CN115225313B - A highly reliable cloud network virtual private network communication method and device - Google Patents

Abstract

The application discloses a highly reliable cloud network virtual private network communication method and a device, wherein the method comprises the following steps: based on the VPN client, sending an IP packet in a preset format to a first VPN gateway, carrying out first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, establishing first transmission between the VPN client and the first VPN gateway, and when the VPN client is switched from the first VPN gateway to a second VPN gateway to establish second transmission, carrying out second identity authentication of the VPN client and the second VPN gateway based on an authentication request packet sent by the first transmission; based on the first transmission and the second transmission, a detection request packet is sent to the VPN gateway associated with transmission through the VPN client so as to finish detection between the VPN client and the VPN gateway associated with transmission. The application can construct a tunnel for data transmission between the VPN client and the VPN gateway, and the IP packet for constructing the transmission tunnel has a structure similar to a widely used TCP packet in the Internet, thereby being beneficial to improving the reliability of data transmission between the VPN client and the VPN gateway.

Description

A highly reliable cloud network virtual private network communication method and device

technical field

The invention relates to the technical field of network communication transmission, in particular to a highly reliable cloud network virtual private network communication method and device.

Background technique

Cloud network VPN is a layered network built on a public network (such as the Internet). It is an imaginary network rather than a real private network, but the VPN retains the security of a private network. A common way to construct a VPN on the Internet is to establish a tunnel through the Internet between the VPN client and the VPN gateway. The VPN client and VPN gateway guarantee the integrity and confidentiality of the data communicated through the tunnel. The existing way is to use the IPSec protocol to build a tunnel between the VPN client and the VPN gateway. The IPSec packet generated by this method may be discarded by devices in the network during transmission on the Internet. The prior art often uses the IPSec protocol to construct the IPSec packet to transmit data between the VPN client and the VPN gateway.

IPSec packets are easily recognized as abnormal packets by devices on the Internet and discarded. Tunnels based on IPSec packets are therefore relatively fragile in the Internet. Therefore, how to prevent devices on the Internet from discarding traffic transmitted on the tunnel between the VPN client and the VPN gateway? package, which needs to be resolved urgently.

Contents of the invention

The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

For this reason, the object of the present invention is to propose a kind of highly reliable cloud network virtual private network communication method, can be applied to VPN communication scene, can be used for constructing the tunnel of data transmission between VPN client and VPN gateway, contribute to VPN Improved reliability of data transmission between client and VPN gateway.

Another object of the present invention is to provide a highly reliable cloud network virtual private network communication device.

In order to achieve the above purpose, the present invention proposes a highly reliable cloud network virtual private network communication method on the one hand, including:

Based on the VPN client sending an IP packet of a preset format to the first VPN gateway, and performing first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, establishing the VPN client and the first VPN gateway The first transmission between the first VPN gateways, wherein the IP packet in the preset format is an IP packet whose packet type in the VPN header is online;

When the VPN client is switched from the first VPN gateway to the second VPN gateway to establish a second transmission, the VPN client and the second VPN gateway are authenticated based on the authentication request packet sent by the first transmission. Second identity authentication;

Based on the first transmission and the second transmission, the VPN client sends a detection request packet to the VPN gateway associated with the transmission, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission.

In addition, the highly reliable cloud network virtual private network communication method according to the above-mentioned embodiments of the present invention may also have the following additional technical features:

Further, in an embodiment of the present invention, the method further includes: determining the corresponding packet type of the VPN header according to the data in the IP packet of the preset format; wherein, the packet of the VPN header The type includes at least one of the following: the online IP packet, the authentication request packet, the authentication reply packet, the authentication completion packet, the probe request packet, the probe reply packet, the ESP packet, the WireGuard packet and the RAW packet.

Further, in an embodiment of the present invention, the method further includes: when the IP address and port number of the VPN client change, sending a TCP connection exception to the VPN client through the first VPN gateway Terminate the RST packet, and re-perform the first identity authentication of the VPN client and the first VPN gateway according to the configuration information.

Further, in an embodiment of the present invention, before sending the IP packet whose packet type is online to the first VPN gateway, it also includes: using a VPN client to imitate TCP behavior to establish an IP packet with the first VPN gateway. Connecting, specifically: using the VPN client to send a SYN packet for establishing a TCP connection to the first VPN gateway; using the first VPN gateway to receive the SYN packet, and replying a SYN+ACK packet to the VPN client; Using the VPN client to receive the SYN+ACK packet, and send an ACK packet to the first VPN gateway.

Further, in an embodiment of the present invention, performing the first identity authentication of the VPN client and the first VPN gateway according to the configuration information includes: sending the VPN client to the first VPN gateway through the VPN client. A VPN gateway sends the online IP packet, and according to the configuration information, determines whether the online IP packet is marked with the low-frequency detection information, and if the configuration information indicates that the low-frequency detection information is used, the The position is marked as 1, otherwise the position is marked as 0; the first identity authentication is triggered based on the online IP packet, and the first authentication request packet is sent to the VPN client by the first VPN gateway; The VPN client receives the first authentication request packet, and sends a first authentication reply packet to the first VPN gateway, and uses the first VPN gateway to receive the first authentication reply packet, if the first authentication reply The authentication information of the packet is correct, and a first authentication completion packet is sent to the VPN client; wherein, the first authentication reply packet includes information used by the first VPN gateway to verify the identity of the VPN client.

Further, in an embodiment of the present invention, after the first identity authentication is completed, further comprising: performing data interaction between the VPN client and the first VPN gateway; wherein, the data interaction includes : According to the configuration information, perform one of FEC encoding, ESP tunnel encapsulation using IPSec, WireGuard tunnel encapsulation or RAW without encapsulation to transmit data.

Further, in one embodiment of the present invention, the format of the control information part of the authentication request packet includes: version, serial number, IP and port number; the format of the control information part of the authentication reply packet includes: version, Serial number, IP, port number and authentication information.

Further, in an embodiment of the present invention, when the VPN client switches from the first VPN gateway to the second VPN gateway to establish the second transmission, based on the first transmission and according to the authentication request packet Performing the second identity authentication of the VPN client and the second VPN gateway includes: when the VPN client is switched from the first VPN gateway to the second VPN gateway, triggering the second identity authentication, by The second VPN gateway sends a second authentication request packet to the VPN client; uses the VPN client to receive the second authentication request packet, and sends a second authentication reply packet to the second VPN gateway, through The second VPN gateway receives the second authentication reply, and if the authentication information of the second authentication reply is correct, sends a second authentication complete packet to the VPN client; wherein, the second authentication reply packet includes Information used by the second VPN gateway to verify the identity of the VPN client.

Further, in an embodiment of the present invention, the VPN client sends a detection request packet to the VPN gateway associated with the transmission, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission , including: using the VPN client to send the detection request packet to the VPN gateway associated with the transmission; receiving the detection request packet by the VPN gateway associated with the transmission, and sending the detection request packet to the VPN client. A probe reply packet to complete the probe between the VPN client and the transport associated VPN gateway.

The highly reliable cloud network virtual private network communication method in the embodiment of the present invention can be applied to a VPN communication scene, and can be used to construct a tunnel for data transmission between a VPN client and a VPN gateway, and the IP packets for constructing a transmission tunnel are widely used in the Internet. The TCP packet structure used is similar, which helps to improve the reliability of data transmission between the VPN client and the VPN gateway.

In order to achieve the above purpose, another aspect of the present invention proposes a highly reliable cloud network virtual private network communication device, including:

The first transmission module is configured to send an IP packet in a preset format to the first VPN gateway based on the VPN client, and perform first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, Establishing a first transmission between the VPN client and the first VPN gateway, wherein the IP packet in the preset format is an IP packet whose packet type in the VPN header is online;

The second transmission module is used for when the VPN client is switched from the first VPN gateway to the second VPN gateway to establish a second transmission, based on the authentication request packet sent by the first transmission, the VPN client and The second identity authentication of the second VPN gateway;

A periodic detection module, configured to send a detection request packet to the VPN gateway associated with the transmission through the VPN client based on the first transmission and the second transmission, so as to complete the connection between the VPN client and the VPN gateway associated with the transmission. Between detection.

Further, the above device further includes: a type determining module, configured to determine the corresponding packet type of the VPN header according to the data in the IP packet of the preset format; wherein, the packet type of the VPN header includes the following: At least one of: the online IP packet, the authentication request packet, the authentication reply packet, the authentication completion packet, the probe request packet, the probe reply packet, the ESP packet, the WireGuard packet, and the RAW packet.

Further, the above device further includes: a port change module, configured to send a TCP connection abnormal termination packet RST to the VPN client through the first VPN gateway when the IP address and port number of the VPN client change, And perform the first identity authentication of the VPN client and the first VPN gateway again according to the configuration information.

Further, the above device also includes: an imitation connection module, configured to use the VPN client to imitate TCP behavior to establish a connection with the first VPN gateway, specifically including:

The first connection submodule is configured to use the VPN client to send a SYN packet for establishing a TCP connection to the first VPN gateway;

The second connection submodule is used to receive the SYN packet by using the first VPN gateway, and reply the SYN+ACK packet to the VPN client;

The third connection sub-module is configured to use the VPN client to receive the SYN+ACK packet, and send the ACK packet to the first VPN gateway.

Further, the above-mentioned first transmission module includes:

A location marking module, configured to send the online IP packet to the first VPN gateway through the VPN client, and determine whether the online IP packet performs location marking on the low-frequency detection information according to the configuration information, if The configuration information indicates that the low-frequency detection information is used, and the position is marked as 1, otherwise, the position is marked as 0;

A first identity authentication module, configured to trigger first identity authentication based on the online IP packet, and send a first authentication request packet to the VPN client by using the first VPN gateway;

The first authentication completion module is configured to use the VPN client to receive the first authentication request packet, and send a first authentication reply packet to the first VPN gateway, and use the first VPN gateway to receive the first authentication request packet. An authentication reply packet, if the authentication information of the first authentication reply packet is correct, send a first authentication completion packet to the VPN client; wherein, the first authentication reply packet includes the first VPN gateway used to verify Information about the identity of the VPN client.

Further, after the above-mentioned first authentication completion module, it also includes: a data interaction module for performing data interaction between the VPN client and the first VPN gateway; wherein, the data interaction includes: performing FEC encoding according to the configuration information , use IPSec ESP tunnel encapsulation, use WireGuard tunnel encapsulation or RAW without encapsulation to transmit data.

Further, the above-mentioned second transmission module includes:

The second identity authentication module is used to trigger the second identity authentication when the VPN client is switched from the first VPN gateway to the second VPN gateway, and send the VPN client to the VPN client through the second VPN gateway. The second authentication request packet;

The second authentication completion module is configured to use the VPN client to receive the second authentication request packet, and send a second authentication reply packet to the second VPN gateway, and receive the second authentication request packet through the second VPN gateway. An authentication reply, if the authentication information of the second authentication reply is correct, send a second authentication completion packet to the VPN client; wherein, the second authentication reply packet includes the second authentication reply packet used by the second VPN gateway to verify the Information about the identity of the VPN client.

Further, the above-mentioned cycle detection module includes:

A probe request module, configured to use the VPN client to send the probe request packet to the VPN gateway associated with the transmission;

A probe reply module, configured to use the VPN gateway associated with the transmission to receive the probe request packet, and send the probe reply packet to the VPN client, so as to complete the connection between the VPN client and the VPN gateway associated with the transmission. Between detection.

The highly reliable cloud network virtual private network communication device of the embodiment of the present invention can be applied to VPN communication scenarios, and can be used to construct a tunnel for data transmission between a VPN client and a VPN gateway, and the IP packets for constructing a transmission tunnel are widely used in the Internet. The TCP packet structure used is similar, which helps to improve the reliability of data transmission between the VPN client and the VPN gateway.

The beneficial effects of the present invention are:

The present invention can be applied to the VPN communication scene, and can be used to construct a data transmission tunnel between the VPN client and the VPN gateway. Applicable products include but are not limited to the construction of tenant networks in cloud networks and SD-WAN (Software Defined Wide Area Network, software-defined wide area network) product (Customer-Premises Equipment, CPE) on the cloud or communicate with each other.

IPSec packets are easily recognized as abnormal packets by devices on the Internet and discarded. Therefore, tunnels built based on IPSec packets are relatively vulnerable on the Internet. The invention imitates the TCP behavior, so that the equipment in the Internet recognizes the packets transmitted in the tunnel as the TCP packets commonly existing in the Internet instead of the rare IPSec packets. The invention helps to improve the reliability of data transmission between the VPN client and the VPN gateway.

Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of drawings

The above and/or additional aspects and advantages of the present invention will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

Fig. 1 is a schematic diagram of the format of an IP packet between a VPN client and a VPN gateway according to an embodiment of the present invention;

2 is a flowchart of a highly reliable cloud network virtual private network communication method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of the format of the control information part of the authentication request packet according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of the format of the control information part of the authentication reply packet according to an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of a highly reliable cloud network virtual private network communication device according to an embodiment of the present invention.

Detailed ways

It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and examples.

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

The highly reliable cloud network virtual private network communication method and device proposed according to the embodiments of the present invention will be described below with reference to the accompanying drawings.

Fig. 2 is a flowchart of a highly reliable cloud network virtual private network communication method according to an embodiment of the present invention.

As shown in Figure 2, the method includes but is not limited to the following steps:

S1, based on the VPN client sending an IP packet in a preset format to the first VPN gateway, and performing the first identity authentication of the VPN client and the first VPN gateway according to the preset configuration information, and establishing the VPN client and the first VPN gateway The first transmission between, wherein, the IP packet with the preset format is an IP packet whose packet type in the VPN header is online.

It can be understood that the present invention defines the format of the IP packet between the cloud network VPN client and the VPN gateway, as shown in FIG. 1 . The format of the IP packet includes an IP header, a TCP header, a VPN header, data or control information, and an integrity check; wherein, the IP header and the TCP header follow the definition of the computer network TCP/IP protocol. Figure 1 omits the option fields of the IP header and the TCP header that may follow the IP header and the TCP header. After the TCP header is the VPN header defined by the present invention, and its length is fixed at 20 bytes. The last 12 bytes of the entire IP packet are used for integrity check of the packet. The length of the packet body between the VPN header and the integrity check field is variable. According to the content of the packet body here, the packet can be divided into two types. If the packet body information here is data, the packet is called a data packet. If this If the packet body information is control information, the packet is called a control packet. The first 3 bits (bits) of the first byte of the VPN header are the flag bit field, and the last 5 bits are the packet type field. The flag bit field contains three possible flags, which are incompatible with each other, and their names, meanings, and impact on the packet format are shown in Table 1. The package type field describes the specific package type, and they are also incompatible with each other. Their names, meanings and impact on the package format are shown in Table 2. The "VPN ID" field of the VPN header is used to uniquely identify the VPN tunnel that the VPN client can use.

Table 1 Possible flags of the VPN header flag field

Table 2 Possible packet types in the VPN header packet type field

It can be understood that this process occurs when the VPN client is initialized for the first time, and the VPN controller pushes the VPN configuration to the VPN client and multiple VPN gateways. The configuration includes: the VPN ID for this VPN client, the key required for tunnel encryption corresponding to this VPN ID, the key required for VPN client authentication, whether to perform FEC encoding or whether to perform low-frequency detection information, etc. The VPN gateway establishes a session for each VPN client based on this information.

As an example, "connection establishment transmission between the VPN client and the gateway": the VPN client imitates the TCP behavior and sends a TCP connection establishment packet, that is, a SYN packet, to the VPN gateway. The packet contains IP header and TCP header, and the packet body ends at the TCP header. The format completely imitates the SYN packet of the three-way handshake when TCP establishes a connection. After the VPN gateway receives the packet, it continues to imitate the TCP connection establishment process, and it will reply a SYN+ACK packet to the VPN client, which is in the same format as the SYN+ACK packet of the three-way handshake when the TCP connection is established. When the VPN client receives the SYN+ACK packet, it will send an ACK packet to the VPN gateway that imitates the three-way handshake when TCP establishes a connection.

After the three-way handshake, the VPN client will send the "go online" packet mentioned in Table 2 to the VPN gateway. According to the configuration information received by the VPN client during the process of "VPN controller pushes VPN configuration", the VPN client will determine the "go online" packet. " package whether to set the "low frequency detection" flag bit to 1. The "go online" packet will trigger the VPN gateway to authenticate the identity of the VPN client. The VPN gateway will first send an "authentication request" packet to the VPN client to start the identity authentication process. The format of the control information part of the "authentication request" packet in the present invention is shown in FIG. 3 . After the VPN client receives the "authentication request", it will send the "authentication reply" packet to the VPN gateway. The format of the control information part of the "Authentication Reply" packet in the present invention is shown in FIG. 4 . Contains information that the VPN gateway can use to verify the identity of the VPN client. After the VPN gateway receives the "authentication reply", if the "authentication information" is correct, it will send an "authentication complete" packet to the VPN client. As shown in Fig. 3 and Fig. 4, they are schematic diagrams of the format of the control information part of the "authentication request" packet and the part of the control information of the "authentication reply" packet in the present invention, respectively. The format of the control information part of the authentication request packet includes: version, serial number, IP and port number; the format of the control information part of the authentication reply packet includes: version, serial number, IP, port number and authentication information.

After the authentication is passed, data exchange will take place between the VPN client and the VPN gateway. According to the configuration information pushed to the VPN client during the process of "VPN controller pushing VPN configuration", the data packet may be FEC encoded, may be encapsulated by IPSec's ESP tunnel, may be encapsulated by WireGuard tunnel or not encapsulated in RAW, etc. to transmit data.

S2. When the VPN client switches from the first VPN gateway to the second VPN gateway to establish the second transmission, perform second identity authentication of the VPN client and the second VPN gateway based on the authentication request packet sent by the first transmission.

It is understandable that the IP address and port number of the VPN client may change. When the IP address and port number of the VPN client change, the VPN gateway will send a TCP RST packet to the VPN client. From the perspective of devices on the Internet It looks like the TCP connection is terminated. Then, the process of "connection establishment and transmission between the VPN client and the gateway" is performed again between the VPN client and the VPN gateway.

Furthermore, when a VPN client switches from one VPN gateway to another, it needs to re-authenticate with the new VPN gateway, that is, the new VPN gateway will first send an "authentication request" packet to the VPN client to activate the identity The process of certification. After the VPN client receives the "authentication request", it will send an "authentication reply" packet to the new VPN gateway. Contains information that the new VPN gateway can use to verify the identity of the VPN client. After the new VPN gateway receives the "authentication reply", if the "authentication information" is correct, it will send the "authentication complete" packet to the VPN client.

S3. Based on the first transmission and the second transmission, the VPN client sends a detection request packet to the VPN gateway associated with the transmission, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission.

Specifically, the VPN client periodically sends a detection request packet to the VPN gateway. After receiving the "period detection request" packet, the VPN gateway sends the "period detection reply packet" to the VPN client.

The highly reliable cloud network virtual private network communication method according to the embodiment of the present invention can be applied to VPN communication scenarios, and can be used to construct a tunnel for data transmission between the VPN client and the VPN gateway, and the IP packets that construct the transmission tunnel can communicate with those in the Internet. The widely used TCP packet structure is similar, which helps to improve the reliability of data transmission between VPN clients and VPN gateways.

In order to realize the above-mentioned embodiment, as shown in FIG. 5 , a highly reliable cloud network virtual private network communication device 10 is also provided in this embodiment, and the device 10 includes: a first transmission module 100, a second transmission module 200 and a periodic detection Module 300.

The first transmission module 100 is configured to send an IP packet in a preset format to the first VPN gateway based on the VPN client, and perform first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, and establish The first transmission between the VPN client and the first VPN gateway, wherein the IP packet in the preset format is an IP packet whose packet type in the VPN header is online;

The second transmission module 200 is used to perform the second communication between the VPN client and the second VPN gateway based on the authentication request packet sent by the first transmission when the VPN client is switched from the first VPN gateway to the second VPN gateway to establish the second transmission. Authentication;

The periodic detection module 300 is configured to send a detection request packet to the VPN gateway associated with the transmission through the VPN client based on the first transmission and the second transmission, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission.

Further, the above-mentioned device 10 also includes: a type determination module, configured to determine the packet type of the corresponding VPN header according to the data in the IP packet of the preset format; wherein, the packet type of the VPN header includes at least one of the following: Online IP packets, authentication request packets, authentication reply packets, authentication complete packets, probe request packets, probe reply packets, ESP packets, WireGuard packets, and RAW packets.

Further, the above-mentioned device 10 also includes: a port change module, configured to send a TCP connection abnormal termination packet RST to the VPN client through the first VPN gateway when the IP address and port number of the VPN client change, and restart the connection according to the configuration information. Perform first identity authentication of the VPN client and the first VPN gateway.

Further, the above-mentioned device 10 also includes: an imitation connection module, configured to use the VPN client to imitate TCP behavior to establish a connection with the first VPN gateway, specifically including:

The first connection submodule is configured to use the VPN client to send a SYN packet for establishing a TCP connection to the first VPN gateway;

The second connection submodule is used to receive the SYN packet by using the first VPN gateway, and reply the SYN+ACK packet to the VPN client;

The third connection sub-module is configured to use the VPN client to receive the SYN+ACK packet, and send the ACK packet to the first VPN gateway.

Further, the above-mentioned first transmission module 100 includes:

The position marking module is used to send the online IP packet to the first VPN gateway through the VPN client, and according to the configuration information, determine whether the online IP packet carries out the position marking of the low-frequency detection information, and if the configuration information indicates that the low-frequency detection information is used, then the The position is marked as 1, otherwise the position is marked as 0;

The first identity authentication module is configured to trigger the first identity authentication based on the online IP packet, and utilize the first VPN gateway to send the first authentication request packet to the VPN client;

The first authentication completion module is configured to use the VPN client to receive the first authentication request packet, and send the first authentication reply packet to the first VPN gateway, and utilize the first VPN gateway to receive the first authentication reply packet, if the first authentication reply packet The authentication information is correct, and the first authentication completion packet is sent to the VPN client; wherein, the first authentication reply packet includes information used by the first VPN gateway to verify the identity of the VPN client.

Further, after the above-mentioned first authentication completion module, it also includes: a data interaction module for performing data interaction between the VPN client and the first VPN gateway; wherein, the data interaction includes: performing FEC encoding, using One of IPSec's ESP tunnel encapsulation, WireGuard tunnel encapsulation, or RAW without encapsulation.

Further, the above-mentioned second transmission module 200 includes:

The second identity authentication module is used to trigger the second identity authentication when the VPN client is switched from the first VPN gateway to the second VPN gateway, and send the second authentication request packet to the VPN client through the second VPN gateway;

The second authentication completion module is used to use the VPN client to receive the second authentication request packet, and send the second authentication reply packet to the second VPN gateway, and receive the second authentication reply through the second VPN gateway, if the authentication of the second authentication reply If the information is correct, a second authentication completion packet is sent to the VPN client; wherein, the second authentication reply packet includes information used by the second VPN gateway to verify the identity of the VPN client.

Further, the above cycle detection module 300 includes:

A probe request module, configured to send a probe request packet to the VPN gateway associated with the transmission by using the VPN client;

The detection reply module is used for receiving the detection request packet by the VPN gateway associated with the transmission, and sending the detection reply packet to the VPN client, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission.

The highly reliable cloud network virtual private network communication device according to the embodiment of the present invention can be applied to VPN communication scenarios, and can be used to construct a tunnel for data transmission between the VPN client and the VPN gateway, and the IP packets that construct the transmission tunnel can communicate with those in the Internet. The widely used TCP packet structure is similar, which helps to improve the reliability of data transmission between VPN clients and VPN gateways.

It should be noted that the foregoing explanations of the embodiment of the highly reliable cloud network virtual private network communication method are also applicable to the highly reliable cloud network virtual private network communication device of this embodiment, and will not be repeated here.

In addition, the terms "first" and "second" are used for descriptive purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the described specific features, structures, materials or characteristics may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention, and those skilled in the art can make the above-mentioned The embodiments are subject to changes, modifications, substitutions and variations.

Claims (7)

1. A highly reliable cloud network virtual private network communication method, is characterized in that, comprises the following steps: Based on the VPN client sending an IP packet of a preset format to the first VPN gateway, and performing first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, establishing the VPN client and the first VPN gateway The first transmission between the first VPN gateways, wherein the IP packet in the preset format is an IP packet whose packet type in the VPN header is the online IP packet; the online IP packet is only used in the control packet, and the VPN client After the VPN client goes online, the client and the VPN gateway perform a three-way handshake, and then the VPN client sends the online IP packet to the VPN gateway; When the VPN client is switched from the first VPN gateway to the second VPN gateway to establish a second transmission, the VPN client and the second VPN gateway are authenticated based on the authentication request packet sent by the first transmission. Second identity authentication; Based on the first transmission and the second transmission, sending a detection request packet to the VPN gateway associated with the transmission through the VPN client, so as to complete the detection between the VPN client and the VPN gateway associated with the transmission; The method further includes: when the IP address and port number of the VPN client change, sending a TCP connection abnormal termination packet RST to the VPN client through the first VPN gateway, and redo the process according to the configuration information. First identity authentication of the VPN client and the first VPN gateway; Before the IP packet of the preset format is sent to the first VPN gateway based on the VPN client, it also includes: using the VPN client to imitate TCP behavior to establish a connection with the first VPN gateway, specifically: Utilize the VPN client to send a SYN packet for TCP connection establishment to the first VPN gateway; receiving the SYN packet by using the first VPN gateway, and replying a SYN+ACK packet to the VPN client; using the VPN client to receive the SYN+ACK packet, and send an ACK packet to the first VPN gateway; The first identity authentication of the VPN client and the first VPN gateway according to the configuration information includes: Send the online IP packet to the first VPN gateway through the VPN client, and determine whether the online IP packet will mark the location of the low-frequency detection information according to the configuration information, if the configuration information indicates the use of For the low-frequency detection information, mark the position as 1, otherwise mark the position as 0; Triggering first identity authentication based on the online IP packet, using the first VPN gateway to send a first authentication request packet to the VPN client; Using the VPN client to receive the first authentication request packet, and sending a first authentication reply packet to the first VPN gateway, using the first VPN gateway to receive the first authentication reply packet, if the first authentication reply packet is used, The authentication information of an authentication reply packet is correct, and a first authentication completion packet is sent to the VPN client; wherein, the first authentication reply packet includes information used by the first VPN gateway to verify the identity of the VPN client . 2. The method according to claim 1, further comprising: determining the packet type of the corresponding VPN header according to the data in the IP packet of the preset format; wherein, the VPN The packet type of the header includes at least one of the following: the online IP packet, the authentication request packet, the authentication reply packet, the authentication completion packet, the probe request packet, the probe reply packet, the ESP packet, the WireGuard packet, and the RAW Bag. 3. The method according to claim 1, further comprising: after the first identity authentication is completed: Perform data interaction between the VPN client and the first VPN gateway; wherein, the data interaction includes: performing FEC encoding, encapsulation using IPSec's ESP tunnel, encapsulation using a WireGuard tunnel or no encapsulation according to the configuration information One of the data transmitted in RAW mode. 4. The method according to claim 3, wherein the format of the control information part of the authentication request packet includes: version, serial number, IP and port number; The format of the control information part of the authentication reply packet includes: version, serial number, IP, port number and authentication information. 5. The method according to claim 4, wherein when the VPN client is switched from the first VPN gateway to the second VPN gateway to establish a second transmission, based on the first transmission and according to The authentication request packet performs the second identity authentication of the VPN client and the second VPN gateway, including: When the VPN client is switched from the first VPN gateway to the second VPN gateway, a second identity authentication is triggered, and a second authentication request packet is sent to the VPN client through the second VPN gateway; Use the VPN client to receive the second authentication request packet, and send a second authentication reply packet to the second VPN gateway, receive the second authentication reply through the second VPN gateway, if the second The authentication information of the authentication reply is correct, and a second authentication completion packet is sent to the VPN client; wherein, the second authentication reply packet includes information used by the second VPN gateway to verify the identity of the VPN client. 6. The method according to claim 5, wherein the VPN client sends a detection request packet to the VPN gateway associated with the transmission to complete the connection between the VPN client and the VPN gateway associated with the transmission. Interval detection, including: using the VPN client to send the probe request packet to the VPN gateway associated with the transport; The VPN gateway associated with the transport receives the probe request packet, and sends the probe reply packet to the VPN client, so as to complete the probe between the VPN client and the VPN gateway associated with the transport. 7. A highly reliable cloud network virtual private network communication device, characterized in that it comprises: The first transmission module is configured to send an IP packet in a preset format to the first VPN gateway based on the VPN client, and perform first identity authentication of the VPN client and the first VPN gateway according to preset configuration information, Establishing the first transmission between the VPN client and the first VPN gateway, wherein the IP packet in the preset format is an IP packet whose packet type in the VPN header is an online IP packet; the online IP packet is only used In the control packet, the VPN client and the VPN gateway perform a three-way handshake after the VPN client goes online, and then the VPN client sends the online IP packet to the VPN gateway; The second transmission module is used for when the VPN client is switched from the first VPN gateway to the second VPN gateway to establish a second transmission, based on the authentication request packet sent by the first transmission, the VPN client and The second identity authentication of the second VPN gateway; A periodic detection module, configured to send a detection request packet to the VPN gateway associated with the transmission through the VPN client based on the first transmission and the second transmission, so as to complete the connection between the VPN client and the VPN gateway associated with the transmission. detection between It also includes: when the IP address and port number of the VPN client change, sending a TCP connection abnormal termination packet RST to the VPN client through the first VPN gateway, and performing the VPN again according to the configuration information First identity authentication of the client and the first VPN gateway; Before the first transmission module, it also includes: using a VPN client to imitate TCP behavior to establish a connection with the first VPN gateway, specifically: Utilize the VPN client to send a SYN packet for TCP connection establishment to the first VPN gateway; receiving the SYN packet by using the first VPN gateway, and replying a SYN+ACK packet to the VPN client; using the VPN client to receive the SYN+ACK packet, and send an ACK packet to the first VPN gateway; The first transmission module is also used for: Send the online IP packet to the first VPN gateway through the VPN client, and determine whether the online IP packet will mark the location of the low-frequency detection information according to the configuration information, if the configuration information indicates the use of For the low-frequency detection information, mark the position as 1, otherwise mark the position as 0; Triggering first identity authentication based on the online IP packet, using the first VPN gateway to send a first authentication request packet to the VPN client; Using the VPN client to receive the first authentication request packet, and sending a first authentication reply packet to the first VPN gateway, using the first VPN gateway to receive the first authentication reply packet, if the first authentication reply packet is used, The authentication information of an authentication reply packet is correct, and a first authentication completion packet is sent to the VPN client; wherein, the first authentication reply packet includes information used by the first VPN gateway to verify the identity of the VPN client .