WO2018223488A1 - 一种加速代理设备、加速代理方法以及一种内容管理系统 - Google Patents

一种加速代理设备、加速代理方法以及一种内容管理系统 Download PDF

Info

Publication number
WO2018223488A1
WO2018223488A1 PCT/CN2017/092756 CN2017092756W WO2018223488A1 WO 2018223488 A1 WO2018223488 A1 WO 2018223488A1 CN 2017092756 W CN2017092756 W CN 2017092756W WO 2018223488 A1 WO2018223488 A1 WO 2018223488A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
module
access request
acceleration
bridge
Prior art date
Application number
PCT/CN2017/092756
Other languages
English (en)
French (fr)
Inventor
谢文伟
林剑影
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP17900277.9A priority Critical patent/EP3432550B1/en
Priority to US16/062,961 priority patent/US10951438B1/en
Publication of WO2018223488A1 publication Critical patent/WO2018223488A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to an acceleration proxy device, an acceleration proxy method, and a content management system.
  • a VLAN Virtual Local Area Network
  • the trunk technology is used to interconnect switches, allowing different VLANs to communicate with the same VLAN in other switches over a shared link.
  • Acceleration proxy devices can typically be deployed in the uplink of core switches in the customer network environment and downlinks in Network Address Translation (NAT) devices.
  • NAT Network Address Translation
  • the existing accelerated proxy device cannot be deployed on the trunk line because it does not support multiple VLAN bridges, the application layer return source address is determined by the system, and does not support multi-network segment routing, and thus does not support multi-VLAN wear. through. If the acceleration agent device is deployed on the NAT device, since the security protection of the client is deployed on the NAT device, the acceleration agent device needs to bear the security risk at this time. It can be seen from the above that the current accelerated proxy device cannot be integrated with the VLAN technology.
  • an embodiment of the present invention provides an acceleration proxy device, an acceleration proxy method, and a content management system.
  • the technical solution is as follows:
  • an acceleration proxy device includes a network module, an application acceleration module, and a policy routing module, wherein the network module includes at least one bridge, each bridge Associated with the IP address network segment; the policy routing module stores a routing table of the at least one bridge, and the routing table of each of the bridges includes a gateway corresponding to the bridge; the network module is used Receiving, by the target bridge, an access request from the target IP address network segment, and forwarding the access request to the application acceleration module; the application acceleration module is configured to bind the IP address of the target bridge to the Accessing the source IP address of the request and forwarding the access request bound to the source IP address; the policy routing module is configured to query the target gateway corresponding to the access request bound to the source IP address, and use the network module to An access request bound to the source IP address is sent to the target gateway to send the access request with the source IP address bound to the server through the target gateway.
  • acceleration proxy device is disposed in a relay link between the switch and the network address translation device.
  • the network module is a local area network module used in a VLAN environment.
  • the network module is further configured to remove the local area network identifier carried in the access request, and forward the access request for removing the local area network identifier to the application acceleration module.
  • the network module is further configured to receive an access request that is bound to the source IP address and sent by the policy routing module, and add the local area identifier to the access request that is bound to the source IP address, and then send the At the target gateway.
  • the network module is further configured to receive the response data that is sent by the server, and forward the response data to the application acceleration module, where the response data carries a destination IP address;
  • the application acceleration module is configured to forward the response data to a user pointed to by the destination IP address;
  • the policy routing module is configured to query a bridge corresponding to the destination IP address, and send the response data to the user by using the bridge that is queried.
  • the network module is further configured to remove the local area network identifier carried in the response data, and forward the response data that removes the local area network identifier to the application acceleration module.
  • the network module is further configured to receive response data sent by the policy routing module, and add the response data to the local area network identifier and send the response data to the user.
  • a content management system includes the above-described accelerated proxy device.
  • an accelerated proxy method comprising:
  • the network module receives the access request from the target IP address network segment through the target bridge, and forwards the access request to the application acceleration module;
  • the application acceleration module binds the IP address of the target bridge to the source IP address of the access request and forwards the access request bound to the source IP address;
  • the policy routing module queries the target gateway corresponding to the access request to which the source IP address is bound, and sends the access request with the source IP address bound to the target gateway through the network module to pass the The target gateway sends the access request with the source IP address bound to the server.
  • the method further includes:
  • the network module is configured to remove a local area network identifier carried in the access request, and forward the access request for removing the local area network identifier to the application acceleration module.
  • the method further includes:
  • the network module receives the access request that is bound to the source IP address sent by the policy routing module, and adds the local area identifier to the access request that is bound to the source IP address, and then sends the access request to the target gateway.
  • the method further includes:
  • the network module receives the response data fed back by the server, and forwards the response data to the application acceleration module, where the response data carries a destination IP address;
  • the application acceleration module is configured to forward the response data to a user pointed to by the destination IP address;
  • the policy routing module is configured to query a bridge corresponding to the destination IP address, and send the response data to the user by using the bridge that is queried.
  • a content management system includes a memory, the instructions stored by the memory being used to perform the accelerated proxy method described above.
  • a content management system includes a processor for performing the accelerated proxy method described above.
  • the technical solution provided by the embodiment of the present invention has the beneficial effects that the network module in the present invention can provide corresponding bridges for the local area networks of different IP address network segments, so that when the application acceleration module issues a user access request,
  • the IP address of the corresponding bridge can be bound to the source IP address of the access request according to the IP address network segment where the access request is located.
  • the policy routing module can determine the default gateway corresponding to each bridge, so that the gateway that sends the access request can be queried according to the source IP address in the access request, so that the query can be sent to the server through the queried gateway.
  • the policy corresponding to the destination IP address can be used to query the bridge corresponding to the destination IP address according to the destination IP address in the response data, so that the response can be sent to the user through the direct route of the bridge. data.
  • the acceleration proxy device, the acceleration proxy method, and the content management system provided by the present invention can be deployed in a trunk link, so as to be able to integrate with the current VLAN technology and enhance the network adaptation capability of the device transparent proxy function.
  • Embodiment 1 is a schematic diagram of a network topology in Embodiment 1 of the present invention.
  • FIG. 2 is a schematic structural diagram of a content management system with an acceleration proxy device according to Embodiment 1 of the present invention
  • FIG. 3 is a schematic diagram of interaction of each module in an acceleration proxy device according to Embodiment 1 of the present invention.
  • Embodiment 4 is a flow chart of an acceleration proxy method in Embodiment 2 of the present invention.
  • Embodiments of the present application provide an accelerated proxy device and a content management system having the accelerated proxy device.
  • the acceleration proxy device may be located in a trunk link between a switch and a network address translation NAT device. Both the switch and the NAT device can have a trunk interface, and the trunk link can be formed between the two trunk interfaces.
  • a pair of physical network cards eth0 and eth1 may be provided, and the two physical network cards may respectively perform data interaction with the switch or the NAT device.
  • the acceleration proxy device may include a network module, an application acceleration module, and a policy routing module.
  • the network module is specifically a LAN VLAN module, and includes at least one bridge, each bridge is associated with an IP address network segment; and the policy routing module stores a routing table of the at least one bridge, where each The routing table of the bridge includes the gateway corresponding to the bridge. That is to say, multiple VLANs can be created in the VLAN module, and each bridge can correspond to one VLAN. In this way, each bridge can be associated with an IP address segment of a VLAN. In this way, the same effect as the trunk link can be achieved, that is, multiple VLANs share one physical link.
  • the VLAN module can create two virtual network cards and bridge the created virtual network card to the bridge.
  • the IP address of the VLAN is 192.168.1.0/24.
  • Two virtual NICs are bridged to the bridge br_vlan101.
  • the bridge br_vlan101 can be configured with the bridge IP192.168.1.2, and the default gateway can be set to 192.168.1.1 for the bridge.
  • the corresponding relationship between the bridge and the gateway can be stored in the policy routing module as a routing table.
  • the network module may be configured to receive an access request from a target IP address network segment through the target bridge, and forward the access request to the application acceleration module.
  • a VLAN with a VLAN ID of 101 can be used as the target IP address network segment.
  • the bridge br_vlan 101 corresponding to the VLAN 101 can serve as the target bridge.
  • the user access request from VLAN 101 can be received by bridge br_vlan 101.
  • the access request can be sent to the application acceleration module.
  • the local area network identifier and the source IP address of the user who sent the access request may be included. site.
  • the network module may be further configured to remove the local area network identifier carried in the access request, and remove the access request of the local area network identifier. Forward to the application acceleration module.
  • the application acceleration module may bind the IP address of the target bridge to the source IP address of the access request and forward the access request bound to the source IP address. Specifically, after the application acceleration module receives the access request, it may be determined that the source IP address in the access request belongs to the 192.168.1.0/24 network segment, so that the IP address of the target bridge corresponding to the network segment may be used as the source IP address. Bind to this access request. Thus, the source IP address of the access request can be the IP address 192.168.1.2 of the bridge br_vlan101. After the source IP address is bound, the application acceleration module can forward the access request.
  • the policy routing module may query the target gateway corresponding to the access request bound to the source IP address. Specifically, in the routing table, a correspondence between an IP address of the bridge and an IP address of the gateway may be recorded. Thus, for the bridge IP address 192.168.1.2, the IP address of the corresponding gateway can be 192.168.1.1. In this way, after the target gateway is queried, the access request bound to the source IP address may be sent to the target gateway by the network module, so that the source IP address is bound by the gateway. The access request is sent to the server.
  • the network module when the network module sends an access request, it also needs to add a corresponding local area network identifier for the access request.
  • the network module may receive an access request with the source IP address sent by the policy routing module, and add the local area identifier to the access request bound to the source IP address, and then send the request to the target gateway.
  • the local area network identifier may be the same as the previously removed local area network identifier, for example, may be VLAN 101.
  • the server may feed back the response data to the acceleration proxy device in response to the received access request.
  • the server may use the source IP address in the access request as the destination IP address of the response data, thereby transmitting response data to the destination IP address.
  • the source IP address in the access request is bound by the application acceleration module to the IP address of the bridge, so the destination IP address in the response data can be the IP address of the bridge.
  • the destination IP address may be the IP address 192.168.1.2 of the bridge br_vlan 101.
  • the IP address of the user who actually sends the access request may be provided.
  • the IP address of the user may also be included.
  • the network module may receive response data fed back by the server, and Forwarding the response data to the application acceleration module, where the response data carries a destination IP address.
  • the network module may remove the local area network identifier carried in the response data. For example, VLAN 101 can be removed. And the response data for removing the local area network identifier may be forwarded to the application acceleration module.
  • the application acceleration module may forward the response data to the destination IP address by using the policy routing module according to the destination IP address carried in the response data.
  • the policy routing module may query the bridge corresponding to the destination IP address, and send the response data to the user by using the bridge that is queried.
  • the IP address of each bridge can be recorded in the routing table.
  • the policy routing module can query the corresponding bridge to be br_vlan101 according to the destination IP address 192.168.1.2.
  • the response data can be sent to the terminal pointed to by the user's IP address through the direct route of the bridge br_vlan101.
  • the response data sent by the application acceleration module is data with the LAN identifier removed, and after receiving the response data sent by the policy routing module, the bridge in the network module receives the response data sent by the policy routing module.
  • the response data may be added to the local area network identifier and sent to the user.
  • the present application further discloses an acceleration proxy method, where the method includes:
  • the network module receives an access request from the target IP address network segment through the target bridge, and forwards the access request to the application acceleration module;
  • the application acceleration module binds the IP address of the target bridge to the source IP address of the access request and forwards the access request bound to the source IP address.
  • the policy routing module queries the target gateway corresponding to the access request with the source IP address, and sends the access request with the source IP address bound to the target gateway through the network module to pass the The target gateway sends the access request with the source IP address bound to the server.
  • the method further includes:
  • the network module is configured to remove a local area network identifier carried in the access request, and forward the access request for removing the local area network identifier to the application acceleration module.
  • the method further includes:
  • the network module receives an access request that is sent by the policy routing module and is bound to a source IP address, where And adding the local area identifier to the access request bound to the source IP address, and sending the request to the target gateway.
  • the method further includes:
  • the network module receives the response data fed back by the server, and forwards the response data to the application acceleration module, where the response data carries a destination IP address;
  • the application acceleration module forwards the response data to a user pointed by the destination IP address by using the policy routing module;
  • the policy routing module is configured to query a bridge corresponding to the destination IP address, and send the response data to the user by using the bridge that is queried.
  • the present application also discloses a content management system including a memory, the instructions stored by the memory being operable to perform the accelerated proxy method described above.
  • the application also discloses a content management system, the content management system comprising a processor, the processor being operative to perform the accelerated proxy method described above.
  • the memory may be a memory device for storing information.
  • a device capable of storing binary data may be a memory; in an integrated circuit, a circuit having a storage function without a physical form may also be a memory such as a RAM, a FIFO, etc.; in the system, having a physical form of storage
  • the device can also be called a memory, such as a memory stick, a TF card, or the like.
  • the processor can be implemented in any suitable manner.
  • a processor can employ, for example, a microprocessor or processor and a computer readable medium, logic gate, switch, or application-specific integrated circuit (such as software or firmware) that can be executed by the (micro)processor.
  • ASIC Application Specific Integrated Circuit
  • programmable logic controller programmable logic controller and embedded microcontroller form, etc. This application is not limited.
  • the network module in the present invention can provide a corresponding bridge for the local area network of different IP address network segments, so that when the application acceleration module is issuing the user, When accessing the request, the IP address of the corresponding bridge can be bound to the source IP address of the access request according to the IP address network segment where the access request is located.
  • the policy routing module Through the policy routing module, the default gateway corresponding to each bridge can be determined, so that the query can be started according to the source IP address in the access request. The gateway that sent the access request, so that the access request can be sent to the server through the queried gateway.
  • the policy corresponding to the destination IP address can be used to query the bridge corresponding to the destination IP address according to the destination IP address in the response data, so that the response can be sent to the user through the direct route of the bridge. data.
  • the acceleration proxy device, the acceleration proxy method, and the content management system provided by the present invention can be deployed in the trunk link, so as to be able to integrate with the current VLAN technology and enhance the network adaptation capability of the device transparent proxy function.

Abstract

本发明公开了一种加速代理设备、加速代理方法以及一种内容管理系统，其中，所述加速代理设备包括网络模块、应用加速模块以及策略路由模块，其中，所述网络模块中包括至少一个网桥，每个网桥与IP地址网段相关联；所述策略路由模块中存储所述至少一个网桥的路由表，每个所述网桥的路由表中包含所述网桥对应的网关。本发明提供的加速代理设备及加速代理方法，能够部署在trunk链路中，从而能够与当前的VLAN技术相融合，增强设备透明代理功能的网络适配能力。

Description

一种加速代理设备、加速代理方法以及一种内容管理系统 技术领域
本发明涉及互联网技术领域，特别涉及一种加速代理设备、加速代理方法以及一种内容管理系统。
背景技术
在现有的网络部署中，VLAN(Virtual Local Area Network，虚拟局域网)是常被用到的技术。在路由/交换领域，VLAN的中继端口叫做trunk。trunk技术用在交换机之间互连，使不同VLAN通过共享链路与其它交换机中的相同VLAN通信。目前，为了能够针对用户的请求提供缓存响应和回源链路优化等服务，通常需要在网络中加入加速代理设备。加速代理设备通常可以部署在客户网络环境的核心交换机的上联以及网络地址转换(Network Address Translation，NAT)设备的下联。
在核心交换机与NAT设备之间通过trunk连接时，现有的加速代理设备存在以下弊端：
现有的加速代理设备由于不支持多VLAN的网桥、应用层回源地址由系统决定、不支持多网段路由选择等多方面的原因，无法部署在trunk线路上，从而不支持多VLAN穿透。而如果将加速代理设备部署在NAT设备的上联，由于客户的安全防护多部署在NAT设备上，所以加速代理设备此时就需要承担安全风险。由上可见，当前的加速代理设备无法与VLAN技术相融合。
发明内容
为了解决现有技术的问题，本发明实施例提供了一种加速代理设备、加速代理方法以及一种内容管理系统。所述技术方案如下：
一方面，一种加速代理设备，所述加速代理设备包括网络模块、应用加速模块以及策略路由模块，其中，所述网络模块中包括至少一个网桥，每个网桥 与IP地址网段相关联；所述策略路由模块中存储所述至少一个网桥的路由表，每个所述网桥的路由表中包含所述网桥对应的网关；所述网络模块用于通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至所述应用加速模块；所述应用加速模块用于将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求；所述策略路由模块用于查询所述绑定了源IP地址的访问请求对应的目标网关，并通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述目标网关将所述绑定了源IP地址的访问请求发送至服务器处。
进一步地，所述加速代理设备设置于交换机和网络地址转换设备之间的中继链路中。
进一步地，所述网络模块是用于VLAN环境下的局域网模块。
进一步地，所述网络模块还用于将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
进一步地，所述网络模块还用于接收所述策略路由模块发来的绑定了源IP地址的访问请求，并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。
进一步地，所述网络模块还用于接收所述服务器反馈的响应数据，并将所述响应数据转发至所述应用加速模块，其中，所述响应数据中携带目的IP地址；
所述应用加速模块用于向所述目的IP地址指向的用户转发所述响应数据；
所述策略路由模块用于查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。
进一步地，所述网络模块还用于将所述响应数据中携带的局域网标识去除，并将去除局域网标识的响应数据转发至所述应用加速模块。
进一步地，所述网络模块还用于接收所述策略路由模块发来的响应数据，并将所述响应数据添加局域网标识后发送至所述用户处。
另一方面，一种内容管理系统，包括上述的加速代理设备。
另一方面，一种加速代理方法，所述方法包括：
网络模块通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至应用加速模块；
所述应用加速模块将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求；
策略路由模块查询所述绑定了源IP地址的访问请求对应的目标网关，并通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述目标网关将所述绑定了源IP地址的访问请求发送至服务器处。
进一步地，所述方法还包括：
所述网络模块是用于VLAN环境下的局域网模块，将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
进一步地，所述方法还包括：
所述网络模块接收所述策略路由模块发来的绑定了源IP地址的访问请求，并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。
进一步地，所述方法还包括：
所述网络模块接收所述服务器反馈的响应数据，并将所述响应数据转发至所述应用加速模块，其中，所述响应数据中携带目的IP地址；
所述应用加速模块用于向所述目的IP地址指向的用户转发所述响应数据；
所述策略路由模块用于查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。
另一方面，一种内容管理系统，所述内容管理系统包括存储器，所述存储器所存储的指令用于执行上述的加速代理方法。
另一方面，一种内容管理系统，所述内容管理系统包括处理器，所述处理器用于执行上述的加速代理方法。
本发明实施例提供的技术方案带来的有益效果是：本发明中的网络模块可以为不同IP地址网段的局域网分别提供对应的网桥，这样，当应用加速模块在发出用户的访问请求时，可以根据访问请求所处的IP地址网段，将相应的网桥的IP地址绑定为访问请求的源IP地址。通过策略路由模块，可以确定各个网桥对应的默认网关，从而可以根据访问请求中的源IP地址，查询出发送该访问请求的网关，从而能够通过查询的网关向服务器发送访问请求。此外，在接收到服务器反馈的响应数据时，可以根据响应数据中的目的IP地址，通过策略路由模块查询到目的IP地址对应的网桥，从而可以通过网桥的直连路由向用户发送该响应数据。由此可见，本发明提供的加速代理设备、加速代理方法和内容管理系统，能够部署在trunk链路中，从而能够与当前的VLAN技术相融合，增强设备透明代理功能的网络适配能力。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例一中网络拓扑示意图；
图2是本发明实施例一中具有加速代理设备的内容管理系统的结构示意图；
图3是本发明实施例一中加速代理设备中各个模块的交互示意图；
图4是本发明实施例二中加速代理方法的流程图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明 实施方式作进一步地详细描述。
实施例一
本申请实施方式提供一种加速代理设备和具有所述加速代理设备的内容管理系统。请参阅图1，所述加速代理设备可以位于交换机和网络地址转换NAT设备之间的中继(trunk)链路中。所述交换机和NAT设备上均可以具备trunk接口，两个trunk接口之间便可以形成所述trunk链路。在所述加速代理设备上，可以具备一对物理网卡eth0和eth1，这两个物理网卡可以分别与交换机或NAT设备进行数据交互。
请参阅图1至图3，在本实施方式中，所述加速代理设备中可以包括网络模块、应用加速模块以及策略路由模块。其中，所述网络模块具体为局域网VLAN模块，包括至少一个网桥，每个网桥与IP地址网段相关联；所述策略路由模块中存储所述至少一个网桥的路由表，每个所述网桥的路由表中包含所述网桥对应的网关。也就是说，所述VLAN模块的可以创建多个网桥，每个网桥可以与一个VLAN相对应。这样，每个网桥可以与VLAN的IP地址段相关联。这样便可以达到与trunk链路相同的作用，即多个VLAN共享一条物理链路。
具体地，在本实施方式中，针对每个VLAN，VLAN模块可以创建两个虚拟网卡，并将创建的虚拟网卡桥接至网桥上。例如，对于VLAN标识为101的VLAN，该VLAN的IP地址网段为192.168.1.0/24，可以在物理网卡eth0和eth1上分别创建eth0.101和eth1.101这两个虚拟网卡，并将这两个虚拟网卡桥接至网桥br_vlan101上。同时，可以给网桥br_vlan101配置网桥IP192.168.1.2，同时可以为该网桥设置默认网关为192.168.1.1，上述的网桥与网关的对应关系可以作为路由表存储于策略路由模块中。
在本实施方式中，所述网络模块可以用于通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至所述应用加速模块。以VLAN标识为101的VLAN为例，该VLAN 101的IP地址网段192.168.1.0/24可以作为所述目标IP地址网段，该VLAN 101对应的网桥br_vlan101可以作为所述目标网桥。那么来自VLAN 101中的用户访问请求均可以被网桥br_vlan101接收。在网桥br_vlan101接收到访问请求后，可以将该访问请求发送至应用加速模块。在所述访问请求中，可以包括局域网标识以及发送该访问请求的用户的源IP地 址。在实际应用过程中，发送至应用层的数据中均需要将局域网标识去除，因此，所述网络模块还可以用于将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
在本实施方式中，所述应用加速模块可以将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求。具体地，在应用加速模块接收到访问请求后，可以判定访问请求中的源IP地址属于192.168.1.0/24网段，从而可以将该网段对应的目标网桥的IP地址作为源IP地址，绑定至该访问请求中。这样，该访问请求的源IP地址便可以为网桥br_vlan101的IP地址192.168.1.2。在绑定了源IP地址后，应用加速模块可以向外转发该访问请求。
该访问请求在被转发后，所述策略路由模块可以查询所述绑定了源IP地址的访问请求对应的目标网关。具体地，在所述路由表中，可以记录网桥的IP地址与网关的IP地址之间的对应关系。这样，针对网桥IP地址192.168.1.2而言，其对应的网关的IP地址可以为192.168.1.1。这样，在查询到目标网关之后，可以通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述网关将所述绑定了源IP地址的访问请求发送至服务器处。
在实际应用过程中，网络模块在发送访问请求时，还需要为该访问请求添加对应的局域网标识。这样，所述网络模块可以接收所述策略路由模块发来的绑定了源IP地址的访问请求，并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。所述局域网标识可以与之前去除的局域网标识相同，例如均可以为VLAN 101。
在本实施方式中，服务器可以响应于接收到的访问请求，向加速代理设备反馈响应数据。在反馈所述响应数据时，服务器可以将访问请求中的源IP地址作为响应数据的目的IP地址，从而向该目的IP地址发送响应数据。由上可知，访问请求中的源IP地址被应用加速模块绑定为了网桥的IP地址，因此响应数据中的目的IP地址便可以为所述网桥的IP地址。例如，所述目的IP地址可以是网桥br_vlan101的IP地址192.168.1.2。当然，之前在所述访问请求中，除了绑定的源IP地址，还可以具备实际发送访问请求的用户的IP地址。这样，在所述响应数据中，同样也可以包括所述用户的IP地址。
在本实施方式中，所述网络模块可以接收所述服务器反馈的响应数据，并 将所述响应数据转发至所述应用加速模块，其中，所述响应数据中携带目的IP地址。当然，在将响应数据转发至应用加速模块时，所述网络模块可以将响应数据中携带的局域网标识去除。例如，可以将VLAN 101去除。并可以将去除局域网标识的响应数据转发至所述应用加速模块。
在本实施方式中，所述应用加速模块可以根据响应数据中携带的目的IP地址，通过所述策略路由模块向该目的IP地址处转发所述响应数据。在响应数据被转发之后，所述策略路由模块可以查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。具体地，在所述路由表中可以记录各个网桥的IP地址。这样，所述策略路由模块根据目的IP地址192.168.1.2可以查询得到对应的网桥为br_vlan101。这样，便可以将响应数据通过网桥br_vlan101的直连路由发送至用户IP地址指向的终端。需要说明的是，在实际应用场景中，由应用加速模块发出的响应数据中是去除了局域网标识的数据，那么网络模块中的网桥在接收到所述策略路由模块发来的响应数据后，可以将所述响应数据添加局域网标识后发送至所述用户处。
实施例二
请参阅图4，本申请还公开一种加速代理方法，所述方法包括：
S1：网络模块通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至应用加速模块；
S2：所述应用加速模块将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求；
S3：策略路由模块查询所述绑定了源IP地址的访问请求对应的目标网关，并通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述目标网关将所述绑定了源IP地址的访问请求发送至服务器处。
在本实施方式中，所述方法还包括：
所述网络模块是用于VLAN环境下的局域网模块，将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
在本实施方式中，所述方法还包括：
所述网络模块接收所述策略路由模块发来的绑定了源IP地址的访问请求， 并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。
在本实施方式中，所述方法还包括：
所述网络模块接收所述服务器反馈的响应数据，并将所述响应数据转发至所述应用加速模块，其中，所述响应数据中携带目的IP地址；
所述应用加速模块，通过所述策略路由模块向所述目的IP地址指向的用户转发所述响应数据；
所述策略路由模块用于查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。
实施例三
本申请还公开一种内容管理系统，所述内容管理系统包括存储器，所述存储器所存储的指令可以用于执行上述的加速代理方法。
本申请还公开一种内容管理系统，所述内容管理系统包括处理器，所述处理器可以用于执行上述的加速代理方法。
在本实施例中，所述存储器可以是用于保存信息的记忆设备。在数字系统中，能保存二进制数据的设备可以是存储器；在集成电路中，一个没有实物形式的具有存储功能的电路也可以为存储器，如RAM、FIFO等；在系统中，具有实物形式的存储设备也可以叫存储器，如内存条、TF卡等。
所述处理器可以按任何适当的方式实现。例如，处理器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式等等。本申请并不作限定。
由上可见，本发明实施例提供的技术方案带来的有益效果是：本发明中的网络模块可以为不同IP地址网段的局域网分别提供对应的网桥，这样，当应用加速模块在发出用户的访问请求时，可以根据访问请求所处的IP地址网段，将相应的网桥的IP地址绑定为访问请求的源IP地址。通过策略路由模块，可以确定各个网桥对应的默认网关，从而可以根据访问请求中的源IP地址，查询出发 送该访问请求的网关，从而能够通过查询的网关向服务器发送访问请求。此外，在接收到服务器反馈的响应数据时，可以根据响应数据中的目的IP地址，通过策略路由模块查询到目的IP地址对应的网桥，从而可以通过网桥的直连路由向用户发送该响应数据。由此可见，本发明提供的加速代理设备、加速代理方法以及内容管理系统，能够部署在trunk链路中，从而能够与当前的VLAN技术相融合，增强设备透明代理功能的网络适配能力。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
以上所描述的系统实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种加速代理设备，其特征在于，所述加速代理设备包括网络模块、应用加速模块以及策略路由模块，其中，所述网络模块中包括至少一个网桥，每个网桥与IP地址网段相关联；所述策略路由模块中存储所述至少一个网桥的路由表，每个所述网桥的路由表中包含所述网桥对应的网关；
    所述网络模块用于通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至所述应用加速模块；
    所述应用加速模块用于将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求；
    所述策略路由模块用于查询所述绑定了源IP地址的访问请求对应的目标网关，并通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述目标网关将所述绑定了源IP地址的访问请求发送至服务器处。
  2. 根据权利要求1所述的加速代理设备，其特征在于，所述加速代理设备设置于交换机和网络地址转换设备之间的中继链路中。
  3. 根据权利要求1所述的加速代理设备，其特征在于，所述网络模块是用于VLAN环境下的局域网模块。
  4. 根据权利要求3所述的加速代理设备，其特征在于，所述网络模块还用于将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
  5. 根据权利要求4所述的加速代理设备，其特征在于，所述网络模块还用于接收所述策略路由模块发来的绑定了源IP地址的访问请求，并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。
  6. 根据权利要求1所述的加速代理设备，其特征在于，所述网络模块还用于接收所述服务器反馈的响应数据，并将所述响应数据转发至所述应用加速模 块，其中，所述响应数据中携带目的IP地址；
    所述应用加速模块用于向所述目的IP地址指向的用户转发所述响应数据；
    所述策略路由模块用于查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。
  7. 根据权利要求6所述的加速代理设备，其特征在于，所述网络模块还用于将所述响应数据中携带的局域网标识去除，并将去除局域网标识的响应数据转发至所述应用加速模块。
  8. 根据权利要求7所述的加速代理设备，其特征在于，所述网络模块还用于接收所述策略路由模块发来的响应数据，并将所述响应数据添加局域网标识后发送至所述用户处。
  9. 一种内容管理系统，其特征在于，所述内容管理系统包括根据权利要求1至8中任一项所述的加速代理设备。
  10. 一种加速代理方法，其特征在于，所述方法包括：
    网络模块通过目标网桥接收来自目标IP地址网段的访问请求，并将所述访问请求转发至应用加速模块；
    所述应用加速模块将所述目标网桥的IP地址绑定为所述访问请求的源IP地址并转发绑定了源IP地址的访问请求；
    策略路由模块查询所述绑定了源IP地址的访问请求对应的目标网关，并通过所述网络模块将所述绑定了源IP地址的访问请求发送至所述目标网关处，以通过所述目标网关将所述绑定了源IP地址的访问请求发送至服务器处。
  11. 根据权利要求10所述的加速代理方法，其特征在于，所述方法还包括：
    所述网络模块是用于VLAN环境下的局域网模块，将所述访问请求中携带的局域网标识去除，并将去除局域网标识的访问请求转发至所述应用加速模块。
  12. 根据权利要求11所述的加速代理方法，其特征在于，所述方法还包括：
    所述网络模块接收所述策略路由模块发来的绑定了源IP地址的访问请求，并将所述绑定了源IP地址的访问请求添加局域网标识后发送至所述目标网关处。
  13. 根据权利要求10所述的加速代理方法，其特征在于，所述方法还包括：
    所述网络模块接收所述服务器反馈的响应数据，并将所述响应数据转发至所述应用加速模块，其中，所述响应数据中携带目的IP地址；
    所述应用加速模块用于向所述目的IP地址指向的用户转发所述响应数据；
    所述策略路由模块用于查询所述目的IP地址对应的网桥，并通过查询的所述网桥向所述用户发送所述响应数据。
  14. 一种内容管理系统，其特征在于，所述内容管理系统包括存储器，所述存储器所存储的指令用于执行以下根据权利要求10-13中任一项所述的加速代理方法。
  15. 一种内容管理系统，其特征在于，所述内容管理系统包括处理器，所述处理器用于执行以下根据权利要求10-13中任一项所述的加速代理方法。
PCT/CN2017/092756 2017-06-08 2017-07-13 一种加速代理设备、加速代理方法以及一种内容管理系统 WO2018223488A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17900277.9A EP3432550B1 (en) 2017-06-08 2017-07-13 Acceleration proxy device, acceleration proxy method and content management system
US16/062,961 US10951438B1 (en) 2017-06-08 2017-07-13 Acceleration proxy device, acceleration proxy method, and content management system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710428820.4A CN107181812B (zh) 2017-06-08 2017-06-08 一种加速代理设备、加速代理方法以及一种内容管理系统
CN201710428820.4 2017-06-08

Publications (1)

Publication Number Publication Date
WO2018223488A1 true WO2018223488A1 (zh) 2018-12-13

Family

ID=59836466

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/092756 WO2018223488A1 (zh) 2017-06-08 2017-07-13 一种加速代理设备、加速代理方法以及一种内容管理系统

Country Status (4)

Country Link
US (1) US10951438B1 (zh)
EP (1) EP3432550B1 (zh)
CN (1) CN107181812B (zh)
WO (1) WO2018223488A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112422396A (zh) * 2020-11-04 2021-02-26 郑州信大捷安信息技术股份有限公司 一种基于sslvpn通道的tcp网络传输加速方法和系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108494748B (zh) * 2018-03-08 2021-06-04 网宿科技股份有限公司 一种通信方法、装置及存储介质
CN110719343B (zh) * 2019-09-12 2022-04-22 厦门网宿有限公司 业务加速处理方法及系统、入口及出口网络设备
CN112953833B (zh) * 2021-03-25 2022-04-15 全讯汇聚网络科技（北京）有限公司 基于网桥实现三层路由转发的方法、系统及网关设备
CN114339133B (zh) * 2022-03-10 2022-05-31 南京旭顶通讯科技有限公司 一种连接不同视频会议终端的网络加速方法、设备及存储介质
CN116257521B (zh) * 2023-01-18 2023-11-17 深存科技(无锡)有限公司 一种基于fpga的kv存储方法
CN116527586B (zh) * 2023-07-05 2023-09-19 北京亿赛通科技发展有限责任公司 一种基于多链路负载均衡网络的串接代理系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1394998A2 (en) * 2002-08-27 2004-03-03 Alcatel Canada Inc. Improved virtual local area network provisioning in bridged networks
CN102710485A (zh) * 2012-05-07 2012-10-03 深信服网络科技（深圳）有限公司 透明代理方法及代理服务器
CN103248569A (zh) * 2012-02-08 2013-08-14 杭州华三通信技术有限公司 实现trill网络等价路径的方法及装置
CN103763407A (zh) * 2014-01-28 2014-04-30 上海斐讯数据通信技术有限公司 二层虚拟局域网实现地址解析协议代理方法及局域网系统
CN105490910A (zh) * 2014-09-19 2016-04-13 北京奇虎科技有限公司 网络通信方法及客户端

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8713696B2 (en) * 2006-01-13 2014-04-29 Demand Media, Inc. Method and system for dynamic digital rights bundling
US8194674B1 (en) * 2007-12-20 2012-06-05 Quest Software, Inc. System and method for aggregating communications and for translating between overlapping internal network addresses and unique external network addresses
CN101729388B (zh) * 2008-10-22 2012-01-25 华为技术有限公司 一种实现网络地址转换的方法、媒体网关和网络系统
CN101383778B (zh) * 2008-10-27 2011-04-13 杭州华三通信技术有限公司 基于网络双出口的报文传输方法和出口路由器
US8200752B2 (en) * 2009-12-23 2012-06-12 Citrix Systems, Inc. Systems and methods for policy based transparent client IP insertion
US9282097B2 (en) * 2010-05-07 2016-03-08 Citrix Systems, Inc. Systems and methods for providing single sign on access to enterprise SAAS and cloud hosted applications
CN103780468B (zh) * 2012-10-22 2019-06-14 中兴通讯股份有限公司 智能终端接入trill网络的方法、智能终端及路由网桥
CN103997479B (zh) * 2013-02-17 2018-06-15 新华三技术有限公司 一种非对称服务ip代理方法和设备
CN103428095B (zh) * 2013-08-26 2016-12-28 深信服网络科技（深圳）有限公司 一种代理服务器及其代理方法
CN105530185B (zh) * 2014-09-29 2018-12-25 优视科技有限公司 覆盖路由网络、基于覆盖路由网络的路由方法及路由器
CN104994137B (zh) * 2015-05-27 2019-01-22 四川卫士通信息安全平台技术有限公司 一种网络透明代理的方法
CN106230898B (zh) * 2016-07-21 2019-07-23 网宿科技股份有限公司 网络系统、代理服务器及其应用的数据处理方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1394998A2 (en) * 2002-08-27 2004-03-03 Alcatel Canada Inc. Improved virtual local area network provisioning in bridged networks
CN103248569A (zh) * 2012-02-08 2013-08-14 杭州华三通信技术有限公司 实现trill网络等价路径的方法及装置
CN102710485A (zh) * 2012-05-07 2012-10-03 深信服网络科技（深圳）有限公司 透明代理方法及代理服务器
CN103763407A (zh) * 2014-01-28 2014-04-30 上海斐讯数据通信技术有限公司 二层虚拟局域网实现地址解析协议代理方法及局域网系统
CN105490910A (zh) * 2014-09-19 2016-04-13 北京奇虎科技有限公司 网络通信方法及客户端

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112422396A (zh) * 2020-11-04 2021-02-26 郑州信大捷安信息技术股份有限公司 一种基于sslvpn通道的tcp网络传输加速方法和系统
CN112422396B (zh) * 2020-11-04 2022-04-19 郑州信大捷安信息技术股份有限公司 一种基于sslvpn通道的tcp网络传输加速方法和系统

Also Published As

Publication number Publication date
EP3432550A1 (en) 2019-01-23
CN107181812A (zh) 2017-09-19
US20210075640A1 (en) 2021-03-11
CN107181812B (zh) 2020-05-22
EP3432550B1 (en) 2021-11-24
US10951438B1 (en) 2021-03-16
EP3432550A4 (en) 2019-04-24

Similar Documents

Publication Publication Date Title
WO2018223488A1 (zh) 一种加速代理设备、加速代理方法以及一种内容管理系统
JP7004405B2 (ja) 仮想ネットワークにおける分散型フロー状態ｐ２ｐ設定のためのシステムおよび方法
US9590902B2 (en) Signaling aliasing capability in data centers
CN107465590B (zh) 网络基础设施系统、路由网络业务的方法及计算机可读介质
US10237230B2 (en) Method and system for inspecting network traffic between end points of a zone
KR101371993B1 (ko) 가상화 네트워크 인프라구조를 갖는 투명 클라우드 컴퓨팅을 위한 방법 및 장치
EP2802995B1 (en) Connecting layer-2 domains over layer-3 networks
ES2713078T3 (es) Sistema y método para implementar y gestionar redes virtuales
EP3226487B1 (en) Mass mac withdrawal for evpn-dci using virtual esi
CA2968964C (en) Source ip address transparency systems and methods
US20140230044A1 (en) Method and Related Apparatus for Authenticating Access of Virtual Private Cloud
CA2534637C (en) Methods and apparatus for routing of information depending on the traffic direction
KR20180073726A (ko) 논리적 라우터
US11206212B2 (en) Disambiguating traffic in networking environments with multiple virtual routing and forwarding (VRF) logical routers
WO2014086023A1 (zh) 跨服务区通信的方法、装置和数据中心网络
EP3018866A1 (en) Signaling aliasing capability in data centers
CN103795630A (zh) 一种标签交换网络的报文传输方法和装置
US9853891B2 (en) System and method for facilitating communication
CN109412864B (zh) 一种非docker网络环境外部访问docker容器环境的方法
CN108616439B (zh) 基于Linux内核的网关设备及通信方法
KR100431207B1 (ko) 엠피엘에스（ｍｐｌｓ）기반망에서의 엑스트라넷아이피-브이피엔（ｉｐ－ｖｐｎ）서비스 제공 방법
US20100329258A1 (en) Dynamically enabling mpls stations and ports using an arp database

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2017900277

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017900277

Country of ref document: EP

Effective date: 20180918

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17900277

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE