CN101309195A - A method and device for ensuring quality of service in a secure socket layer virtual private network - Google Patents

Abstract

The present invention discloses a method and device for guaranteeing a quality of service mechanism in a secure socket layer virtual private network. The method provided by the present invention includes: identifying the type of application data, and processing the application data according to the relevant information of the type of application data Prioritization: sending the application data according to the divided priorities. The device provided by the present invention includes: a prioritization unit, configured to identify the type of application data, and classify the application data according to the relevant information of the type of application data; a sending unit, configured to prioritize according to the assigned priority Send the application data. By adopting the method and device provided by the present invention, reasonable allocation of bandwidth can be realized, so that various data can be sent in succession in a reasonable manner, and network congestion can be prevented.

Description

A method and device for ensuring quality of service in a secure socket layer virtual private network

technical field

The invention relates to the field of network security, in particular to a method and device for guaranteeing service quality in a secure socket layer virtual private network.

Background technique

With the continuous advancement of network technology, network security issues have become the most concerned and valued issues. As a secure remote network access technology, Secure Socket Layer Virtual Private Network (SSL VPN: Security Socket Layer Virtual Private Network) has been used in the past two During the year, it has become more and more favored by enterprise users.

The SSL VPN solution refers to the way that users use the browser's built-in SSL packet processing function to redirect network packets so that users can execute applications on remote computers and read company internal server data. It uses standard SSL to encrypt data packets in transmission, thus protecting data security at the application layer. High-quality SSL VPN solutions can guarantee secure global access for enterprises.

The two key technologies implemented by SSL VPN are tunneling technology and encryption technology. Tunneling technology means that the original message is encapsulated at A, and after arriving at B, the encapsulation is removed and restored to the original message, forming a communication tunnel from A to B. Encryption technology camouflages sensitive information that needs to be protected by changing the representation of information, so that unauthorized parties cannot understand the content of the protected information.

The process of using SSL VPN technology to send application data is as follows: encrypt the application data at the sending end, add an SSL header before the application data, and then transmit the encrypted application data to the receiving end. The format of the encrypted application data is as shown in the table As shown in 1, the receiving end performs corresponding decryption and hash processing on the received encrypted data to obtain application data.

IP header TCP header SSL header application data

Through the above-mentioned tunnel technology and encryption technology, a secure and interoperable VPN has been established. However, due to the uncertainty of WAN traffic, the utilization rate of bandwidth is very low, causing network congestion and network bottlenecks during traffic peaks, so that data with high real-time requirements cannot be sent in time, and when traffic is low. A lot of network bandwidth is idle.

There is an existing network security mechanism called Quality of Service (QoS: Quality of Service), which can be used to solve problems such as network delay and congestion. However, the prior art still cannot support QoS policy in SSL VPN and solve the problem of network congestion.

Contents of the invention

In view of this, the embodiments of the present invention provide a method and device for guaranteeing service quality in a secure socket layer virtual private network to realize reasonable allocation of bandwidth, so that various types of data can be sent in a reasonable order and prevent network congestion from occurring.

An embodiment of the present invention provides a method for ensuring quality of service in a secure socket layer virtual private network, the method comprising: identifying an application data type, and prioritizing the application data according to information related to the application data type; Sending the application data according to the divided priorities.

The embodiment of the present invention also provides a device for guaranteeing service quality in a secure socket layer virtual private network, the device includes: a prioritization unit, used to identify the application data type, and classify the application data type according to the relevant information of the application data type performing priority division on the application data; a sending unit configured to send the application data according to the divided priorities.

In the method for guaranteeing service quality in a secure socket layer virtual private network provided by the embodiment of the present invention, by identifying the application data type, the application data is prioritized according to the relevant information of the application data type, and according to the classification The priority of sending the application data. According to the relevant information of the identified application data type, the encrypted data running under the SSL VPN tunnel can be distinguished, and the application data is prioritized, and bandwidth resources are allocated to different types of application data according to the priority, so that all kinds of data It can be sent in a reasonable order to prevent network congestion and ensure QoS in SSL VPN.

Description of drawings

FIG. 1 is a schematic diagram of an application environment of an embodiment of the present invention;

Fig. 2 is a flow chart of a method for ensuring quality of service in a secure socket layer virtual private network provided by an embodiment of the present invention;

3 is a flowchart of a method for ensuring quality of service in a secure socket layer virtual private network provided by another embodiment of the present invention;

FIG. 4 is a device diagram for ensuring quality of service in a secure socket layer virtual private network provided by an embodiment of the present invention;

FIG. 5 is a structural diagram of a prioritization unit provided by an embodiment of the present invention;

FIG. 6 is a structural diagram of a sending unit provided by an embodiment of the present invention;

FIG. 7 is a device diagram for ensuring quality of service in a secure socket layer virtual private network provided by another embodiment of the present invention;

FIG. 8 is a structural diagram of a prioritization unit provided by another embodiment of the present invention;

FIG. 9 is a structural diagram of a sending unit provided by another embodiment of the present invention.

Detailed ways

The method for ensuring quality of service in a secure socket layer virtual private network provided by an embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

Referring to FIG. 1 , it is a schematic diagram of an application environment of an embodiment of the present invention. As shown in Figure 1: data exchange is to be performed between the intranet of A and B. Among them, A's intranet includes server group A, A's user A1, B's user B1 who is on a business trip at A, and gateway A; B's intranet includes server group B, B's user B2, and A's user A2 who is on a business trip at B , Gateway B. There are a large number of devices that need to exchange application data between gateway A and gateway B, and the data is encrypted by SSL during transmission. During the peak period of network traffic, in order to enable all kinds of data to be transmitted in a reasonable sequence, it is necessary to ensure the QoS function on the basis of the illustrated SSL tunnel.

The embodiment of the present invention provides a method for guaranteeing service quality in a secure socket layer virtual private network. Since the SSL VPN is a gateway device running on the application layer, the method provided by the embodiment of the present invention is also based on the application layer. This method can be used in data exchange between at least two gateways.

Referring to FIG. 2 , it is a flowchart of a method for ensuring quality of service in a secure socket layer virtual private network provided by an embodiment of the present invention. The method includes the following steps:

Step 201: Identify the application data type, and add a corresponding level identifier before the application data according to the identified application data type and according to the importance and real-time nature of the application data;

In the network, all applications will leave an identifier on the application data that can be used to identify the source application, such as protocol type, source IP address, or resource type. Among them, the identification of the application data type can usually be identified by the SSL VPN device; in the SSL VPN network, the device can automatically identify the source application type of the application data, and judge the source application type of the application data according to the source application type identified by the device. generated by the application.

Due to the different importance of the application data generated by different applications, the real-time and stability requirements of these application data transmissions are also different. According to the importance of the application data generated by different applications, a level identifier is added before the application data. For example: Some core application data has high requirements for real-time performance, and this type of application data is marked as the highest level, indicating that it needs to be transmitted preferentially to avoid the impact of such application data from network congestion; while some application data is relatively not So important, such application data can be marked as a lower level, indicating that sending can be postponed. See Table 2:

IP header TCP header SSL header level identification application data

Step 202: Determine different priorities of the application data according to the level identifier added before the application data;

Data with a higher level has a higher priority; data with a lower level has a lower priority.

Step 203: Send the application data sequentially according to the priority.

According to the priority of the application data, put the application data into the queue corresponding to the priority; then send the application data according to the priority order of each queue.

Put the application data with the highest priority into the highest-level queue, set the transmission level of this queue as the first priority, and send the application data in this queue first

Put the application data with higher priority into the higher-level queue, set the transmission level of this queue as the second priority, and send the application data in the first priority queue to the second priority queue App data in .

By analogy, the application data in the third, fourth... priority queues are sent in sequence.

Put the application data with the lowest priority into the lowest level queue, and set the transmission level of this queue to be the lowest. The application data in the queue with a lower transmission level is temporarily sent, and the application data in the high-level queue is sent sequentially after being sent.

In the method provided in the embodiment, according to the identified application data type, according to the importance and real-time nature of the application data, a level identifier is added before the application data, and the application data is directly prioritized according to the level identifier, and then the application Data is sent sequentially. When there are many devices in the SSLVPN network, there is a lot of application data to be sent, and it may be difficult to directly distinguish the importance level of the application data according to the type of the identified application data. The method of classifying and prioritizing the application data of the same category can also achieve the purpose of the above invention well.

Referring to FIG. 3 , it is a flowchart of a method for ensuring quality of service in a secure socket layer virtual private network provided by another embodiment of the present invention. The method includes the following steps:

Step 301: Identify the type of application data, and add a type identifier before the application data;

In the network, all applications will leave an identifier on the application data that can be used to identify the source application, such as protocol type, source IP address, or resource type. Among them, the identification of the application data type can usually be identified through the SSL VPN device; in the SSL VPN network, the device can automatically identify the source application category of the application data, and add the type identification before the application data according to the source application category identified by the device , as shown in Table 2, is used to determine which application generates the application data.

IP header TCP header SSL header Type ID application data

Step 302: Obtain the type identifier added above, and classify the application data;

Obtain the type identifier added before the application data, classify the application data, and put the application data of the same type together.

There are many source application types of the application data automatically identified by the device, so the type identifier can contain information of various source application types, and one type of information can be selected to classify the application data. For example, classification can be performed according to the protocol type information, source IP and destination IP address information or resource type information included in the obtained type identifier.

Step 303: Determining different priorities for each category of application data obtained after the classification;

According to the importance of application data, there is a difference in sending priority between the same type of application data. For example, some core application data needs to be transmitted in time. Marking this type of application data as the highest priority and sending it first can avoid this type of application data. Affected by network congestion, some application data is relatively unimportant and can be deferred. Therefore, it is necessary to determine the priority of the application data according to the importance of the application data in each category.

The method for determining priority is illustrated with the three classification methods described in step 302:

(1) Protocol type: some protocols occupy a lot of bandwidth and can easily cause business delays, so the application data of this protocol type can be temporarily processed; relatively speaking, some protocols do not occupy too much bandwidth, and this protocol type can be processed first application data.

(2) Source IP and destination IP address: it can be the IP address of the host, or the IP address of a network segment. Most of the time, the server is specially configured for a single application. By analyzing the source IP address of the application data, it can be identified which device the application data is generated by, such as an email server. Among these application data, some application data have high requirements on real-time performance, some application data have high requirements on reliability, and some application data are very important and require immediate transmission. Based on this, application data can be prioritized to determine which application data generated by the device needs to be transmitted first, and which application data can be deferred.

(3) Resource type: Most SSL VPN devices support resource classification, and application data can be processed differently according to resource types. Application data can thus also be prioritized according to resource type.

Step 304: Send the application data sequentially according to the priority.

According to the priority of the application data, put the application data into the queue corresponding to the priority; then send the application data according to the priority order of each queue.

Put the application data with the highest priority into the highest-level queue, set the transmission level of this queue as the first priority, and send the application data in this queue first

Put the application data with higher priority into the higher-level queue, set the transmission level of this queue as the second priority, and send the application data in the first priority queue to the second priority queue App data in .

By analogy, the application data in the third, fourth... priority queues are sent in sequence.

Put the application data with the lowest priority into the lowest level queue, and set the transmission level of this queue to be the lowest. The transmission of application data in the lower-level queue is suspended, and the data in the higher-level queue is sent sequentially.

Through the method provided by the embodiment of the present invention, the timely and accurate transmission of key data can be guaranteed during the peak period of wide area network traffic, and the QoS in SSLVPN can be guaranteed.

The embodiment of the present invention also provides a device for guaranteeing service quality in a secure socket layer virtual private network. Referring to FIG. 4 , it is a diagram of an apparatus for ensuring quality of service in a secure socket layer virtual private network provided by an embodiment of the present invention. The device includes: a prioritization unit 401 and a sending unit 402, wherein,

The prioritization unit 401 is configured to identify the type of application data, and according to the identified type of application data, according to the importance and real-time nature of the application data, add a corresponding level identifier before the application data, and perform priority division on the application data.

The sending unit 402 is configured to send the application data sequentially according to the priority.

Referring to FIG. 5 , it is a structural diagram of a prioritization unit provided by an embodiment of the present invention. The prioritization unit includes an identification subunit 501, an identification subunit 502 and a priority determination subunit 503, wherein,

The identifying subunit 501 is configured to identify the application data type.

In the network, all applications will leave an identifier on the application data that can be used to identify the source application, such as protocol type, source server address or source port address, etc. In an SSL VPN network, the device can automatically identify the source application category of application data. Therefore, the identification subunit 501 is used to identify the type of application data;

Among them, the identification of the application data type can usually be identified through the SSL VPN device;

The adding identification subunit 502 is configured to add a level identification before the application data according to the identified application data type and according to the importance and real-time performance of the application data.

The priority determination subunit 503 is configured to determine different priorities of the application data according to the added level identifier.

Referring to FIG. 6 , it is a structural diagram of a sending unit provided by an embodiment of the present invention. The sending unit includes a queuing subunit 601 and a sequential sending subunit 602, wherein,

The queuing subunit 601 is configured to put the application data into a queue corresponding to the priority according to the priority of the application data.

Put the application data with the highest priority into the highest-level queue, and set the transmission level of this queue as the first priority. Put the application data with higher priority into a higher-level queue, and set the transmission level of this queue as the second priority. By analogy, set the third, fourth...priority queues. Put the application data with the lowest priority into the lowest level queue, and set the transmission level of this queue to be the lowest.

The sequential sending subunit 602 is configured to send application data according to the priority order of each queue.

The application data in the first priority queue is sent first, and after the application data in the first priority queue is sent, the application data in the second priority queue is sent. By analogy, the application data in the third, fourth... priority queues are sent. The transmission of application data in the lower-level queue is suspended, and the data in the higher-level queue is sent sequentially.

Referring to FIG. 7 , it is a diagram of an apparatus for guaranteeing QoS in a secure socket layer virtual private network provided by another embodiment of the present invention. The device includes: a prioritization unit 701 and a sending unit 702, wherein,

A prioritization unit 701, configured to identify the type of application data, add a type identifier before the application data, classify the application data according to the type identifier, and perform priority division on the classified application data;

The sending unit 702 is configured to send the application data sequentially according to the priority.

Referring to FIG. 8 , it is a structural diagram of a prioritization unit provided by another embodiment of the present invention. The prioritization unit includes an identification subunit 801, an adding identification subunit 802, a classification subunit 803 and a priority determination subunit 804, wherein:

The identifying subunit 801 is configured to identify the type of application data.

In the network, all applications will leave an identifier on the application data that can be used to identify the source application, such as protocol type, source server address or source port address, etc. In an SSL VPN network, the device can automatically identify the source application category of application data. Therefore, the identification subunit 801 is used to identify the type of application data.

Among them, the identification of the application data type can usually be identified through the SSL VPN device.

The adding identifier subunit 802 is configured to add a corresponding type identifier before the application data.

The classification subunit 803 is configured to classify the application data according to the acquired type identifier.

There are many source application types of the application data automatically recognized by the device, so the type identifier can contain information of various source application types, and one type of information can be selected to classify the application data. For example: the classifying unit 803 may classify according to the protocol type information, source IP and destination IP address information or resource type information contained in the obtained type identifier.

The priority determination subunit 804 is configured to determine the priority of each type of application data obtained after the classification.

Referring to FIG. 9 , it is a structural diagram of a sending unit provided by another embodiment of the present invention. The sending unit includes a queuing subunit 901 and a sequential sending subunit 902, wherein,

The queuing subunit 901 is configured to put the application data into a queue corresponding to the priority according to the priority of the application data.

Put the application data with the highest priority into the highest-level queue, and set the transmission level of this queue as the first priority. Put the application data with higher priority into a higher-level queue, and set the transmission level of this queue as the second priority. By analogy, set the third, fourth...priority queues. Put the application data with the lowest priority into the lowest level queue, and set the transmission level of this queue to be the lowest.

The sequential sending subunit 902 is configured to send application data according to the priority order of each queue.

The application data in the first priority queue is sent first, and after the application data in the first priority queue is sent, the application data in the second priority queue is sent. By analogy, the application data in the third, fourth... priority queues are sent. The transmission of application data in the lower-level queue is suspended, and the data in the higher-level queue is sent sequentially.

To sum up, in the method for guaranteeing service quality in a secure socket layer virtual private network provided by the embodiment of the present invention, the application data is prioritized according to the relevant information of the application data type by identifying the application data type ; Sending the application data sequentially according to the divided priorities. Through this method, during the peak period of WAN traffic, bandwidth resources are allocated according to priority, so that various data can be sent in a reasonable sequence, preventing network congestion and ensuring QoS in SSL VPN.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be executed during execution The method includes the following steps: identifying the application data type, and classifying the application data according to the related information of the application data type; and sending the application data according to the classifying priority.

A method and device for ensuring quality of service in a secure socket layer virtual private network provided by the embodiments of the present invention have been described above in detail. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The above embodiments The description is only used to help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, As stated above, the content of this specification should not be construed as limiting the present invention.

Claims (10)

1. A method for ensuring quality of service in a secure socket layer virtual private network, characterized in that the method comprises: identifying the application data type, and prioritizing the application data according to the relevant information of the application data type; Sending the application data according to the divided priorities. 2. The method according to claim 1, wherein the prioritization of the application data according to the relevant information of the application data type comprises: According to the application data type, add a level identifier before the application data; Determine the priority of the application data according to the level identifier. 3. The method according to claim 1, wherein the prioritization of the application data according to the relevant information of the application data type comprises: According to the application data type, adding a type identifier before the application data; Obtain the type identifier, and classify the application data; Determine the priority of each category of application data obtained after classification. 4. The method according to claim 3, wherein said classifying said application data comprises: Classify the application data according to the protocol type information, source IP and destination IP address information or resource type information included in the acquired type identifier. 5. The method according to any one of claims 1-4, wherein the sending the application data according to the divided priority comprises: putting the application data into a queue of a level corresponding to the divided priority; Application data is sent in order of priority for each queue. 6. A device for ensuring quality of service in a secure socket layer virtual private network, characterized in that the device comprises: a prioritization unit, configured to identify the application data type, and perform prioritization on the application data according to the relevant information of the application data type; A sending unit, configured to send the application data according to the divided priorities. 7. The device according to claim 6, wherein the prioritization unit comprises: Identifying subunits for identifying application data types; Adding an identification subunit, used to add a level identification before the application data according to the application data type; The priority determination subunit is configured to determine the priority of the application data according to the level identifier. 8. The device according to claim 6, wherein the prioritization unit comprises: Identifying subunits for identifying application data types; adding an identification subunit, configured to add a type identification before the application data according to the application data type; a classification subunit, configured to classify the application data according to the type identifier; The priority determination subunit is configured to determine the priority of each category of application data obtained after classification. 9. The device according to claim 8, wherein the classification subunit is configured to classify the application data according to the protocol type information, source IP and destination IP address information or resource type information included in the type identifier . 10. The device according to any one of claims 6-9, wherein the sending unit comprises: a queuing subunit, configured to put the application data into a queue corresponding to the divided priority; The sequential sending subunit is used to send application data according to the priority order of each queue.

Images