tunnel negotiation process.

A third aspect of the embodiments of the present invention provides an initiator device, where the device is used to negotiate with a responder device, where the device includes:

a recording unit, configured to: during the negotiation process between the initiator device and the initial responder device, if the initiator device is redirected by the initial responder device to the first target responder device, record corresponding redirection result information;

a sending unit, configured to: when the initiator device initiates negotiation with the initial responder device, carry the redirection result information in the negotiation message, so that the initial responder device performs heavy according to the redirection result information. A directed operation, wherein the negotiation message refers to any one of messages sent by the initiator device to the initial responder device during the negotiation process.

In conjunction with the third aspect of the embodiments of the present invention, the first implementation of the third aspect of the embodiment of the present invention In the manner, the redirection result information includes the identifier information of the first target responder device and the indication information used to indicate whether the negotiation is successful.

The sending unit is configured to: if the indication information indicates that the negotiation fails, the redirection result information is carried in the negotiation message, so that the initial responder device sends the initiator according to the redirection result information. Redirecting the device to the second target responder device or abandoning the redirect operation, wherein the second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, then the negotiation message is And carrying the redirection result information, so that the initial responder device preferentially redirects the initiator device to the first target responder device according to the redirection result information.

With reference to the third aspect of the embodiments of the present invention, in a second implementation manner of the third aspect of the embodiments, the redirection result information includes a correspondence relationship table, where the corresponding relationship table is configured with at least one of the foregoing Corresponding relationship between the identification information of the target responder device and the priority value, wherein if the initial responder device redirects the initiator device to the first target responder device successfully, a priority value corresponding to the identifier information of the target responder device, if the initial responder device fails to redirect the initiator device to the first target responder device, reducing the device with the first target responder device The priority value corresponding to the identification information;

The sending unit is configured to carry the redirection result information in the negotiation message, so that the initial responder device preferentially redirects the initiator device to a high priority value according to the redirection result information. The first target responder device.

With reference to the third aspect of the embodiments of the present invention, any one of the first to the second implementation manners of the third aspect, in the third implementation manner of the third aspect of the embodiment of the present invention, the initiator The device is a base station; the responder device is a security gateway; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; the negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during the IPsec tunnel negotiation process.

A fourth aspect of the embodiments of the present invention provides a responder device, where the responder device is an initial responder device, and the initial responder device includes:

The receiving unit is configured to: when the initiator device initiates the negotiation with the initial responder device, receive the negotiation message sent by the initiator device, where the negotiation message carries the redirection result information, where the redirection result information is The initiator is initiated during the negotiation process with the initial responder. Recording is obtained when the responder redirects to the first target responder; the negotiation message refers to any one of the messages sent by the initiator device to the initial responder device during the negotiation process;

An execution unit, configured to perform a redirection operation according to the redirection result information.

With reference to the fourth aspect of the embodiments of the present invention, in a first implementation manner of the fourth aspect of the embodiments, the redirection result information includes the identifier information of the first target responsive device, and is used to indicate whether Instructions for successful negotiation;

The executing unit is specifically configured to: if the indication information indicates that the negotiation fails, redirect the initiator device to the second target responder device or abandon the redirect operation according to the redirect result information, where the The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, preferentially redirecting the initiator device to the first target according to the redirect result information Responder device.

With reference to the fourth aspect of the embodiments of the present invention, in a second implementation manner of the fourth aspect of the embodiments of the present disclosure, the redirection result information includes a correspondence relationship table, where the corresponding relationship table is established with at least one of the foregoing Corresponding relationship between the identification information of the target responder device and the priority value, wherein if the initial responder device redirects the initiator device to the first target responder device successfully, a priority value corresponding to the identifier information of the target responder device, if the initial responder device fails to redirect the initiator device to the first target responder device, reducing the device with the first target responder device The priority value corresponding to the identification information;

The executing unit is specifically configured to preferentially redirect the initiator device to a first target responder device with a high priority value according to the redirect result information.

In combination with the fourth aspect of the embodiment of the present invention, the first to the second implementation manner of the fourth aspect, in the third implementation manner of the fourth aspect of the embodiment of the present invention, the feature is The responder device is a security gateway; the initiator device is a base station; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; and the negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH in the IPsec tunnel negotiation process. Request message.

A fifth aspect of the embodiments of the present invention provides a redirection system, including an initiator device and a responder device for negotiating with the initiator device, where the responder device is an initial responder device.

The initiator device is used to negotiate a process between the initiator device and an initial responder device If the initiator device is redirected by the initial responder device to the first target responder device, the corresponding redirect result information is recorded; when the initiator device initiates negotiation with the initial responder device again, The negotiation message carries the redirection result information, so that the initial responder device performs a redirection operation according to the redirection result information, where the negotiation message refers to the initiator device in the negotiation process. Said any one of the messages sent by the initial responder device;

The initial responder device is configured to: when the initiator device initiates negotiation with the initial responder device, receive the negotiation message sent by the initiator device;

The initial responder device is further configured to perform a redirection operation according to the redirection result information.

With reference to the fifth aspect of the embodiments of the present invention, in a first implementation manner of the fifth aspect, the redirection result information includes the identifier information of the first target responsive device, and is used to indicate whether Instructions for successful negotiation;

The initial responder device is specifically configured to redirect the initiator device to the second target responder device or abandon the redirect operation according to the redirect result information, if the indication information indicates that the negotiation fails, where The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, the initiator device is preferentially redirected to the first according to the redirect result information A target responder device.

With reference to the fifth aspect of the embodiments of the present invention, in a second implementation manner of the fifth aspect of the embodiments, the redirection result information includes a correspondence relationship table, where the correspondence relationship table is configured with at least one of the foregoing Corresponding relationship between the identification information of the target responder device and the priority value, wherein if the initial responder device redirects the initiator device to the first target responder device successfully, a priority value corresponding to the identifier information of the target responder device, if the initial responder device fails to redirect the initiator device to the first target responder device, reducing the device with the first target responder device The priority value corresponding to the identification information;

The initial responder device is specifically configured to preferentially redirect the initiator device to a first target responder device with a high priority value according to the redirect result information.

With reference to the fifth aspect of the embodiment of the present invention, the first to the second implementation manner of the fifth aspect, in the third implementation manner of the fifth aspect of the embodiment of the present invention, the initiator The device is a base station; the responder device is a security gateway; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; and the negotiation message includes an IKE_SA_INIT Request during the IPsec tunnel negotiation process. Message or IKE_AUTH Request message.

In the technical solution provided by the embodiment of the present invention, in the negotiation process between the initiator and the initial responder, if the initiator is redirected to the first target responder by the initial responder, the initiator records the corresponding redirect result information. As the redirection history of the initiator in the negotiation process, when the initiator initiates the negotiation with the initial responder, the initiator carries the redirection result information in the negotiation message, so that the initial responder according to the weight Directed result information performs a redirect operation. The embodiment of the present invention carries the redirection result information in the negotiation message, so that the initiator can guide the redirection operation according to the redirection history record during the negotiation process, so as to improve the negotiation efficiency.

DRAWINGS

1 is a schematic diagram of an embodiment of a redirection method according to an embodiment of the present invention;

2 is a schematic diagram of another embodiment of a redirection method according to an embodiment of the present invention;

3 is a schematic diagram of another embodiment of a redirection method according to an embodiment of the present invention;

4 is a schematic diagram of an embodiment of an initiator device according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of another embodiment of an initiator device according to an embodiment of the present disclosure;

6 is a schematic diagram of an embodiment of a responder device according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of another embodiment of a responder device according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic diagram of an embodiment of a redirection system according to an embodiment of the present invention.

detailed description

The embodiment of the present invention provides a redirection method, which can guide the redirection operation according to the redirection history record of the initiator in the negotiation process, so as to improve the negotiation efficiency.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terms "first", "second", "third", "fourth", etc. (if present) in the specification and claims of the present invention and the above figures are used to distinguish similar objects without being used for Describe a specific order or order. It should be understood that the data used in this way can be interchanged where appropriate, so here The described embodiments can be implemented in a sequence other than what is illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

First, it should be noted that the initiator and the responder are respectively the two ends of the communication process of the negotiation process, wherein the initiator usually refers to the communication end that initiates the negotiation request or sends the first message in the negotiation process, for example, in IPsec. During the tunnel negotiation process, the initiator is the base station, the responder is the security gateway, or the initiator is the terminal device and the responder is the network-side device during the frequency negotiation. The negotiation scenario of the specific application is not limited.

In this embodiment, when the initiator initiates the negotiation, the responder that initially negotiates with the initiator is recorded as the initial responder. In the actual application process, it is usually determined by the initial responder whether the execution condition of the redirect operation is met. The initiator is redirected to the target responder if the redirection condition is met. Of course, in some special application scenarios, the default initial responder can satisfy the execution condition of the redirection operation.

It can be understood that the target responder after performing the redirection operation can be the same communication network element as the initial responder, and can be interchanged under appropriate circumstances, such as a security gateway during IPsec tunnel negotiation, or a differentiated communication. The network element, for example, the network side device in the frequency negotiation process, the initial responder is the network side device in the first communication network, and the target responder is the network side device in the second communication network, where the specific application can be negotiated. The scenario or specific needs are determined.

The following describes the redirection method in the embodiment of the present invention from the perspective of the initiator. Referring to FIG. 1, an embodiment of the redirection method in the embodiment of the present invention includes:

101. If the initiator is redirected by the initial responder to the first target responder, the initiator records the corresponding redirect result information.

In this embodiment, the initiator and the initial responder negotiate through the interaction message. If the initiator is redirected to the first target responder by the initial responder in the process, the initiator records the corresponding redirect. Result information. It can be understood that the result of the initial responder redirecting the initiator to the first target responder may or may not succeed.

Optionally, in the actual application process, a certain touch may also be set for recording the redirection result information. The qualified condition is sent, for example, only when it is determined that the initiator is redirected to the first target responder by the initial responder, the initiator records the corresponding redirect result information. At this time, the redirect result information records are all failed. Orientation results.

It can be understood that, in an actual application process, the initiator may negotiate with multiple different initial responders simultaneously or sequentially, and the initiator may record corresponding multiple redirect result information, or perform redirection result information. Live Update.

102. When the initiator initiates the negotiation with the initial responder, the initiator carries the redirect result information in the negotiation message, so that the initial responder performs the redirection operation according to the redirect result information.

In this embodiment, when the initiator initiates the negotiation with the initial responder again, the initiator and the initial responder negotiate through the exchange of the message, and in the negotiation process, the initiator sends an at least one message to the initial responder, and The initiator carries the redirection result information in the negotiation message, so that the initial responder performs the redirection operation according to the redirection result information, where the negotiation message refers to the message sent by the initiator to the initial responder during the negotiation process. Any one, for example, in a certain negotiation process, the initiator and the initial responder complete the negotiation by using four message messages, wherein the first message message and the third message message are sent by the initiator in the originating direction. The negotiation message may be the first message message or the third message message, that is, the redirection result information is carried in the first message message or the third message message. It should be emphasized that since the performing redirect operation is triggered by the redirect request, the negotiation message must be a message before the initiator sends the redirect request in the initial response direction.

In this embodiment, the initial responder in step 101 may be the same as the initial responder in step 102, or may be different. It may be understood that, in the actual application process, the initiator may be different from one another at the same time or sequentially. The initial responder negotiates and realizes the sharing of the redirect result information between the multiple initial responders through the initiator's negotiation message.

In the technical solution provided by the embodiment of the present invention, in the negotiation process between the initiator and the initial responder, if the initiator is redirected to the first target responder by the initial responder, the initiator records the corresponding redirect result information. As the redirection history of the initiator in the negotiation process, when the initiator initiates the negotiation with the initial responder, the initiator carries the redirection result information in the negotiation message, so that the initial responder according to the weight Directed result information performs a redirect operation. Therefore, the embodiment of the present invention carries the redirection result information in the negotiation message, so that the initiator is negotiating. The redirection history can be used to guide the redirection process to improve the negotiation efficiency.

In this embodiment, the redirection result information is used as the redirection history record of the initiator in the negotiation process, and may be used to guide the redirection operation when the initiator initiates the negotiation again. The execution of the redirection operation specifically includes:

The redirection result information includes the identification information of the first target responder and the indication information for indicating whether the negotiation is successful, and the initiator carries the redirection result information in the negotiation message, so that the initial responder according to the weight Targeting result information performing a redirection operation may include:

1) If the indication information indicates that the negotiation fails, the initiator carries the redirection result information in the negotiation message, so that the initial responder redirects the initiator to the second target responder or gives up the redirection according to the redirection result information. An operation, wherein the second target responder is different from the first target responder;

That is, the record of the redirect failure is used to direct the initial responder to redirect the initiator to other target responders (ie, the second target responder) other than the first target responder, and the second target responder negotiates with the initiator. And establishing a communication link between the initiator and the second target responder to provide services for the initiator by the second target responder; or, in order to ensure that the negotiation is prioritized, using the record of the redirect failure to guide the initial The responder abandons the redirection operation, continues to negotiate with the initiator by the initial responder, and establishes a communication link between the initiator and the second target responder to provide service to the initiator by the initial responder. Optionally, the identifier information of the first target responder may be the IP address information. In other embodiments, the identifier information of the target responder may be uniquely identified. Optionally, the indication information used to indicate the negotiation failure may be an error code. Of course, in some other embodiments, other indication codes or indication parameters may also be used, which are not limited herein.

2) If the indication message indicates that the negotiation is successful, the initiator carries the redirection result information in the negotiation message, so that the initial responder preferentially redirects the initiator to the first target responder according to the redirection result information.

That is, the record of successful redirection is used to guide the initial responder to preferentially redirect the initiator to the first target responder that has been successfully negotiated, and the first target responder negotiates with the initiator, and establishes the initiator and the first a communication link between the two target responders to provide service to the initiator by the first target responder, optionally when multiple first target responders have been successfully negotiated, The responding party can randomly select one of them, or according to the number of successful previous consultations, preferentially select the one with the highest number of successful negotiation, or select one of the most successful ones, where the initial responder selects the first target response. The party is not limited.

The redirection result information includes a correspondence relationship table, where the mapping relationship between the identification information of the at least one first target responding party and the priority value is established, and the initiator carries the redirection in the negotiation message. The result information, such that the initial responder performs the redirection operation according to the redirection result information, may include:

That is, when the initiator responds to the corresponding redirect result information, if the initial responder redirects the initiator to the first target responder successfully, the priority value corresponding to the identifier information of the first target responder is increased, if the initial If the responder fails to redirect the initiator to the first target responder, the priority value corresponding to the identifier information of the first target responder is decreased, so as to establish the identifier information and the priority value of the at least one first target responder. Correspondence between the two. Generally, as long as the initiator is previously redirected to a certain target responder, the priority value of the first target responder is recorded in the correspondence table. It can be understood that the initial responder will according to the redirect result information. The initiator redirects to the first target responder with a higher priority value, and also updates the correspondence table accordingly.

It should be noted that only a few examples are used to explain how to use the redirection result information to guide the initial responder to perform the redirection operation, including how to select the target responder and whether to abandon the redirection operation, which is specific to the specific The directional operation process is not limited.

The embodiment shown in FIG. 1 is described from the perspective of the initiator. The redirection method in the embodiment of the present invention is described in detail from the perspective of the responder (specifically, the initial responder). For details, refer to FIG. 2, Another embodiment of the redirection method in the embodiment includes:

201. When the initiator initiates negotiation with the initial responder, the initial responder receives the negotiation message sent by the initiator.

In this embodiment, the negotiation message carries the redirection result information, wherein the redirection result information is that the initiator is redirected to the first target responder by the initial responder during the negotiation process with the initial responder. The record is obtained, that is, before the initiator initiates the negotiation with the initial responder, the initiator and the initial responder negotiate through the interaction message. If the initiator is initially activated in the process, the initiator is initially activated. The responder redirects to the first target responder, and the initiator records the corresponding redirect result information. It can be understood that the result of the initial responder redirecting the initiator to the first target responder may or may not succeed. It can be understood that, in an actual application process, the initiator may negotiate with multiple different initial responders simultaneously or sequentially, and the initiator may record corresponding multiple redirect result information, or perform redirection result information. Live Update.

In this embodiment, when the initiator initiates the negotiation with the initial responder again, the initiator and the initial responder negotiate through the interaction message, and in the negotiation process, the initiator sends an at least one message to the initial responder, where The negotiation message refers to any one of the messages sent by the initial responder in the initiating direction during the negotiation process. For example, in a certain negotiation process, the initiator and the initial responder complete the negotiation by using four message messages, where The first message message and the third message message are sent by the initial responder in the originating direction, and the negotiation message may be the first message message or the third message message, that is, the first message message. Or the third packet message carries the redirect result information. It should be emphasized that since the performing redirect operation is triggered by the redirect request, the negotiation message must be a message before the initiator sends the redirect request in the initial response direction.

In this embodiment, the initial responder recorded in the redirection result may be the same as the initial responder in this step, or may be different. It can be understood that, in the actual application process, the initiator may simultaneously or sequentially A different initial responder negotiates and shares the redirection result information between the multiple initial responders through the initiator's negotiation message.

202. The initial responder performs a redirection operation according to the redirection result information in the negotiation message.

In this embodiment, the redirection result information is used as the redirection history record of the initiator in the negotiation process, and may be used to guide the initial responder to perform the redirection operation when the initiator initiates the negotiation again, which is embodied in the initial responder. According to the redirection result information, it is determined whether to redirect to the target responder or how to select the target target responder when it is required to redirect to the target responder. The following example illustrates how the initial responder performs the redirection result information according to the negotiation message. For directional operations, specifically:

The redirection result information includes the identification information of the first target responding party and the indication information for indicating whether the negotiation is successful, and the initial responding party performing the redirection operation according to the redirection result information may include:

1) If the indication information indicates that the negotiation fails, the initial responder will The initiator redirects to the second target responder or discards the redirect operation, wherein the second target responder is different from the first target responder;

That is, the initial responder redirects the initiator to other target responders (ie, the second target responder) other than the first target responder according to the record of the redirect failure, and the second target responder negotiates with the initiator. And establishing a communication link between the initiator and the second target responder, so that the second target responder provides the service for the initiator; or in order to ensure the negotiation priority, the initial responder according to the record of the redirect failure The redirection operation is abandoned, the initial responder continues to negotiate with the initiator, and a communication link between the initiator and the second target responder is established to provide services for the initiator by the initial responder. Optionally, the identifier information of the first target responder may be the IP address information. In other embodiments, the identifier information of the target responder may be uniquely identified. Optionally, the indication information used to indicate the negotiation failure may be an error code. Of course, in some other embodiments, other indication codes or indication parameters may also be used, which are not limited herein.

2) If the indication message indicates that the negotiation is successful, the initial responder preferentially redirects the initiator to the first target responder according to the redirect result information.

That is, the initial responder preferentially redirects the initiator to the first target responder that has been successfully negotiated according to the record of the successful redirect, and the first target responder negotiates with the initiator, and establishes the initiator and the second. a communication link between the target responders to provide service to the initiator by the first target responder, optionally, when a plurality of previously targeted first target responders are involved, the initial responder may randomly select One of them, or according to the number of previous successful negotiations, preferentially selects the one with the highest number of successful negotiation, or selects one that has been successfully negotiated the most, and specifically does not limit how the initial responder selects the first target responder.

The redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence relationship between the identification information of the at least one first target responder and the priority value, whereby the initial responder performs the redirection result information according to the redirection result information. Redirection operations can include:

The initial responder preferentially redirects the initiator to the first target responder with a high priority value according to the redirect result information.

That is, when the initiator responds to the corresponding redirect result information, if the initial responder redirects the initiator to the first target responder, the priority corresponding to the identifier information of the first target responder is increased. a value, if the initial responder fails to redirect the initiator to the first target responder, reducing the priority value corresponding to the identifier information of the first target responder, so as to establish identification information of the at least one first target responder and The correspondence between priority values. Generally, as long as the initiator is previously redirected to a certain target responder, the priority value of the first target responder is recorded in the correspondence table. It can be understood that the initial responder will according to the redirect result information. The initiator redirects to the first target responder with a higher priority value, and also updates the correspondence table accordingly.

It should be noted that, in the foregoing, only a few examples are used to describe how the initial responder performs the redirection operation according to the redirection result information in the negotiation message. In other embodiments, the initial responder may also utilize the redirection result information. Perform the redirection operation in other modes. The specific redirection operation process is not limited here.

For the sake of understanding, the redirection method described in the foregoing embodiment is described in detail in a specific application scenario. Referring to FIG. 3, another embodiment of the redirection method in the embodiment of the present invention includes:

In this embodiment, IPsec tunnel negotiation is used as a specific application scenario. The following is a brief introduction to IPsec tunnel negotiation:

IPsec is a security architecture defined by the Internet Engineering Task Force (IETF). It is applied to the IP layer and consists of the AH (Authentication Header), ESP (Encapsulation Security Payload), and IKE (Internet Key Exchange) protocols. IPsec tunnel negotiation mainly includes two phases:

Phase 1: Establish an IKE SA on the network to provide protection and fast negotiation for the second phase. A communication channel is created through negotiation, and the channel is authenticated to provide confidentiality, message integrity, and message source authentication services for further IKE communication.

The second phase: Under the protection of the IKE SA established in the first phase, the IPSec SA negotiates a specific SA to establish an IPSec SA for the final secure transmission of IP data.

In this embodiment, based on the load balancing of the SeGW (Security Gateway) or the failure of the SeGW, the RFC5685 protocol supports the IKE init/IKE AUTH/Information phase negotiated by the IPsec tunnel, and the SeGW initiates a redirect request to the base station, so that The base station negotiates an IPsec tunnel with a Selected SeGW (Selected Security Gateway).

In this embodiment, the initial SeGW that performs IPsec tunnel negotiation with the base station is taken as an example:

301. The base station sends an IKE_SA_INIT Request message to the Initial SeGW.

The IKE_SA_INIT Request message carries the redirection capability of the base station (REDIRECT_SUPPORT). In this embodiment, the base station initiates IPsec tunnel negotiation by using the IKE_SA_INIT Request message as the first message.

302, Initial SeGW determines whether the IPsec redirection condition is met, and if so, step 303 is performed;

In this embodiment, after receiving the IKE_SA_INIT Request message, the first Initial SeGW determines whether the IPsec redirection condition is met, for example, according to the load status of the first Initial SeGW, and in some special application scenarios. Step 302 can be omitted, as the IPsec redirection condition is met by default.

303. The Initial SeGW sends an IKE_SA_INIT Response message to the base station.

The IKE_SA_INIT Response message carries a redirect request (REDIRECT_REQUEST), and the REDIRECT_REQUEST includes the IP address of the first selected SeGW, and is used to instruct the base station to initiate IPsec tunnel negotiation for the first Selected SeGW.

304. The base station sends an IKE_INIT Request message to the first selected SeGW, and performs IPsec tunnel negotiation with the first selected SeGW.

The IKE_SA_INIT Response message carries a redirect source (REDIRECT_FROM). Here, the base station initiates IPsec tunnel negotiation to the first selected SeGW through the IKE_SA_INIT Response message, so as to redirect the base station to the first Selected SeGW.

It should be noted that the specific process of the IPsec tunnel negotiation may refer to the existing related standards and the requirements of the subsequent related standards, and details are not described herein again. It can be understood that, in order to avoid resource waste, the IKE_SA that has been established between the base station and the Initial SeGW can be deleted before the base station is redirected to the first selected SeGW.

305. The base station records the negotiation result of the IPsec tunnel negotiation with the first selected SeGW, and obtains the redirection result information (REDIRECT_RESULT).

In this embodiment, the REDIRECT_RESULT includes the identifier information of the first selected SeGW and the indication information for indicating whether the negotiation is successful. For example, the identifier information of the first selected SeGW may be IP address information, and the indication information indicating that the negotiation fails may be It is a Last Redirect Failed error code.

The REDIRECT_RESULT includes the Last Redirect Failed error code and the IP address information of the first Selected SeGW as an example to describe how to use the redirect result information to guide the execution of the redirection operation:

306. The base station sends an IKE_SA_INIT Request message to the Initial SeGW again.

In this embodiment, step 306 is different from step 301 in that the IKE_SA_INIT Request message also carries REDIRECT_RESULT.

307, Initial SeGW determines the second Selected SeGW according to REDIRECT_RESULT;

In this embodiment, before performing step 307, it may also be determined whether the IPsec redirection condition is met. If it is determined that the IPsec redirection condition is met, the second Selected SeGW is determined according to REDIRECT_RESULT.

308. The Initial SeGW sends an IKE_SA_INIT Response message to the base station.

The IKE_SA_INIT Response message carries the REDIRECT_REQUEST, and the REDIRECT_REQUEST includes the IP address of the second selected SeGW, and is used to instruct the base station to initiate IPsec tunnel negotiation for the second selected SeGW.

309. The base station sends an IKE_INIT Request message to the second selected SeGW, and performs IPsec tunnel negotiation with the second selected SeGW.

The IKE_SA_INIT Response message carries a redirect source (REDIRECT_FROM). Here, the base station initiates IPsec tunnel negotiation to the second selected SeGW through the IKE_SA_INIT Response message, so as to redirect the base station to the second selected SeGW.

Therefore, by using REDIRECT_RESULT, the Initial SeGW can be instructed to find a selected SeGW (ie, the second selected SeGW) other than the first Selected SeGW for the base station to perform IPsec tunnel negotiation with the base station by the second selected SeGW to avoid the ping-pong effect. .

In this embodiment, if the IPsec tunnel negotiation is prioritized, after the step 306 is performed, the Initial SeGW directly abandons the redirection operation according to the REDIRECT_RESULT, and then continues to negotiate with the base station by the Initial SeGW, and establishes the base station and the Initial SeGW. The communication link between them to serve the base station by the Initial SeGW. In practical applications, it is also possible to set abandonment conditions for abandoning the redirect operation according to actual requirements, and the negotiation fails in REDIRECT_RESULT In the case of step 306, it is first determined whether the abandonment condition is satisfied, and if so, the Initial SeGW directly abandons the redirection operation according to REDIRECT_RESULT.

In this embodiment, the foregoing messages may also be messages corresponding to other names having the same function, which are not limited herein.

It should be noted that, in this embodiment, the IKE_SA_INIT Request message/IKE_SA_INIT Response message corresponds to the IKE init phase of the IPsec tunnel negotiation. Here, only the Initial SeGW sends the REDIRECT_REQUEST to the base station in the IKE init phase as an example. The Initial SeGW can also send the REDIRECT_REQUEST to the base station in the subsequent IKE AUTH/Information phase. At this time, the REDIRECT_RESULT can be carried in the IKE_SA_INIT Response message in the IKE init phase or the IKE_AUTH Request message in the IKE AUTH phase. It can be understood that You only need to ensure that the base station has sent REDIRECT_RESULT to the Initial SeGW before the Initial SeGW sends the REDIRECT_REQUEST to the base station. You can configure it according to actual needs.

Moreover, in this embodiment, the REDIRECT_SUPPORT is not limited to the IKE init phase of the IPsec tunnel negotiation. In other embodiments, the REDIRECT_SUPPORT may also be carried in the IKE_AUTH Request message in the IKE AUTH phase.

The redirection method in the embodiment of the present invention is described above. The initiator device in the embodiment of the present invention is described below. The initiator device is used to negotiate with the responder device. Referring to FIG. 4, the present invention is implemented. An embodiment of an initiator device in an example includes:

The recording unit 401 is configured to: during the negotiation process between the initiator device and the initial responder device, if the initiator device is redirected by the initial responder device to the first target responder device, record the corresponding redirect result information. ;

The sending unit 402 is configured to: when the initiator device initiates the negotiation with the initial responder device, carry the redirection result information in the negotiation message, so that the initial responder device performs according to the redirection result information. A redirection operation, wherein the negotiation message refers to any one of messages sent by the initiator device to the initial responder device during the negotiation process.

For ease of understanding, the internal operation process of the initiator device in this embodiment is described by taking a specific application scenario as an example:

In the negotiation process between the initiator device and the initial responder device, if the initiator device is The initial responder device is redirected to the first target responder device, and the recording unit 401 records the corresponding redirect result information; when the initiator device initiates negotiation with the initial responder device again, the sending unit 402 carries the Redirecting result information, so that the initial responder device performs a redirection operation according to the redirection result information, wherein the negotiation message refers to the initial responder device by the initiator device during the negotiation process Any of the messages sent.

In the technical solution provided by the embodiment of the present invention, in the negotiation process between the initiator and the initial responder, if the initiator is redirected to the first target responder by the initial responder, the recording unit 401 records the corresponding redirect result information. As the redirection history of the initiator in the negotiation process, when the initiator initiates the negotiation with the initial responder, the sending unit 402 carries the foregoing redirection result information in the negotiation message, so that the initial responder according to the weight Directed result information performs a redirect operation. The embodiment of the present invention carries the redirection result information in the negotiation message, so that the initiator can guide the redirection operation according to the redirection history record during the negotiation process, so as to improve the negotiation efficiency.

Optionally, in the embodiment, the redirection result information includes the identifier information of the first target responder device and the indication information used to indicate whether the negotiation is successful.

The sending unit 402 is specifically configured to: if the indication information indicates that the negotiation fails, the redirection result information is carried in the negotiation message, so that the initial responder device sends the initiating according to the redirection result information. The party device is redirected to the second target responder device or the redirection operation is abandoned, wherein the second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, then the negotiation is performed The message carries the redirection result information, so that the initial responder device preferentially redirects the initiator device to the first target responder device according to the redirection result information.

Optionally, in the embodiment, the redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence between the identification information of at least one first target responsive party device and a priority value. And if the initial responder device successfully redirects the initiator device to the first target responder device, increasing a priority value corresponding to the identifier information of the first target responder device, if If the initial responder device fails to redirect the initiator device to the first target responder device, the priority value corresponding to the identifier information of the first target responder device is decreased;

The sending unit 402 is specifically configured to carry the redirection result information in the negotiation message, so that the initial responder device preferentially weights the initiator device according to the redirection result information. Directed to the first target responder device with a high priority value.

Optionally, in this embodiment, the initiator device is a base station; the responder device is a security gateway; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; and the negotiation message includes IPsec tunnel negotiation. The IKE_SA_INIT Request message or the IKE_AUTH Request message in the process.

The initiator device in the embodiment of the present invention is described above from the perspective of a modular functional entity. In the technical solution of the present invention, the initiator device in the embodiment of the present invention may also be described from a hardware processing perspective. 5. Another embodiment of the initiator device in the embodiment of the present invention includes:

The input device 501, the output device 502, the processor 503, and the memory 504 (wherein the number of processors 503 in the initiator device may be one or more, and one processor 503 is taken as an example in FIG. 5). In some embodiments of the present invention, the input device 501, the output device 502, the processor 503, and the memory 504 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.

The processor 503 is configured to perform the following steps by calling an operation instruction stored in the memory 504:

During the negotiation process between the initiator and the initial responder, if the initiator is redirected by the initial responder to the first target responder, the corresponding redirect result information is recorded;

When the initiator initiates the negotiation with the initial responder, the redirection result information is carried in the negotiation message, so that the initial responder performs a redirection operation according to the redirection result information, where the negotiation is performed. The message refers to any one of the messages sent by the initial responder in the initiating direction during the negotiation process, and the initial responder may be the same as or different from the initial responder.

In some embodiments of the present invention, the redirection result information includes the identification information of the first target responder and the indication information indicating whether the negotiation is successful. The processor 503 may be specifically configured to perform the following steps:

If the indication information indicates that the negotiation fails, the redirection result information is carried in the negotiation message, so that the initial responder redirects the initiator to the second target responder according to the redirection result information or Relining the redirecting operation, wherein the second target responder is different from the first target responder;

If the indication message indicates that the negotiation is successful, the redirection result message is carried in the negotiation message. And causing the initial responder to preferentially redirect the initiator to the first target responder according to the redirect result information.

In some embodiments of the present invention, the redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence between the identification information of at least one of the first target responders and the priority value, where And if the initial responder redirects the initiator to the first target responder successfully, increasing a priority value corresponding to the identifier information of the first target responder, if the initial responder If the initiator is redirected to the first target responder, the priority value corresponding to the identifier information of the first target responder is decreased. The processor 503 may be specifically configured to perform the following steps:

The redirection result information is carried in the negotiation message, so that the initial responder preferentially redirects the initiator to the first target responder with a high priority value according to the redirection result information.

In some embodiments of the present invention, the initiator device is a base station; the responder device is a security gateway; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; and the negotiation message includes an IPsec tunnel negotiation process. The IKE_SA_INIT Request message or the IKE_AUTH Request message.

The initiator device in the embodiment of the present invention is described above. The responder device in the embodiment of the present invention is described below. The responder device is used to negotiate with the initiator device. Referring to FIG. 6, the present invention is implemented. An embodiment of the responder device in the example includes:

The responder device is an initial responder device, and the initial responder device includes:

The receiving unit 601 is configured to: when the initiator device initiates the negotiation with the initial responder device, receive the negotiation message sent by the initiator device, where the negotiation message carries the redirection result information, where the redirection result information is Recorded by the initiator in the negotiation process with the initial responder if the initiator is redirected to the first target responder by the initial responder; the negotiation message refers to the initiator device in the negotiation process Said any one of the messages sent by the initial responder device;

The executing unit 602 is configured to perform a redirection operation according to the redirection result information.

For ease of understanding, the internal operation process of the responder device in this embodiment is described by taking a specific application scenario as an example:

When the initiator device initiates a negotiation with the initial responder device, the receiving unit 601 receives the negotiation message sent by the initiator device, where the negotiation message carries the redirection result information, where the weight is The orientation result information is obtained by the initiator when the initiator is redirected to the first target responder by the initial responder during the negotiation process with the initial responder; the negotiation message refers to the initiation by the negotiation process. Any one of the messages sent by the party device to the initial responder device; the execution unit 602 performs a redirect operation according to the redirect result information.

The executing unit 602 is specifically configured to: if the indication information indicates that the negotiation fails, redirect the initiator device to the second target responder device or abandon the redirect operation according to the redirect result information, where The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, the initiator device is preferentially redirected to the first according to the redirect result information Target responder device.

The executing unit 602 is specifically configured to preferentially redirect the initiator device to the first target responder device with a high priority value according to the redirection result information.

Optionally, in this embodiment, the responder device is a security gateway; the initiator device is a base station; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; and the negotiation message includes IPsec tunnel negotiation. The IKE_SA_INIT Request message or the IKE_AUTH Request message in the process.

The responsive device in the embodiment of the present invention is described above from the perspective of a modular functional entity. In the technical solution of the present invention, the responsive device in the embodiment of the present invention may also be described from the perspective of hardware processing. 7. Another embodiment of the responder device in the embodiment of the present invention includes:

The input device 701, the output device 702, the processor 703, and the memory 704 (wherein the number of processors 703 in the responder device may be one or more, and one processor 703 is taken as an example in FIG. 7). In some embodiments of the invention, input device 701, output device 702, processor 703, and storage The 704 can be connected by a bus or other means, wherein the connection by a bus is taken as an example in FIG.

The processor 703 is configured to perform the following steps by calling an operation instruction stored in the memory 704:

Receiving, by the initiator, the negotiation message sent by the initiator, where the negotiation message carries the redirection result information, where the redirection result information is sent by the initiator and the initial responder. If the initiator is redirected to the first target responder by the initial responder during the negotiation process, the negotiation message refers to any one of the messages sent by the originating party to the initial responder during the negotiation process. The initial responder may be the same as or different from the initial responder;

Performing a redirection operation according to the redirection result information.

In some embodiments of the present invention, the redirection result information includes the identification information of the first target responding party and the indication information indicating whether the negotiation is successful. The processor 703 may be specifically configured to perform the following steps:

If the indication information indicates that the negotiation fails, the initiator is redirected to the second target responder or the redirect operation is abandoned according to the redirect result information, wherein the second target responder is different from the first a target responder;

If the indication message indicates that the negotiation is successful, the initiator is preferentially redirected to the first target responder according to the redirect result information.

In some embodiments of the present invention, the redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence between the identification information of at least one of the first target responders and the priority value, where And if the initial responder redirects the initiator to the first target responder successfully, increasing a priority value corresponding to the identifier information of the first target responder, if the initial responder If the initiator is redirected to the first target responder, the priority value corresponding to the identifier information of the first target responder is decreased. The processor 703 may be specifically configured to perform the following steps:

The initiator is preferentially redirected to the first target responder with a high priority value according to the redirection result information.

In some embodiments of the present invention, the responder device is a security gateway; the initiator device is a base station; the negotiation is an IPsec tunnel negotiation between the base station and the security gateway; the negotiation message packet The IKE_SA_INIT Request message or the IKE_AUTH Request message during the IPsec tunnel negotiation process.

The initiator device and the responder device in the embodiment of the present invention are described above. The following describes the redirection system in the embodiment of the present invention. Referring to FIG. 8, an embodiment of the redirection system in the embodiment of the present invention includes an initiator. The device 801 and the responder device for negotiating with the initiator device, the responder device is an initial responder device 802;

The initiator device 801 is configured to: during the negotiation process between the initiator device and the initial responder device, if the initiator device is redirected by the initial responder device to the first target responder device, the record corresponds to Redirecting result information; when the initiator device initiates negotiation with the initial responder device, the redirection result information is carried in the negotiation message, so that the initial responder device performs according to the redirection result information. a redirecting operation, wherein the negotiation message refers to any one of messages sent by the initiator device to the initial responder device during the negotiation process;

The initial responder device 802 is configured to: when the initiator device initiates negotiation with the initial responder device, receive the negotiation message sent by the initiator device;

The initial responder device 802 is further configured to perform a redirection operation according to the redirection result information.

The initial responder device 802 is specifically configured to: if the indication information indicates that the negotiation fails, redirect the initiator device to the second target responder device according to the redirect result information or discard the redirect operation, where The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, the initiator device is preferentially redirected to the The first target responder device.

The initial responder device 802 is specifically configured to preferentially redirect the initiator device to a first target responder device with a high priority value according to the redirect result information.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. , including a number of instructions to make a computer device (which can be a personal computer, a server, Or a network device or the like) performing all or part of the steps of the method of the various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

A redirection method, the method comprising:

During the negotiation process between the initiator and the initial responder, if the initiator is redirected by the initial responder to the first target responder, the initiator records the corresponding redirect result information;

When the initiator initiates the negotiation with the initial responder, the initiator carries the redirection result information in the negotiation message, so that the initial responder performs a redirection operation according to the redirection result information, where The negotiation message refers to any one of the messages sent by the originating party to the initial responder during the negotiation process.
The redirection method according to claim 1, wherein the redirection result information includes identification information of the first target responding party and indication information indicating whether the negotiation is successful;

And the performing, by the initiator, the redirection result information in the negotiation message, so that the initial responding party performs the redirection operation according to the redirection result information, including:

If the indication information indicates that the negotiation fails, the initiator carries the redirection result information in the negotiation message, so that the initial responder redirects the initiator to the second according to the redirection result information. The target responder or abandon the redirect operation, wherein the second target responder is different from the first target responder;

If the indication message indicates that the negotiation is successful, the initiator carries the redirection result information in the negotiation message, so that the initial responder preferentially redirects the initiator to the redirection result according to the redirection result information. The first target responder.
The redirection method according to claim 1, wherein

The redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence between the identification information of at least one of the first target responders and the priority value, wherein if the initial responder If the initiator is redirected to the first target responder, the priority value corresponding to the identifier information of the first target responder is raised, and if the initial responder redirects the initiator to the first target response If the party fails, the priority value corresponding to the identification information of the first target responder is reduced;

And the performing, by the initiator, the redirection result information in the negotiation message, so that the initial responding party performs the redirection operation according to the redirection result information, including:

The initiator carries the redirection result information in a negotiation message, so that the initial response The party preferentially redirects the initiator to the first target responder with a high priority value according to the redirect result information.
The redirection method according to any one of claims 1 to 3, wherein the negotiation is an IPsec tunnel negotiation between a base station and a security gateway;

The negotiation message includes an Internet Key Exchange-Security Association-Initialization Request IKE_SA_INIT Request message or an Internet Key Exchange-Authentication Request IKE_AUTH Request message during IPsec tunnel negotiation.
A redirection method, the method comprising:

When the initiator initiates the negotiation with the initial responder, the initial responder receives the negotiation message sent by the initiator, and the negotiation message carries the redirect result information, where the redirect result information is initiated by the initiator. Recording is obtained when the initiator is redirected to the first target responder by the initial responder during the negotiation with the initial responder; the negotiation message is sent by the initial responder by the originating direction during the negotiation process. Any one of the messages, the initial responder may be the same as the initial responder, or may be different;

The initial responder performs a redirection operation according to the redirection result information.
The redirection method according to claim 5, wherein the redirection result information includes identification information of the first target responder and indication information indicating whether the negotiation is successful;

And performing, by the initial responder, the redirection operation according to the redirection result information includes:

If the indication information indicates that the negotiation fails, the initial responder redirects the initiator to the second target responder or abandons the redirect operation according to the redirect result information, wherein the second target responder Different from the first target responder;

If the indication message indicates that the negotiation is successful, the initial responder preferentially redirects the initiator to the first target responder according to the redirect result information.
The redirection method according to claim 5, wherein the redirection result information comprises a correspondence relationship table, wherein the correspondence relationship table is established with at least one identification information of the first target responding party and a priority value Corresponding relationship, wherein if the initial responder redirects the initiator to the first target responder, the priority value corresponding to the identifier information of the first target responder is increased, if If the initial responder fails to redirect the initiator to the first target responder, the priority value corresponding to the identifier information of the first target responder is decreased;

And performing, by the initial responder, the redirection operation according to the redirection result information includes:

The initial responder preferentially redirects the initiator to a first target responder with a high priority value according to the redirect result information.
The redirection method according to any one of claims 5 to 7, wherein the negotiation is an IPsec tunnel negotiation between the base station and the security gateway;

The negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during an IPsec tunnel negotiation process.
An initiator device, configured to negotiate with a responder device, where the device includes:

a recording unit, configured to: during the negotiation process between the initiator device and the initial responder device, if the initiator device is redirected by the initial responder device to the first target responder device, record corresponding redirection result information;

a sending unit, configured to: when the initiator device initiates negotiation with the initial responder device, carry the redirection result information in the negotiation message, so that the initial responder device performs heavy according to the redirection result information. A directed operation, wherein the negotiation message refers to any one of messages sent by the initiator device to the initial responder device during the negotiation process.
The initiator device according to claim 9, wherein the redirection result information includes identification information of the first target responder device and indication information for indicating whether the negotiation is successful;

The sending unit is configured to: if the indication information indicates that the negotiation fails, the redirection result information is carried in the negotiation message, so that the initial responder device sends the initiator according to the redirection result information. Redirecting the device to the second target responder device or abandoning the redirect operation, wherein the second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, then the negotiation message is And carrying the redirection result information, so that the initial responder device preferentially redirects the initiator device to the first target responder device according to the redirection result information.
The initiator device of claim 9 wherein:

The redirection result information includes a correspondence relationship table, where the correspondence relationship table establishes a correspondence relationship between the identification information of at least one first target responsive party device and a priority value, where If the initial responder device redirects the initiator device to the first target responder device, the priority value corresponding to the identifier information of the first target responder device is increased, if the initial responder device If the initiator device fails to redirect to the first target responder device, the priority value corresponding to the identifier information of the first target responder device is decreased;

The sending unit is configured to carry the redirection result information in the negotiation message, so that the initial responder device preferentially redirects the initiator device to a high priority value according to the redirection result information. The first target responder device.
The initiator device according to any one of claims 9 to 11, wherein the initiator device is a base station; the responder device is a security gateway; and the negotiation is IPsec between the base station and the security gateway. Tunnel negotiation; the negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during an IPsec tunnel negotiation process.
A responder device, configured to negotiate with an initiator device, where the responder device is an initial responder device, wherein the initial responder device includes:

The receiving unit is configured to: when the initiator device initiates the negotiation with the initial responder device, receive the negotiation message sent by the initiator device, where the negotiation message carries the redirection result information, where the redirection result information is The initiator obtains the record when the initiator is redirected to the first target responder by the initial responder during the negotiation with the initial responder; the negotiation message refers to the initiator device in the negotiation process to the Any one of the messages sent by the initial responder device;

An execution unit, configured to perform a redirection operation according to the redirection result information.
The responder device according to claim 13, wherein the redirection result information includes identification information of the first target responder device and indication information indicating whether the negotiation is successful;

The executing unit is specifically configured to: if the indication information indicates that the negotiation fails, redirect the initiator device to the second target responder device or abandon the redirect operation according to the redirect result information, where the The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, preferentially redirecting the initiator device to the first target according to the redirect result information Responder device.
The responder device according to claim 13, wherein the redirection result information comprises a correspondence relationship table, and the correspondence relationship table is established with at least one of the first target responders Corresponding relationship between the identification information of the device and the priority value, wherein if the initial responder device redirects the initiator device to the first target responder device, the first target responder is improved And the priority value corresponding to the identifier information of the device, if the initial responder device fails to redirect the initiator device to the first target responder device, reducing the identifier information corresponding to the first target responder device Priority value

The executing unit is specifically configured to preferentially redirect the initiator device to a first target responder device with a high priority value according to the redirect result information.
The responder device according to any one of claims 13 to 15, wherein the responder device is a security gateway; the initiator device is a base station; and the negotiation is between a base station and a security gateway. The IPsec tunnel negotiation; the negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during the IPsec tunnel negotiation process.
A redirection system includes an initiator device and a responder device for negotiating with the initiator device, where the responder device is an initial responder device, and is characterized by:

The initiator device is configured to: during the negotiation process between the initiator device and the initial responder device, if the initiator device is redirected by the initial responder device to the first target responder device, record the corresponding Redirecting result information; when the initiator device initiates negotiation with the initial responder device, the redirection result information is carried in the negotiation message, so that the initial responder device performs heavy according to the redirection result information. Directed operation, wherein the negotiation message refers to any one of messages sent by the initiator device to the initial responder device during the negotiation process;

The initial responder device is configured to: when the initiator device initiates negotiation with the initial responder device, receive the negotiation message sent by the initiator device;

The initial responder device is further configured to perform a redirection operation according to the redirection result information.
The redirection system according to claim 17, wherein the redirection result information includes identification information of the first target responder device and indication information for indicating whether the negotiation is successful;

The initial responder device is specifically configured to redirect the initiator device to the second target responder device or abandon the redirect operation according to the redirect result information, if the indication information indicates that the negotiation fails, where The second target responder device is different from the first target responder device; if the indication message indicates that the negotiation is successful, the sending is preferentially selected according to the redirecting result information. The originating device is redirected to the first target responder device.
The redirection system according to claim 17, wherein the redirection result information comprises a correspondence relationship table, and the correspondence relationship table is configured with at least one identification information and a priority value of the first target responder device. Corresponding relationship, wherein if the initial responder device redirects the initiator device to the first target responder device successfully, the priority corresponding to the identifier information of the first target responder device is increased a value, if the initial responder device fails to redirect the initiator device to the first target responder device, reducing a priority value corresponding to the identifier information of the first target responder device;

The initial responder device is specifically configured to preferentially redirect the initiator device to a first target responder device with a high priority value according to the redirect result information.
The redirection system according to any one of claims 17 to 19, wherein: the initiator device is a base station; the responder device is a security gateway; and the negotiation is IPsec between the base station and the security gateway. Tunnel negotiation; the negotiation message includes an IKE_SA_INIT Request message or an IKE_AUTH Request message during an IPsec tunnel negotiation process.