CN113905013B - A method for realizing IP address transparent transmission in cluster network - Google Patents

Abstract

The present invention discloses a method for realizing IP address transparent transmission for cluster network, which unloads SSL hardware on SSL hardware proxy server and modifies it into IP address and port of terminal device, realizes source IP address transparent transmission, realizes load and IP address transparent transmission of application server and functions such as packet return according to source MAC route on load balancing module. The present invention uses SSL unloading and IP address transparent transmission of cluster network, and the application server only needs to point the default route to load balancing, and does not need to make any other modification to obtain IP address and port information of terminal device. In the data packet flow of actual user access, the source IP initiated by the user terminal remains unchanged, and the target IP address is converted when passing through SSL gateway and load balancing, which can meet the requirements of large concurrency and high stability in finance, securities, futures and other industries, and can also meet regulatory requirements.

Description

A method for implementing IP address transparent transmission in cluster network

Technical Field

The present invention relates to the technical field of computer network communication, and in particular to a method for implementing IP address transparent transmission in a cluster network.

Background technique

In key industries such as finance and securities that are related to the national economy and people's livelihood, SSL is generally used for encrypted transmission to protect the security of sensitive data during transmission. Informatization has also brought great threats to financial supervision, and various attacks have emerged in an endless stream. Therefore, financial supervision requires that all application servers must be able to conduct supervision and audit of information such as user identity, terminal IP and port access.

Usually, SSL is directly deployed on the application server to provide external services. In this way, the application server can directly obtain the user identity, terminal IP, port and other information of the terminal access. However, this solution directly exposes the core service to the Internet, which is very vulnerable to network attacks. At the same time, SSL encryption and decryption will consume a lot of computing resources of the application server, causing the operation page to freeze. To address this problem, the general solution is to use dedicated gateway hardware to offload SSL, and then forward it to the application server, so as to achieve loose coupling between SSL offloading and application server processing logic.

After the dedicated SSL hardware unloads the data packet, it will perform SNAT and DNAT at the same time, that is, the source address and destination address of the data packet will be modified. The source address of the data packet detected by the application server is the SSL hardware address, not the real IP address of the client, which makes it impossible for the application server to directly obtain the terminal IP and port information.

If the application server wants to obtain the terminal IP information, there are usually the following methods:

1. For applications based on B/S architecture, after being unloaded by SSL hardware, the terminal information is passed to the application server through cookie injection or X-Forward-For, and the application server obtains the terminal address and port information by reading the cookie or header information in the http protocol. This solution is powerless for applications based on C/S framework.

2. For C/S applications, after being unloaded by SSL hardware, the terminal information is passed to the application server through the Proxy Protocol (rfc6967). The Proxy Protocol adds a header information to the TCP protocol to facilitate the transmission of client information. Its essence is that after the three-way handshake is completed, the proxy service on the SSL hardware device inserts a data packet carrying the original connection four-tuple information into the backend connection. This solution requires the application server to be modified and is not convenient for promotion.

3. Obtain the real IP address of the client through TOA. In order to pass the client IP address to the server, after SSL unloading, the client IP address and port PORT are placed in the custom tcp option field when forwarding. This solution requires the application server to modify the kernel to obtain the terminal's IP address and port PORT, which has high requirements on the application environment and developers and is not easy to promote.

4. The client obtains its own IP address and port PORT through the SSL handshake protocol (commonly used for intranet terminals to obtain the source IP and PORT information of the corresponding Internet access), and sends its own IP address and port PORT information to the server through a private protocol. This solution involves application protocol modification and is not convenient for promotion.

Therefore, the applicant has found a solution to the above-mentioned problem through beneficial exploration and research, and the technical solution to be introduced below is produced in this context.

Summary of the invention

In view of the defects and shortcomings of the background technology, the present invention proposes a method for realizing IP address transparent transmission for cluster networks based on high-concurrency networks. After SSL unloading, this method disguises itself as the user's IP and port to initiate a connection to the back-end application server. The application server can obtain terminal access information without making any changes. This invention can be widely used in B/S and C/S services, and can meet the financial supervision requirements of high-concurrency networks such as finance and securities.

SSL offloading is a typical CPU-intensive computing device. Using dedicated hardware devices for SSL offloading can analyze all network data, obtain complete threat protection, resist network attacks, and thus improve the performance of applications. Usually, for the high concurrency and high availability of the entire project solution, SSL hardware devices will be deployed in clusters to improve the overall SSL offloading performance and the stability of the application server's external services. Load balancing is generally only used for traffic distribution, consumes little computing resources, and can be deployed on a single unit.

The technical problem to be solved by the present invention is that the application service only needs to point the default route to the load balancing, and no other customized modifications are required to obtain the terminal IP and port.

The technical problem to be solved by the present invention can be achieved by adopting the following technical solutions:

A method for implementing IP address transparent transmission for a cluster network includes the following steps:

The terminal device sends a connection request to the SSL hardware proxy server;

The SSL hardware proxy server obtains the IP address and port information of the terminal device according to the connection request sent by the terminal device;

The SSL hardware proxy server unloads the SSL hardware and disguises itself as the IP address and port information of the terminal device to send a connection request to the load balancing module;

After receiving the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server;

The application server obtains the IP address, port information and user identity information according to the connection request forwarded by the load balancing module, performs relevant operations to generate data packets, and then returns the generated data packets to the load balancing module according to the default route;

The load balancing module returns the packet to the source-initiated SSL hardware proxy server based on the policy routing, source IP address, and MAC address; and

The source-initiated SSL hardware proxy server receives the data packets returned by the load balancing module, searches for the corresponding SOCKET connection according to the policy routing, performs SSL encryption on the data packets, and then returns the encrypted data packets to the terminal device that initiated the connection according to the found SOCKET connection.

In a preferred embodiment of the present invention, after the load balancing module receives the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server, including the following steps:

The load balancing module receives the connection request initiated by the SSL hardware proxy server disguised as a terminal device, and records the MAC address, source IP, and port; and

The load balancing module disguises itself as the IP address and port information of the terminal device and sends a connection request initiated by the SSL hardware proxy server disguised as the terminal device to the application server.

In a preferred embodiment of the present invention, the load balancing module returns a packet to the source-initiated SSL hardware proxy server according to the policy routing, source IP address and MAC address, including the following steps:

The load balancing module routes the received data packets to the lo port according to the policy routing;

The load balancing module searches for the corresponding SOCKET connection from the corresponding connection queue according to the policy routing; and

The load balancing module searches for the MAC address corresponding to the front-end connection based on the policy routing connection, and sends the data packet back to the source-initiated SSL hardware proxy server based on the MAC address.

Due to the adoption of the above technical solution, the beneficial effects of the present invention are: the present invention unloads the SSL hardware on the SSL hardware proxy server and modifies it into the IP address and port of the terminal device, realizes the transparent transmission of the source IP address, and realizes the functions of the load of the application server, the transparent transmission of the IP address, and the return packet according to the source MAC route on the load balancing module. The present invention uses the SSL unloading and IP address transparent transmission of the cluster network. The application server only needs to point the default route to the load balancing, and does not need to make any other modifications to obtain the IP address and port information of the terminal device. In the data packet flow of the actual user access, the source IP initiated by the user terminal remains unchanged, and the target IP address is converted when passing through the SSL gateway and load balancing, which can meet the requirements of large concurrency and high stability in the financial, securities, futures and other industries, while meeting the regulatory requirements.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG. 1 is a schematic diagram of a network topology of the present invention.

FIG. 2 is a schematic diagram of the process of the present invention.

FIG. 3 shows the changes of the IP address and port information of the present invention when passing through the SSL hardware proxy server and the load balancing module.

Detailed ways

In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below with reference to specific diagrams.

See Figure 1 for the network topology. The SSL hardware proxy server 200 provides services to the outside world by cluster self-load or ospf. After SSL unloading, it uses the IP address and port of the terminal device 100 to initiate a connection to the back-end load balancing module 300. The load balancing module 300 implements the load of the application and returns the original path according to the source IP address, port information and MAC address. The application server only needs to point the default route to the load balancing module, and no other customization is required to obtain the IP address and port information of the terminal device. The role of load balancing here is mainly traffic distribution and original path return.

Referring to FIG. 2 and FIG. 3 , a method for implementing IP address transparent transmission for a cluster network is provided, comprising the following steps:

Step S10: The terminal device sends a connection request to the SSL hardware proxy server.

Step S20, the SSL hardware proxy server obtains the IP address and port information of the terminal device according to the connection request sent by the terminal device.

Step S30, the SSL hardware proxy server unloads the SSL hardware and sends a connection request to the load balancing module disguised as the IP address and port information of the terminal device.

Step S40: After receiving the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server.

Step S50, the application server obtains the IP address, port information and user identity information according to the connection request forwarded by the load balancing module, performs relevant operations to generate a data packet, and then returns the generated data packet to the load balancing module according to the default route.

Step S60: The load balancing module returns the packet to the source-initiated SSL hardware proxy server according to the policy routing, source IP address and MAC address.

Step S70, the source-initiated SSL hardware proxy server receives the data packet returned by the load balancing module, searches for the corresponding SOCKET connection according to the policy routing, performs SSL encryption on the data packet, and then returns the encrypted data packet to the terminal device that initiated the connection according to the found SOCKET connection.

In step S40, after receiving the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server, including the following steps:

Step S41, the load balancing module receives a connection request initiated by the SSL hardware proxy server disguised as a terminal device, and records the MAC address, source IP, and port;

Step S42, the load balancing module disguises itself as the IP address and port information of the terminal device and sends a connection request initiated by the SSL hardware proxy server disguised as the terminal device to the application server.

In step S60, the load balancing module returns the packet to the source-initiated SSL hardware proxy server according to the policy routing, source IP address and MAC address, including the following steps:

Step S61, the load balancing module routes the received data packet to the LO port according to the policy routing;

Step S62, the load balancing module searches for the corresponding SOCKET connection from the corresponding connection queue according to the policy routing;

Step S63, the load balancing module searches for the MAC address corresponding to the front-end connection according to the policy routing connection, and returns the data packet to the source-initiated SSL hardware proxy server according to the MAC address.

The present invention unloads SSL hardware on an SSL hardware proxy server and modifies it into the IP address and port of a terminal device, realizes transparent transmission of the source IP address, and realizes functions such as transparent transmission of the load and IP address of the application server and packet return according to the source MAC route on the load balancing module. The present invention uses SSL unloading and IP address transparent transmission of a cluster network, and the application server only needs to point the default route to the load balancing, and does not need to make any other modifications to obtain the IP address and port information of the terminal device. In the data packet flow of actual user access, the source IP initiated by the user terminal remains unchanged, and the target IP address is converted when passing through the SSL gateway and load balancing, which can meet the requirements of large concurrency and high stability in the financial, securities, futures and other industries, while meeting regulatory requirements.

The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims (1)

1. A method for implementing IP address transparent transmission for a cluster network, characterized by comprising the following steps: The terminal device sends a connection request to the SSL hardware proxy server; The SSL hardware proxy server obtains the IP address and port information of the terminal device according to the connection request sent by the terminal device; The SSL hardware proxy server unloads the SSL hardware and disguises itself as the IP address and port information of the terminal device to send a connection request to the load balancing module; After receiving the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server; The application server obtains the IP address, port information and user identity information according to the connection request forwarded by the load balancing module, performs relevant operations to generate data packets, and then returns the generated data packets to the load balancing module according to the default route; The load balancing module returns the packet to the source-initiated SSL hardware proxy server based on the policy routing, source IP address, and MAC address; and The source-initiated SSL hardware proxy server receives the data packets returned by the load balancing module, searches for the corresponding SOCKET connection according to the policy routing, performs SSL encryption on the data packets, and then returns the encrypted data packets to the terminal device that initiated the connection according to the found SOCKET connection; After receiving the connection request sent by the SSL hardware proxy server, the load balancing module forwards the connection request to the application server, including the following steps: The load balancing module receives the connection request initiated by the SSL hardware proxy server disguised as a terminal device, and records the MAC address, source IP, and port; and The load balancing module disguises itself as the IP address and port information of the terminal device and sends a connection request to the application server disguised as the connection request initiated by the SSL hardware proxy server as the terminal device; The load balancing module returns the packet to the source-initiated SSL hardware proxy server according to the policy routing, source IP address and MAC address, including the following steps: The load balancing module routes the received data packets to the lo port according to the policy routing; The load balancing module searches for the corresponding SOCKET connection from the corresponding connection queue according to the policy routing; and The load balancing module searches for the MAC address corresponding to the front-end connection based on the policy routing connection, and sends the data packet back to the source-initiated SSL hardware proxy server based on the MAC address.