CN100372323C - A method for accessing server group - Google Patents

The present invention discloses a method for accessing a server cluster. The present invention is characterized in that the method comprises the steps that in step A, a subscriber accesses intermediate equipment by using an IP address and a port number for different types of service, and the IP address and the port number are provided by the intermediate equipment for outside; by using information prestored in the intermediate equipment, the intermediate equipment allocates a server for the access of the subscriber and establishes message conversion rules between the subscriber and the allocated server; in step B, the subscriber and the allocated server mutually transmit messages through the intermediate equipment according to the message conversion rules. In the method, the servers which provide service do not respectively occupy public network IP addresses any longer, and the subscribers access the servers through the intermediate equipment which provide IP addresses to the outside; in this way, the resource consumption of the public network IP addresses is reduced. Besides, the method makes the subscriber difficult to attack the servers according to addresses of the servers, and thus, the method provides network security.

A kind of access server group's method

Technical field

The invention belongs to network communication field, relate in particular to address process and safeguard protection field in the network service.

Background technology

Current, network is just developed with swift and violent speed, and its application is penetrated among the fields of society gradually.Accordingly, each website provides diversified network service at different COS and service object.These websites adopt in HTTP(Hypertext Transport Protocol), file transfer protocol (FTP) (FTP), Simple Mail Transfer protocol (SMTP) and the post office protocol (POP) one or more that service is provided more, and the user then visits these services by the IP address.Along with increasing of type service that the website provided and quantity, increasing public network IP address is occupied, makes to show nervous Internet resources day; Simultaneously, owing to provide the Website server of the above service all the IP address of himself to be offered the user, therefore, under the situation that fire compartment wall is not installed, make server be in complete exposed state, poor stability, very easily under attack, thus influence network security.

Summary of the invention

In view of this, main purpose of the present invention is to provide a kind of access server group's method, this method realizes using the visit of IP address that the server zone of different services is provided, both reduced the consumption of public network IP address resources, also make the user can't obtain providing the server address of service, thereby reduced the possibility of user's attack server, strengthened network security.

The present invention is a kind of access server group's a method, it is characterized in that this method comprises:

The IP address that A, user provide by intermediate equipment and the port numbers of dissimilar services are visited described intermediate equipment, the connection request that described intermediate equipment sends during according to the related information of its service of storing in advance and user capture, determine the COS of user capture, then, described intermediate equipment is according to the related information of the COS corresponding server of storing in advance, distribute the server of this user capture, and set up the message transformation rule between described user and the institute's distribution server;

According to described message transformation rule transformation rule, transmit message between B, described user and the institute's distribution server by described intermediate equipment.

Wherein, the IP address that described intermediate equipment provides is same IP address, and the IP address number that perhaps provides is less than the number of the server that service is provided.

Wherein, steps A further comprises:

The pairing port numbers of service that the IP address that A1, user provide with intermediate equipment externally provides as destination address, with intermediate equipment is as the destination slogan, to intermediate equipment send server connection request;

A2, intermediate equipment are received connection request, determine the COS of user capture according to the related information of the service of storage in advance, the protocol type of destination address, destination slogan and message in this connection request, then, the related information of the service corresponding server that the intermediate equipment utilization is stored in advance, determine this COS corresponding server for the user distributes, the server connection request is sent to this server;

A3, server are received user's connection request, sending connection request to intermediate equipment replys, intermediate equipment is replied this connection request and is sent to the user who initiates connection request, and intermediate equipment is set up message transformation rule between the server that user and this are user's distribution according to fixing algorithm.

Wherein, the related information of the service of storing in advance on the intermediate equipment described in the steps A 2 comprises IP address, port numbers and the protocol type of this service at least.

Wherein, the related information of storing in advance on the intermediate equipment described in the steps A 2 of serving institute's corresponding with service device comprises the IP address and the port numbers of this service corresponding with service device at least.

Wherein, in the steps A 3, the message transformation rule that described intermediate equipment is set up between the server that user and this distribute for the user according to fixing algorithm comprises:

Intermediate equipment sends source address, source port number, destination address, destination slogan and protocol type in the connection request message as a five-tuple with the user, this five-tuple is carried out hash calculate a hash value, this hash value and this IP address and port numbers for the server of user's distribution are preserved in pairs, send the transformation rule of message as the user to this server that distributes for the user; Intermediate equipment with this server that distributes for the user to source address, source port number, destination address, destination slogan and the protocol type of response message that intermediate equipment sends as a five-tuple, this five-tuple is carried out hash calculate a hash value, this hash value and this address and port numbers that sends the user of service connection request are preserved in pairs, send the transformation rule of message as this server that distributes for the user to the user.

Wherein, according to this transformation rule, E-Packeting by intermediate equipment comprises between user described in the step B and the institute's distribution server:

Intermediate equipment sends source address, source port number, destination address, destination slogan and protocol type in the message as five-tuple with the user, this five-tuple is carried out hash to be calculated, obtain this hash value corresponding server IP address and port numbers according to the hash value that calculates, destination address in the user's message and destination slogan are converted to this server ip address and port numbers, and intermediate equipment sends to server with message according to this address and port numbers;

Intermediate equipment with the source address in the server acknowledge message, source port number, destination address, destination slogan and protocol type as five-tuple, this five-tuple is carried out hash to be calculated, obtain the corresponding user's of this hash value address and port numbers according to the hash value that calculates, destination address in the server acknowledge message and destination slogan are converted to this user's address and port numbers, and intermediate equipment sends to the user with message according to this address and port numbers.

Wherein, this method further comprises: on intermediate equipment, the pairing port numbers of service that provides of intermediate equipment is set to different with the port numbers of this service corresponding with service device in advance.

Wherein, when the corresponding a plurality of server of service, the server of described this user capture of distribution of steps A further comprises:

Intermediate equipment is carried out load balancing according to the present flow rate of each corresponding server of the type service, is user's distribution server according to the load balancing result.

Wherein, described intermediate equipment is a switching equipment.

As seen, in the method, provide each server of service to occupy public network IP address no longer respectively, the user is by externally providing the switching equipment access server of IP address, in this way, reduced the consumption of public network IP address resources, and, this method makes the user be difficult to according to the server address attack server, thereby internet security is provided.

Description of drawings

Fig. 1 is a server networking schematic diagram of the present invention.

Fig. 2 is for using same internet protocol address access server group's flow chart.

Embodiment

The present invention is a kind of access server group's a method, in the method, the IP address visit intermediate equipment that the user provides the user by intermediate equipment, intermediate equipment is determined service and is determined server for the user according to user's access type, set up the message transformation rule between the server of user and distribution then, according to this rule, the message between intermediate equipment forwarding server and the user, thus realize that server is to service that the user provided.

Below with switching equipment as intermediate equipment, it is example that this switching equipment externally provides an IP address, describes the present invention in conjunction with the accompanying drawings.

Referring to shown in Figure 1, in the embodiment of the invention, exist three kinds of services to offer the user, be respectively: FTP service, HTTP service and POP3 service, these three kinds only corresponding respectively servers of service are respectively ftp server, http server and POP3 server, these three servers have IP address and port numbers separately respectively, wherein, the IP address of ftp server is: 192.168.2.101, and port numbers is 21; The IP address of http server is: 192.168.2.102, and port numbers is 80; The IP address of POP3 server is: 192.168.2.103, port numbers is 110.In embodiments of the present invention, adopt multilayer switching equipment (Webswitch) equipment in return, above-mentioned each server of service that provides is coupled together, the Internet (INTERNET) side user provides the respective server of service by the Webswitch visit.This Webswitch provides same IP address 202.119.5.100 to INTERNET side user, and service provides different port numbers 21,80,110 respectively with POP3 for FTP service, HTTP service.Ginseng is shown in Table 1, on this Webswitch, preserve the related information table, the related information of the FTP service that storage in advance provides to some extent on this table, HTTP service and POP3 service and the related information of every kind of service corresponding server, wherein, the protocol type that comprises IP address, port numbers and this service of each service in the related information of each service, the related information of service corresponding server comprises the IP address and the port numbers of this server.Wherein, in other embodiment of the present invention, also can further provide the service of n kind, at this moment, related information saving that need the service of n kind is corresponding is in the related information table shown in the table 1, and a kind of service is corresponding a plurality of servers further, for example, n can a corresponding m server for service, at this moment, in the list item of service n, comprise the related information as mentioned above of m server in the related information table.

Table 1

Referring to shown in Figure 2, the user is described in detail by the corresponding service of Webswitch visit:

With user's internet usage (IE) browser access HTTP service is example, and the user specifically may further comprise the steps by Webswitch visit HTTP service:

Step 201: the user imports the IP address 202.119.5.100 that Webswitch externally provides in browser's address bar, by INTERNET to Webswitch send server connection request message, wherein, in this message, comprise destination address, destination slogan and protocol type that message sends, wherein, the IP address 202.119.5.100 that this connection request message externally provides with Webswitch is as destination address, the port numbers 80 that the HTTP that externally provides with Webswitch serves is as the destination slogan, and protocol type is HTTP; Because in the embodiment of the invention, the user uses IE browser access HTTP service, therefore, the destination slogan of message and protocol type are determined respectively automatically in the embodiment of the invention, need not artificial input, and wherein, the destination slogan is 80, and protocol type is TCP;

Step 202:Webswitch is according to the server connection request message of receiving, the IP address that analysis obtains user institute access services is: 202.119.5.100, port numbers is 80, protocol type is: TCP, Webswitch is in the related information table shown in the table 1, judge in corresponding this list item of related information of service and whether preserve address with above IP, port numbers is identical with protocol type one, embodiment of the invention judged result is corresponding related information and the above-mentioned IP address of HTTP service, port numbers and protocol type are consistent, determine that the user capture COS is the HTTP service, if in other embodiments of the invention, judge the destination address obtain not with the user capture service, the corresponding related information of the corresponding to service of destination slogan and protocol type then returns error message;

Step 203:Webswitch provides the IP address 192.168.2.102 and the port numbers 80 of the server of HTTP service for the user distributes, and destination address, destination slogan in the server connection request message be converted to institute's IP address allocated and port numbers, the server connection request message after will changing again sends to http server; Wherein, in other embodiments of the invention, if the corresponding a plurality of servers of the service that the user visited, then Webswitch obtains the flow situation of each server, according to this flow situation each server is carried out flow load balance, for the user selects a server, making in this way between each server can co-ordination according to the flow load balance result;

Step 204:HTTP server is received server connection request message, to Webswitch send server connection request response message, Webswitch receives this response message, user to the send server connection request transmits this response message, simultaneously, Webswitch set up the user and the server that distributed between the message transformation rule, in the embodiment of the invention, Webswitch sets up the message transformation rule of user side and server side respectively, wherein, the method for building up of user side message transformation rule is:

These five elements of source address, destination address, source port number, destination slogan and protocol type that this user is sent in the connection request constitute a five-tuple, wherein, source address in the connection request and source port number are exactly user's IP address and port numbers, and destination address in the connection request and port numbers are exactly IP address and the port numbers of the Webswitch that visits of user; This five-tuple is carried out hash to be calculated, obtain a hash value, this hash value and this http server IP address definite for the user distributes and port numbers are kept in the hash value correspondence table in pairs, hash value correspondence table ginseng is shown in Table 2, with above-mentioned to five-tuple the hash algorithm and the corresponding relation in the hash value correspondence table as the transformation rule of user side message;

Table 2

The method for building up of server side message transformation rule is identical with the method for building up principle of user side message transformation rule, is specially:

These five elements of source address, destination address, source port number, destination slogan and protocol type of the response message that server sent are constituted a five-tuple, wherein, the source address of response message and source port number are exactly IP address and the port numbers that sends the server of response message, and the destination address of response message and port numbers are exactly IP address and the port numbers of the Webswitch that sends to of response message; This five-tuple is carried out hash to be calculated, obtain a hash value, user's IP address and port numbers that this hash value and response message are sent to are kept in the hash value correspondence table shown in the table 2 in pairs, with to the hash algorithm of five-tuple and the corresponding relation in the hash value correspondence table transformation rule as the server side message;

Step 205:Webswitch sets up the user and serves being connected between the pairing server with this user capture according to user side and the server side message transformation rule set up, realizes the service of server to the user, specifically comprises:

Message for the user side transmission, Webswitch is according to user side message transformation rule, with source address in this message and destination address, source port number and destination slogan, and protocol type constitutes a five-tuple, this five-tuple is carried out hash to be calculated, obtain a hash value, in hash value correspondence table, search the hash value identical with this hash value, search according to this identical hash value and to obtain corresponding server address and port numbers, destination address and port numbers in the message that user side is sent are converted to this server address and port numbers, and send message from user side according to this server address and port numbers;

Response message for the server side transmission, Webswitch is according to server side message transformation rule, with source address in this message and destination address, source port number and destination slogan, and protocol type constitutes a five-tuple, this five-tuple is carried out hash to be calculated, obtain a hash value, in hash value correspondence table, search the hash value identical with this hash value, search address and the port numbers that obtains corresponding user side according to this identical hash value, address and port numbers that destination address in the response message that server side is sent and port numbers are converted to this user side, and send message from server side according to the address of this user side and port numbers.

In embodiments of the present invention, when other that is provided in the user capture embodiment of the invention served, the step of its concrete steps and above-mentioned visit HTTP was similar, at this moment, Webswitch can and provide between the server of other service the user, connects by transformation rule.

Wherein, the present invention also can further be applied to provide in the website of more services, and the described process of the process of each service of user capture and the foregoing description is similar; Wherein, each service that is provided can further corresponding a plurality of server, and at this moment, switching equipment can carry out load balancing according to the flow situation in each server of same type, thereby makes the server co-ordination, improves the service efficiency of server.

In above embodiment, switching equipment provides and the corresponding to port numbers of the port numbers of each server own to the user, in other embodiments of the invention, it is different with each server self port numbers of this service that the port numbers of the service that can also externally provide on switching equipment in advance is set to, realize shielding in this way to the server end slogan, to avoid attack from user side, adopt this kind mode, do not influence realization of the present invention.

In other embodiments of the invention, intermediate equipment can externally provide more than 1 but be less than the IP address that the server of service number is provided, in the related information table of intermediate equipment, these IP addresses are inserted respectively in the corresponding related information list item of different services; It is same as the previously described embodiments by the specific implementation of intermediate equipment transmitting-receiving message that the user utilizes IP address visit intermediate equipment, intermediate equipment that intermediate equipment externally provides to set up message transformation rule between user and the server and user and server;

The above only is preferred embodiment of the present invention, and is in order to restriction the present invention, within the spirit and principles in the present invention not all, any modification of being done, is equal to replacement, improvement etc., all should be included within protection scope of the present invention.

As seen, the present invention adopts switching equipment will provide the server of different services to couple together, and this switching equipment externally provides the IP address, and is storing the related information that service is provided and serves pairing server from one's body; The IP address visit switching equipment that the user provides with switching equipment, switching equipment is determined the service that the user visits according to related information, and, the user serves pairing server for distributing this, then, switching equipment is set up the message transformation rule between user and the institute's distribution server, utilize this rule to transmit subsequent packet, thereby realize that server provides service to the user.This method is easy to realization, and simple and reliable.