WO2021248318A1 - Cloud service system, network switching control method and related device - Google Patents

Abstract

Disclosed in embodiments of the present application are a cloud service system, a network switching control method and a related device. The cloud service system comprises P computer nodes, P being an integer greater than 1. Q computer nodes in the P computer nodes serve as virtual private network (VPN) gateway nodes, Q being an integer less than P and greater than 1. K computer nodes in the Q computer nodes serve as source address translation (SNAT) gateways, K being a positive integer less than or equal to Q. Use of the embodiments of the present application can reduce the negative impact of disconnection and reconnection when VPN access is not restricted by the performance of a single server and the active/standby switch is performed.

Description

Cloud service system, network switching control method and related devices Technical field

This application relates to the computer field, in particular to a cloud service system, a network switching control method and related devices.

Background technique

A virtual private network (virtual private network, VPN) server is deployed in a virtual gateway of a network node, and a virtual router redundancy protocol (virtual router redundancy protocol, VRRP) is used to implement active/standby switching, thereby avoiding a single point of failure. Since only one server provides services at the gateway access end, the VPN access capability is limited by the performance of a single server, and when the active/standby switch is performed, all users connected to this virtual network will be disconnected and reconnected.

Summary of the invention

The embodiments of the present application provide a cloud service system, a network switching control method, and related devices, which can reduce the negative effects of disconnection and reconnection when VPN access is not restricted by the performance of a single server and when the active/standby switch is performed Influence.

In the first aspect, an embodiment of the present application is a cloud service system. The cloud service system includes P computer nodes, where P is an integer greater than 1, where:

Q of the P computer nodes are used as virtual private network VPN gateway nodes, and the Q is an integer less than the P and greater than 1;

The K computer nodes among the Q computer nodes are used as source address translation SNAT gateways, and the K is a positive integer less than or equal to the Q.

In the second aspect, an embodiment of the present application provides a network handover control method, which is applied to the cloud service system as described in the first aspect, and the method includes:

Acquiring a target operating parameter set of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes;

When the target operating parameter set meets a preset condition, determine a backup VPN gateway node from the K computer nodes;

The main VPN gateway node and the standby VPN gateway node are switched between the main VPN gateway node and the standby VPN gateway node through SNAT rules.

In a third aspect, an embodiment of the present application provides a network switching control device, which is applied to the cloud service system as described in the first aspect, and the device includes: an acquiring unit, a determining unit, and a switching unit, wherein:

The obtaining unit is configured to obtain target operating parameters of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes;

The determining unit is configured to determine a backup VPN gateway node from the K computer nodes when the target operating parameter meets a preset condition;

The switching unit is configured to switch between the primary VPN gateway node and the backup VPN gateway node through SNAT rules.

In a fourth aspect, an embodiment of the present application provides a server, including a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be processed by the above The above program includes instructions for executing the steps in the second aspect of the embodiments of the present application.

In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the above-mentioned computer-readable storage medium stores a computer program for electronic data exchange, wherein the above-mentioned computer program enables a computer to execute Part or all of the steps described in the two aspects.

In a sixth aspect, an embodiment of the present application provides a computer program product, wherein the above-mentioned computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the above-mentioned computer program is operable to cause a computer to execute as implemented in this application. Examples of part or all of the steps described in the second aspect. The computer program product may be a software installation package.

Description of the drawings

The following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art.

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1A is a schematic structural diagram of a server provided by an embodiment of the present application;

FIG. 1B is a schematic structural diagram of a cloud service system provided by an embodiment of the present application;

FIG. 1C is a schematic structural diagram of another cloud service system disclosed in an embodiment of the present application;

FIG. 1D is a schematic diagram showing the implementation of IP address switching based on SNAT disclosed in an embodiment of the present application;

1E is a schematic flowchart of a network handover control method disclosed in an embodiment of the present application;

Figure 2 is a schematic structural diagram of another server disclosed in an embodiment of the present application;

Fig. 3 is a schematic structural diagram of a network switching control device disclosed in an embodiment of the present application.

detailed description

In order to enable those skilled in the art to better understand the solutions of this application, the technical solutions in the embodiments of this application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only These are a part of the embodiments of this application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific sequence. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes unlisted steps or units, or optionally also includes Other steps or units inherent in these processes, methods, products or equipment.

Reference to "embodiments" herein means that a specific feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art clearly and implicitly understand that the embodiments described herein can be combined with other embodiments.

The computer nodes involved in the embodiments of the present application may all be servers, and the servers may be cloud servers, or servers with other functions, which are not limited here.

The following describes the embodiments of the application in detail.

Please refer to FIG. 1A. FIG. 1A is a schematic structural diagram of a server disclosed in an embodiment of the present application. The server 100 may include a control circuit, and the control circuit may include a storage and processing circuit 110. The storage and processing circuit 110 can be memory, such as hard disk drive memory, non-volatile memory (such as flash memory or other electronic programmable read-only memory used to form a solid-state drive, etc.), volatile memory (such as static or dynamic random access memory). Access to memory, etc.), etc., are not limited in the embodiment of the present application. The processing circuit in the storage and processing circuit 110 can be used to control the operation of the server 100. The processing circuit can be implemented based on one or more microprocessors, microcontrollers, baseband processors, power management units, audio codec chips, application specific integrated circuits, display driver integrated circuits, etc.

The storage and processing circuit 110 can be used to run software in the server 100, such as Internet browsing applications, voice over internet protocol (VOIP) telephone call applications, email applications, media playback applications, operating system functions, etc. . These software can be used to perform some control operations, for example, camera-based image capture, ambient light measurement based on ambient light sensors, proximity sensor measurement based on proximity sensors, and information based on status indicators such as the status indicator of light-emitting diodes. Display functions, touch event detection based on touch sensors, functions associated with displaying information on multiple (for example, layered) displays, operations associated with performing wireless communication functions, operations associated with collecting and generating audio signals , The control operations associated with the collection and processing of button press event data, and other functions in the server 100, are not limited in the embodiment of the present application.

The server 100 may further include an input-output circuit 150. The input-output circuit 150 may be used to enable the server 100 to input and output data, that is, to allow the server 100 to receive data from an external device and also allow the server 100 to output data from the server 100 to an external device. The input-output circuit 150 may further include a sensor 170. The sensor 170 may include an ambient light sensor, a proximity sensor based on light and capacitance, and a touch sensor (for example, a light-based touch sensor and/or a capacitive touch sensor, where the touch sensor may be a part of a touch display screen, or it may be used as a touch sensor). The touch sensor structure is used independently), acceleration sensor, gravity sensor, and other sensors.

The input-output circuit 150 may also include one or more displays, such as the display 130. The display 130 may include one or a combination of a liquid crystal display, an organic light emitting diode display, an electronic ink display, a plasma display, and a display using other display technologies. The display 130 may include a touch sensor array (ie, the display 130 may be a touch display screen). The touch sensor can be a capacitive touch sensor formed by an array of transparent touch sensor electrodes (such as indium tin oxide (ITO) electrodes), or it can be a touch sensor formed using other touch technologies, such as sonic touch, pressure-sensitive touch, and resistance. Touch, optical touch, etc., are not limited in the embodiment of the present application.

The audio component 140 may be used to provide audio input and output functions for the server 100. The audio component 140 in the server 100 may include a speaker, a microphone, a buzzer, a tone generator, and other components for generating and detecting sounds.

The communication circuit 120 may be used to provide the server 100 with the ability to communicate with external devices. The communication circuit 120 may include analog and digital input-output interface circuits, and wireless communication circuits based on radio frequency signals and/or optical signals. The wireless communication circuit in the communication circuit 120 may include a radio frequency transceiver circuit, a power amplifier circuit, a low noise amplifier, a switch, a filter, and an antenna. For example, the wireless communication circuit in the communication circuit 120 may include a circuit for supporting near field communication (NFC) by transmitting and receiving near-field coupled electromagnetic signals. For example, the communication circuit 120 may include a near field communication antenna and a near field communication transceiver. The communication circuit 120 may also include a cellular phone transceiver and antenna, a wireless local area network transceiver circuit and antenna, and so on.

The server 100 may further include a battery, a power management circuit, and other input-output units 160. The input-output unit 160 may include buttons, joysticks, click wheels, scroll wheels, touch pads, keypads, keyboards, cameras, light emitting diodes, and other status indicators.

The user can control the operation of the server 100 by inputting commands through the input-output circuit 150, and can use the output data of the input-output circuit 150 to realize receiving status information and other outputs from the server 100.

Please refer to Figure 1B. Figure 1B provides the cloud service system architecture involved in implementing the embodiments of this application. In the embodiments of this application, the cloud service system can be regarded as a virtual private cloud (VPC). Including multiple computer nodes. Among the multiple computer nodes, two computer nodes are used as network nodes. Both of the two computer nodes are used as VPN servers. One of the two computer nodes is used as a VPN server. As the main router (router master) and the other as the backup router (router slave), the two computer nodes are connected through the Virtual Router Redundancy Protocol (VRRP), and the network node is connected through the Internet (Internet) access to a VPN client (VPN client), in addition to the two computer nodes of the multiple computing connection nodes, each of the other computer nodes includes an application search engine (docker). The specific structure of the computer node may be the server described in FIG. 1A above. Among them, based on the cloud service system shown in FIG. 1B, the VPN server is deployed in the virtual gateway of the network node, and the active/standby connection is realized by using the VRRP protocol, thereby avoiding a single point of failure.

However, the problem it faces is that only one gateway access terminal provides services, and the VPN access capability is limited by the performance of a single server, and when the active/standby switch is performed, all users connected to this virtual network will be disconnected. Connected, that is, the related technology cannot meet the needs of a large number of users to access the scene.

Based on this, please refer to Figure 1C. Figure 1C provides the cloud service system architecture involved in implementing the embodiments of this application. In the embodiments of this application, the cloud service system can be regarded as a virtual private cloud VPC, and the cloud service system includes P A computer node, the P is an integer greater than 1, and the VPC accesses the VPN Client through the Internet, where,

Q of the P computer nodes are used as virtual private network VPN gateway nodes, and the Q is an integer less than the P and greater than 1;

The K computer nodes among the Q computer nodes are used as source address translation SNAT gateways, and the K is a positive integer less than or equal to the Q.

The specific structure of the computer node may be the server described in FIG. 1A. In a specific implementation, the cloud service system may include a large number of computer nodes, some of which are used as VPN gateway nodes, and the VPN gateway nodes can be used to use SNAT source address translation technology to open up data packets and realize normal round-trip transmission of data packets. Of course, Q computer nodes can correspond to Q VPN gateway nodes, and one VPN gateway node of the Q VPN gateway nodes can be used to implement the main router function, and the remaining VPN gateway nodes can be used to implement the slave router function. All Q computer nodes can be used to provide VPN services.

In a possible example, the cloud service system provides VPN client access and forwarding to different VPN gateway nodes through VIP technology.

In specific implementation, the cloud service system can provide VPN client access through virtual IP address technology (VIP technology) and forward data to different VPN gateway nodes, and can also forward to other computer nodes that are not VPN gateway nodes. In the embodiments of this application, the introduction of the VIP technology enables the VPN Client to forward the request for establishing a chain to different VPN gateway nodes, thereby providing basic support for the distributed solution.

In specific implementation, the embodiments of this application can realize the horizontal expansion of VPN gateway nodes according to demand, and solve the problem of the performance limitation of a single network node in related technologies, for example, according to the preset number of gateway nodes and the total number of computer nodes included in the cloud service system The mapping relationship between the two determines the required number of target gateway nodes, and further, the horizontal expansion of VPN gateway nodes can be realized on demand. In addition, if the VPN gateway node fails, only users who access the node will be affected, and will be connected to the normal VPN gateway node after reconnection.

In a possible example, at least one VPN gateway node among the K computer nodes is used to create a network namespace.

In a specific implementation, at least one VPN gateway node among the K computer nodes is used to create a network name space, that is, one or more VPN gateway nodes among the K computer nodes can be used to create a network name space. For example, one VPN gateway node among K computer nodes can be used to create a network namespace. For example, two VPN gateway nodes among K computer nodes can be used to create a network namespace. For example, K The three VPN gateway nodes in each computer node are used to create a network name space, etc., which are not limited here. In the embodiments of the present application, the virtual network namespace technology is used, which can be used as a bridge to connect a private network and a public network.

In a possible example, at least one VPN gateway node among the K computer nodes is used to create a network namespace, and the cloud service system is specifically used to:

A1. Deploy a VPN service in a VPN gateway node i, and create a network name space, where the VPN gateway node i is any computer node among the K computer nodes;

A2. Access the target virtual private network through the pre-reserved private IP address;

A3. Based on the target virtual private network, introduce a preset external virtual IP address VIP into the network namespace corresponding to the VPN gateway node i.

In specific implementation, the preset external virtual IP address can be preset or system default. The cloud service system can access the target virtual private network through a pre-reserved private IP address, and based on the target virtual private network, introduce the preset external virtual IP address VIP into the network namespace corresponding to the VPN gateway node i. Take any VPN gateway node i as an example. The VPN gateway node i is any computer node among the K computer nodes. VPN service is deployed in the VPN gateway node i, and a network namespace is created, through the pre-reserved private IP The address is connected to the target virtual private network, and based on the target virtual private network, the preset external virtual IP address VIP is introduced into the network namespace corresponding to the VPN gateway node i.

In a possible example, SNAT rules are set in the VPN gateway node i.

In specific implementation, SNAT is source address translation, and its function is to convert the source address of an IP packet into another address. Among them, gateway node i can set SNAT rules, and SNAT can implement corresponding functions after setting SNAT rules.

In specific implementation, SNAT is used to implement source address translation, and DNAT is used to implement target address translation. Both are functions of address translation, which convert private addresses to public addresses. When the internal address wants to access the service on the public network (such as web access), the internal address will initiate the connection, and the router or the gateway on the firewall will do an address translation of the internal address, and convert the private IP of the internal address to the public IP of the public network. The address translation of the gateway is called SNAT, which is mainly used for internal shared IP access to the outside. Of course, when the internal needs to provide external services (such as publishing a web site), the external address initiates an active connection, and the gateway on the router or firewall Receive this connection, and then convert the connection to the internal. The process is to replace the internal service with the gateway with the public network IP to receive the external connection, and then do the internal address conversion. This conversion is called DNAT, and it is mainly used internally. The service is released to the outside world.

In a possible example, it is specifically: implementing the setting of the SNAT rule through iptables technology.

In specific implementation, the cloud service system can implement setting SNAT rules through iptables technology, of course, it can also implement setting SNAT rules through other technologies.

In a possible example, the network namespace includes a first virtual network card and a second virtual network card, the first virtual network card is used as an access port of a target virtual private network, and the second virtual network card is used as a target The output port of the virtual private network.

In a specific implementation, the network namespace can include a first virtual network card (IN) and a second virtual network card (EX), where the first virtual network card can be used as the access port of the target virtual private network, and the second virtual network card can be used As the output port of the target virtual private network, it is equivalent to being able to realize the access function.

In a possible example, the first virtual network card is configured with a first private network address and a first public network VIP address, and the second virtual network card is configured with a second private network address and a second public network VIP address

The first virtual network card may be configured with a first private network address and a first public network VIP (public VIP) address. Correspondingly, the second virtual network card can be configured with a second private network address and a second public network VIP (public VIP) address, so that it can be used to implement the next hop function of the data packet to access the VIP.

In a possible example, the target virtual private network is accessed through the first virtual network card.

In specific implementation, the cloud service system can access the target virtual private network through the first virtual network card IN.

In a possible example, the first virtual network card accesses the target virtual private network by means of a container or a virtual machine.

In specific implementation, the cloud service system can connect the first virtual network card to the target virtual private network through a container means or a virtual machine means. Of course, other means can also be used, which will not be repeated here.

In a possible example, the source IP address of the data packet sent by the first virtual network card is converted into a private IP address through the SNAT rule.

In specific implementation, SNAT can be used to implement the source address switching function. Based on this, the cloud service system can convert the source IP address of the data packet sent by the first virtual network card into a private IP address through the SNAT rule.

In a possible example, the K computer nodes include a host VPN gateway.

In a specific implementation, the VPN gateways corresponding to the K computer nodes may include a host VPN gateway, which may be used to control other VPN gateways, or may be a VPN gateway with high priority use.

In a possible example, the host VPN gateway includes a host network namespace.

Of course, the host VPN gateway can correspond to the host network namespace, and in specific implementation, the host network namespace corresponding to the host can be established first.

In a possible example, a direct connection route is configured in the host network namespace, and the direct connection route can be used to point the next hop of the data packet accessing the VIP to the second virtual network card.

In specific implementation, a direct connection route can be configured in the host network namespace, and the direct connection route can directly implement data forwarding, that is, the direct connection route can be used to point the next hop of the data packet accessing the VIP to the second virtual network card EX.

For example, as shown in Figure 1D, in the VPN gateway, create two virtual network cards IN (first virtual network card) and virtual network card EX (second virtual network card) (using a virtual veth pair) in the network namespace, and configure them separately Private network address and public network VIP address, the specific steps are as follows:

First, connect the network card IN to the target virtual private network (refer to the container or virtual machine connection method);

Second, set SNAT rules in the network namespace to convert the source IP of the data packet sent from the network card IN to a private IP;

Then, configure a direct route in the network namespace of the VPN gateway host, and point the next hop of the data packet that accesses the VIP to the network card EX.

Taking the source IP address (Src IP) 172.16.0.10 and the destination address (Dst IP) 192.168.1.11 as an example, it first enters the tunnel, then passes through the VPN tunnel, and then passes through the SNAT rules to obtain the destination IP address 192.168.1.11.

Conversely, taking the source IP address (Src IP) 192.168.1.11 and the destination address (Dst IP) 172.16.0.10 as an example, it first DNAT, then passes through the VPN tunnel, and then passes through the out-tunnel to obtain the destination IP address 172.16.0.10.

Based on the cloud service system described above, in the embodiments of this application, first, by introducing VIP technology, the VPN Client link establishment request is forwarded to different VPN gateway nodes, providing basic support for the distributed solution; second, using The virtual network namespace technology serves as a bridge to connect private networks and public networks; thirdly, using SNAT source address translation technology, data packets can be normally round-tripped, which can improve data transmission efficiency for VPN networks in a cloud environment.

In specific implementation, in this embodiment of the application, the cloud server system can reserve part of the computing nodes as VPN gateway nodes, and the user’s private network can reserve part of the addresses as SNAT gateways; in addition, VIP technology is introduced to provide VPN Client access and forwarding to different VPN gateway node; then, create a network namespace in the VPN gateway node, in the network namespace: first, deploy the VPN service; secondly, access the user’s private network through the reserved private IP address; then, import the external VIP The network namespace of the VPN gateway node (VIP can be published through BGP/OSPF and other protocols); finally, set up SNAT rules (which can be implemented through iptables).

It can be seen that the cloud service system described in the embodiment of the application includes P computer nodes, where P is an integer greater than 1, and among the P computer nodes, Q computer nodes are used as virtual private network VPNs. Gateway node, Q is an integer less than P and greater than 1, K computer nodes in Q computer nodes are used as source address translation SNAT gateways, K is a positive integer less than or equal to Q, because some computer nodes are used as The VPN gateway node and at least one of the VPN gateway nodes are used as SNAT gateways. This way, on the one hand, it can ensure that the VPN gateway node will not allow users to perceive the disconnection and reconnection during the switching process. On the other hand, use The SNAT source address translation technology can open up data packets to go back and forth normally, ensuring data security and improving data transmission efficiency.

Please refer to FIG. 1E. FIG. 1E is a schematic flowchart of a network switching control method provided by an embodiment of the present application. The network switching control method described in this embodiment is applied to the system architecture shown in FIG. 1C. The network switching Control methods include:

101. Obtain a target operating parameter set of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes.

Among them, the target operating parameter set may include at least one of the following parameters: network speed, network delay, packet loss rate, CPU usage, memory size, etc., which are not limited here. The target operating parameter set reflects the VPN to a certain extent. The performance of the gateway node, for example, whether there is a failure, or whether it is running well, and so on. The cloud server system may obtain the target operating parameter set of the main VPN gateway node through a monitoring platform or a background program, and the main VPN gateway node may be one computer node among Q computer nodes.

102. When the target operating parameter set meets a preset condition, determine a backup VPN gateway node from the K computer nodes.

Among them, the backup VPN gateway node and the main VPN gateway node are different nodes, and the preset conditions can be set by the user or the system defaults, for example, at least one operating parameter is abnormal. In specific implementation, the cloud service system can obtain the target operating parameter set of the main VPN gateway node, and the main VPN gateway node is one computer node among the Q computer nodes.

In a possible example, the target operating parameter includes multiple operating parameters; between the above step 101 and step 102, the following steps may also be included:

B1. Evaluate each of the multiple operating parameters to obtain multiple evaluation values, each of which corresponds to an evaluation value;

B2. Obtain a weight corresponding to each of the multiple operating parameters to obtain multiple weights;

B3. Perform a weighting operation based on the multiple evaluation values and the multiple weights to obtain a target evaluation value;

B4. When the target evaluation value is within a preset range, it is determined that the target operating parameter set satisfies the preset condition.

Among them, the preset range can be set by the user or the system defaults. In specific implementation, the cloud service system can evaluate each operating parameter among multiple operating parameters, and obtain multiple evaluation values. Each operating parameter corresponds to an evaluation value, and the weight corresponding to each operating parameter of the multiple operating parameters can be obtained. Value, obtain multiple weights, perform weighting operations based on multiple evaluation values and multiple weights to obtain a target evaluation value, and when the target evaluation value is within a preset range, it is determined that the target operating parameter set satisfies the preset condition, Conversely, when the target evaluation value is not within the preset range, it can be determined that the target operating parameter does not meet the preset condition.

In a possible example, the foregoing step 102, determining a backup VPN gateway node from the K computer nodes, may include the following steps:

21. Obtain the user's target physiological state parameters;

22. Determine the target emotion type corresponding to the target physiological state parameter;

23. Determine the target computer node corresponding to the target emotion type according to the preset mapping relationship between the computer node and the emotion type, and use the target computer node as the backup VPN gateway node, and the target computer node is the One of the K computer nodes.

Among them, in the embodiment of the present application, the physiological state parameter may be various parameters used to reflect the physiological function of the user, and the physiological state parameter may be at least one of the following: heart rate, blood pressure, blood temperature, blood lipid content, blood glucose content, thyroxine content , Adrenaline content, platelet content, blood oxygen content, etc., are not limited here. The preset emotion type can be set by the user or the system defaults. The preset emotion type can be at least one of the following: dull, crying, calm, irritable, excited, depressed, etc., which are not limited here.

In specific implementation, the cloud service system can pre-store the mapping relationship between the preset computer node and the emotion type, and the cloud service system can obtain the user's target physiological state parameters. The physiological state parameters reflect the emotion type to a certain extent, and then , The target emotion type corresponding to the target physiological state parameter can be determined, and further, the target computer node corresponding to the target emotion type can be determined according to the preset mapping relationship between the computer node and the emotion type, and the target computer node can be used as a backup VPN For the gateway node, the target computer node is one of the K computer nodes.

In a possible example, when the target physiological state parameter is the heart rate change curve within a specified time period, the above step 22, determining the target emotion type corresponding to the target physiological state parameter, can be implemented in the following manner:

221. Sampling the heart rate change curve to obtain multiple heart rate values;

222. Perform an average calculation according to the multiple heart rate values to obtain an average heart rate value;

223. Determine the target heart rate level corresponding to the average heart rate value;

224. Determine the target first emotion value corresponding to the target heart rate level according to the preset mapping relationship between the heart rate level and the first emotion value.

225. Perform a mean square error operation according to the multiple heart rate values to obtain a target mean square error;

226. Determine the target second emotion value corresponding to the target mean square error according to the preset mapping relationship between the mean square error and the second emotion value.

227. Determine a target weight pair corresponding to the target heart rate level according to a preset mapping relationship between the heart rate level and the weight value pair, the weight value pair including a first weight value and a second weight value, and the first weight value A weight value is a weight value corresponding to the first emotion value, and the second weight value is a weight value corresponding to the second emotion value;

228. Perform a weighted operation according to the target first emotion value, the target second emotion value, and the target weight pair to obtain a final emotion value;

229. Determine the target emotion type corresponding to the target emotion value according to the preset mapping relationship between the emotion value and the emotion type.

Among them, the specified time period can be set by the user or the system defaults. The memory of the cloud service system can pre-store the mapping relationship between the preset heart rate level and the first emotion value, as well as the preset mean square error and the second emotion value. The mapping relationship between the preset heart rate level and the weighted value pair, and the preset emotional value and the emotional type mapping relationship, the above weighted value pair may include the first weight and the second The first weight value is the weight value corresponding to the first sentiment value, and the second weight value is the weight value corresponding to the second sentiment value. The sum of the first weight value and the second weight value can be 1, and the first weight value The value ranges of the first weight and the second weight are both 0 to 1. In the embodiment of the present application, the emotion can be evaluated through the heart rate change curve.

In specific implementation, the cloud service system can sample the heart rate curve. The specific sampling method can be: uniform sampling or random sampling to obtain multiple heart rate values, and can perform average calculations based on multiple heart rate values to obtain the average heart rate value. The mapping relationship between the heart rate value and the heart rate level can be pre-stored in the service system, and further, the target heart rate level corresponding to the average heart rate value can be determined according to the mapping relationship, and further, can be based on the preset heart rate level and the first emotional value. To determine the target first emotion value corresponding to the target heart rate level. Furthermore, the mean square error operation can be performed based on multiple heart rate values to obtain the target mean square error, and it can be based on the preset mean square deviation and the second emotion value. The mapping relationship between the two determines the target second sentiment value corresponding to the target mean square error.

Further, the cloud service system can also determine the target weight pair corresponding to the target heart rate level according to the above preset mapping relationship between the heart rate level and the weight value pair, and the target weight value pair may include the target first weight value and the target weight value. The first weight, the target first weight is the weight corresponding to the target first sentiment value, and the target second weight is the weight corresponding to the target second sentiment value. Furthermore, the cloud service system can be based on the target first sentiment value, The target second sentiment value, the target first weight and the target second weight are weighted to obtain the final sentiment value. The specific calculation formula is as follows:

Final sentiment value = target first sentiment value * target first weight + target second sentiment value * target second weight

Furthermore, the target emotion type corresponding to the target emotion value can be determined according to the above preset mapping relationship between the emotion value and the emotion type. Among them, the above average heart rate reflects the user's heart rate value, the mean square error of the heart rate reflects the stability of the heart rate, and the user's emotion is reflected through the two dimensions of the average heart rate and the mean square error, and the user's emotion type can be accurately determined.

103. Implement the switch between the active and standby VPN gateway nodes for the main VPN gateway node and the standby VPN gateway node through SNAT rules.

Among them, in the specific implementation, at least one VPN gateway node of the main VPN gateway node and the backup VPN gateway node is set with SNAT rules, and further, the main VPN gateway node and the backup VPN gateway node can be implemented through the SNAT rules to realize the active and backup VPN gateway nodes Switch.

In specific implementation, the network switching control method described in the embodiment of the present application may be executed by at least one server in the cloud service system, or executed by the controller of the cloud service system, which is not limited herein.

It can be seen that the network switching control method described in the embodiments of the present application is applied to a cloud service system. The cloud service system includes P computer nodes, where P is an integer greater than 1, and among the P computer nodes, Q computer nodes Used as a virtual private network VPN gateway node, Q is an integer less than P and greater than 1, K computer nodes in Q computer nodes are used as source address translation SNAT gateways, K is a positive integer less than or equal to Q, based on The cloud service system obtains the target operating parameter set of the main VPN gateway node. The main VPN gateway node is a computer node among the Q computer nodes. When the target operating parameter set meets the preset conditions, it is determined from the K computer nodes The backup VPN gateway node, through the SNAT rules, the main VPN gateway node and the backup VPN gateway node are switched between the active and standby VPN gateway nodes. Because some computer nodes are used as VPN gateway nodes, and at least one of the VPN gateway nodes is used as The SNAT gateway, on the one hand, can ensure that the VPN gateway node will not allow users to perceive the disconnection and reconnection during the switching process. On the other hand, the SNAT source address translation technology is used to open up data packets to and from the normal, ensuring data Security also improves data transmission efficiency.

The following is a device for implementing the above-mentioned network switching control method, which is specifically as follows:

Consistent with the above, please refer to FIG. 2. FIG. 2 is a server provided by an embodiment of the present application, including: a processor and a memory; and one or more programs, and the one or more programs are stored in the memory. And is configured to be executed by the processor, the server may be any server in the cloud service system shown in FIG. 1C, and the program includes instructions for executing the following steps:

Acquiring a target operating parameter set of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes;

When the target operating parameter set meets a preset condition, determine a backup VPN gateway node from the K computer nodes;

The main VPN gateway node and the standby VPN gateway node are switched between the main VPN gateway node and the standby VPN gateway node through SNAT rules.

It can be seen that the server described in the embodiment of the present application is any computer node in the cloud service system. The cloud service system includes P computer nodes, where P is an integer greater than 1, and among the P computer nodes, Q computer nodes are used as virtual private network VPN gateway nodes, Q is an integer less than P and greater than 1, K computer nodes in Q computer nodes are used as source address translation SNAT gateways, K is less than or equal to Q A positive integer, based on the cloud service system, obtain the target operating parameter set of the main VPN gateway node. The main VPN gateway node is a computer node among Q computer nodes. When the target operating parameter set meets the preset conditions, the target operating parameter set from K computers The backup VPN gateway node is determined in the nodes, and the main VPN gateway node and the backup VPN gateway node are switched through SNAT rules. Because some computer nodes are used as VPN gateway nodes and at least one of the VPN gateway nodes It is used as a SNAT gateway. In this way, on the one hand, it can ensure that the VPN gateway node will not allow users to perceive the disconnection and reconnection during the switching process. On the other hand, using the SNAT source address translation technology, the data packets can be normally round-tripped. , To improve data transmission efficiency while ensuring data security.

In a possible example, the target operating parameters include multiple operating parameters; the program further includes instructions for executing the following steps:

Evaluate each operating parameter of the multiple operating parameters to obtain multiple evaluation values, and each operating parameter corresponds to an evaluation value;

Acquiring a weight corresponding to each of the multiple operating parameters to obtain multiple weights;

Performing a weighting operation according to the plurality of evaluation values and the plurality of weights to obtain a target evaluation value;

When the target evaluation value is within a preset range, it is determined that the target operating parameter set satisfies the preset condition.

The foregoing mainly introduces the solution of the embodiment of the present application from the perspective of the execution process on the method side. It can be understood that, in order to implement the above-mentioned functions, the server includes hardware structures and/or software modules corresponding to each function. Those skilled in the art should easily realize that in combination with the units and algorithm steps of the examples described in the embodiments provided herein, this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

The embodiment of the present application may divide the server into functional units according to the foregoing method examples. For example, each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

Please refer to FIG. 3, which is a schematic structural diagram of a network handover control device provided in this embodiment. The network switching control device is applied to the cloud service system as shown in FIG. 1C, and the device includes: an acquiring unit 301, a determining unit 302, and a switching unit 303, wherein,

The obtaining unit 301 is configured to obtain target operating parameters of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes;

The determining unit 302 is configured to determine a backup VPN gateway node from the K computer nodes when the target operating parameter meets a preset condition;

The switching unit 303 is configured to switch between the main VPN gateway node and the backup VPN gateway node through SNAT rules.

It can be seen that the network switching control device described in the embodiment of the present application is applied to a cloud service system. The cloud service system includes P computer nodes, where P is an integer greater than 1, and among the P computer nodes, Q computers A node is used as a virtual private network VPN gateway node, Q is an integer less than P and greater than 1, K computer nodes among Q computer nodes are used as source address translation SNAT gateways, K is a positive integer less than or equal to Q, Based on the cloud service system, the target operating parameter set of the main VPN gateway node is obtained. The main VPN gateway node is a computer node among Q computer nodes. When the target operating parameter set meets the preset conditions, it is determined from K computer nodes A backup VPN gateway node is generated, and the main VPN gateway node and the backup VPN gateway node are switched through SNAT rules. Because some computer nodes are used as VPN gateway nodes, and at least one of the VPN gateway nodes is used for As a SNAT gateway, this way, on the one hand, it can ensure that the VPN gateway node will not allow users to perceive the disconnection and reconnection during the switching process. Data security also improves data transmission efficiency.

In a possible example, the target operating parameter includes multiple operating parameters; the determining unit 302 is further specifically configured to:

Evaluate each operating parameter among the multiple operating parameters to obtain multiple evaluation values, and each operating parameter corresponds to an evaluation value;

Acquiring a weight corresponding to each of the multiple operating parameters to obtain multiple weights;

Performing a weighting operation according to the plurality of evaluation values and the plurality of weights to obtain a target evaluation value;

When the target evaluation value is within a preset range, it is determined that the target operating parameter set satisfies the preset condition.

It is understandable that the functions of the program modules of the network handover control apparatus of this embodiment can be specifically implemented according to the method in the above method embodiment, and the specific implementation process can refer to the relevant description of the above method embodiment, and will not be repeated here. .

An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute any of the network switching control methods described in the above method embodiments. Part or all of the steps.

The embodiments of the present application also provide a computer program product, the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute the method described in the foregoing method embodiment Part or all of the steps of any kind of network switching control method.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that this application is not limited by the described sequence of actions. Because according to this application, some steps can be performed in other order or at the same time. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the involved actions and modules are not necessarily required by this application.

In the above-mentioned embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in an embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed device may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be realized in the form of hardware or software program module.

If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer readable memory. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, A number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), mobile hard disk, magnetic disk, or optical disk and other media that can store program codes.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above-mentioned embodiments can be completed by a program instructing relevant hardware. The program can be stored in a computer-readable memory, and the memory can include: a flash disk , ROM, RAM, magnetic disk or CD, etc.

The embodiments of the application are described in detail above, and specific examples are used in this article to illustrate the principles and implementation of the application. The descriptions of the above examples are only used to help understand the methods and core ideas of the application; at the same time, for Persons of ordinary skill in the art, based on the idea of the application, will have changes in the specific implementation and the scope of application. In summary, the content of this specification should not be construed as limiting the application.

Claims (20)

A cloud service system, characterized in that, the cloud service system includes P computer nodes, where P is an integer greater than 1, wherein, Q of the P computer nodes are used as virtual private network VPN gateway nodes, and the Q is an integer less than the P and greater than 1; The K computer nodes among the Q computer nodes are used as source address translation SNAT gateways, and the K is a positive integer less than or equal to the Q. The cloud service system according to claim 1, wherein the cloud service system provides VPN client access and forwarding to different VPN gateway nodes through VIP technology. The cloud service system according to claim 1 or 2, wherein at least one VPN gateway node among the K computer nodes is used to create a network name space. The cloud service system according to claim 3, wherein at least one VPN gateway node among the K computer nodes is used to create a network name space, and the cloud service system is specifically used to: Deploy a VPN service in a VPN gateway node i, and create a network name space, where the VPN gateway node i is any computer node among the K computer nodes; Access the target virtual private network through the pre-reserved private IP address; Based on the target virtual private network, a preset external virtual IP address VIP is introduced into the network namespace corresponding to the VPN gateway node i. The cloud service system according to claim 4, wherein SNAT rules are set in the VPN gateway node i. The cloud service system according to claim 5, characterized in that it specifically includes: setting the SNAT rule through iptables technology. The cloud service system according to any one of claims 4-6, wherein the network namespace includes a first virtual network card and a second virtual network card, and the first virtual network card is used as the target virtual private The access port of the network, and the second virtual network card is used as the output port of the target virtual private network. The cloud service system according to claim 7, wherein the first virtual network card is configured with a first private network address and a first public network VIP address; the second virtual network card is configured with a second private network address and a second private network address. Public network VIP address. The cloud service system according to claim 7 or 8, wherein access to the target virtual private network is achieved through the first virtual network card. The cloud service system according to any one of claims 7-9, wherein the first virtual network card is connected to the target virtual private network by means of a container or a virtual machine. The cloud service system according to any one of claims 7-10, wherein the source IP address of the data packet sent by the first virtual network card is converted into a private IP address through the SNAT rule. The cloud service system according to any one of claims 7-11, wherein the K computer nodes include a host VPN gateway. The cloud service system according to claim 12, wherein the host VPN gateway includes a host network namespace. The cloud service system according to claim 13, wherein a direct connection route is configured in the host network namespace, and the direct connection route can be used to direct the next hop of the data packet accessing the VIP to the second Virtual network card. A network handover control method, characterized in that it is applied to the cloud service system according to any one of claims 1-14, and the method comprises: Acquiring a target operating parameter set of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes; When the target operating parameter set meets a preset condition, determine a backup VPN gateway node from the K computer nodes; The main VPN gateway node and the standby VPN gateway node are switched between the main VPN gateway node and the standby VPN gateway node through SNAT rules. The method according to claim 15, wherein the target operating parameter includes a plurality of operating parameters; the method further comprises: Evaluate each operating parameter of the multiple operating parameters to obtain multiple evaluation values, and each operating parameter corresponds to an evaluation value; Acquiring a weight corresponding to each of the multiple operating parameters to obtain multiple weights; Performing a weighting operation according to the plurality of evaluation values and the plurality of weights to obtain a target evaluation value; When the target evaluation value is within a preset range, it is determined that the target operating parameter set satisfies the preset condition. A network switching control device, characterized in that it is applied to the cloud service system according to any one of claims 1-14, and the device includes: an acquisition unit, a determination unit, and a switching unit, wherein: The obtaining unit is configured to obtain target operating parameters of a main VPN gateway node, where the main VPN gateway node is one of the Q computer nodes; The determining unit is configured to determine a backup VPN gateway node from the K computer nodes when the target operating parameter meets a preset condition; The switching unit is configured to switch between the primary VPN gateway node and the backup VPN gateway node through SNAT rules. A server, characterized by comprising a processor, a memory, a communication interface, and one or more programs, the one or more programs are stored in the memory and configured to be executed by the processor, so The program includes instructions for executing the steps in the method according to any one of claims 15 or 16. A computer-readable storage medium, characterized by storing a computer program for electronic data exchange, wherein the computer program causes a computer to execute the method according to any one of claims 15 or 16. A computer program product, wherein the computer program product comprises a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute any one of claims 15 or 16 The method described.

Images