TWI578748B - Virtual private network connection method - Google Patents

Description

Method for establishing a virtual private network

The present invention relates to the field of Internet data transmission, and in particular, to a method for establishing a virtual private network (VPN).

With the rapid spread of the Internet, in the fourth edition of the Internet Protocol version 4 (IPv4) architecture, the Public Internet Protocol address (Public IP Address) (Public IP Address) The number is not enough for a large number of Internet users to appear quickly. Therefore, after the concept of the Private Network or the Enterprise Intranet was proposed, the private network is now widely used by various organizational systems.

With the booming mobile e-commerce, more and more users realize that the best way to economic globalization is to develop mobile-based business applications. With the increasing frequency of mobile business activities, companies have begun to allow their business partners and suppliers to access the company's local area network, which greatly simplifies the way of information exchange and increases the speed of information exchange. These cooperation and connections are dynamic and rely on the network to maintain and strengthen, so companies have found that such information exchange not only brings the complexity of the network, but also brings management and security issues, because the Internet The road is a global and open TCP/IP-based, unmanageable international Internet path. Therefore, Internet-based business activities face unintentional information threats and security risks.

Further, basically, the server side configured with the virtual IP in the private network can use a gateway or the like to connect to the external service, but does not have an IP level connection capability to the external network address.

When the server inside the private network wants to connect with a server (or mobile Internet device) in the Internet, it can be achieved by using the NAT forwarding mechanism. However, when another server on the server side of the private network that wants to communicate with each other is located inside another private network, a virtual private network (Virtual Private Network) is required between the two private networks. VPN) architecture that uses the Internet to deliver messages between two private networks. The virtual private network uses the encrypted Tunneling Protocol to achieve privacy, packet authentication, message accuracy and other private message security effects, so that the information in the private network is not captured by the external server/user. The goal of the change.

However, in the existing method of establishing a channel protocol, it must be completed through a rather cumbersome connection and setting. In the case of security with the transmission of information, how to complete the connection of the virtual private network in a more concise manner has become an urgent problem to be solved in the field.

Therefore, in order to solve the problem of connection setting and connection inconvenience of the conventional virtual private network, the present invention provides a simple and easy-to-set method for establishing a virtual private network connection, so that different servers belonging to different private networks are provided. The end-to-end mobile device can communicate directly over the network via a simple connection.

To achieve the above objective, the present invention discloses a method for establishing a virtual private network connection, which is applicable to a server end and a user end connectable to the Internet, and includes: the server end login through a server account and a server password. A trusted third-party server exchanges messages. The client also logs in to a trusted third-party server through a user connection account and a user password to exchange messages, and the client sends a user connection account and a public internet protocol (IP) address through a third-party server. The connection between the address and the public port is sent to the server; the server responds to the user's connection account and responds to whether the connection and connection information is established, and the connection response includes the public internet protocol (IP). a address, a public port (port) and an automatic timing (NTP) server; after the specified connection time is transmitted through the synchronization connection time of the server and the third-party server of the client, the server is connected to the server The public Internet Protocol (IP) address of the client and the public port establish a point-to-point direct connection between the server and the client.

Wherein, the third-party server is used as a medium for message exchange in the present invention, so the third-party server is a network server that provides an Internet service system provider for any presence, such as a Gmail account for logging into the Google Internet service. And the password, and the server-side server account is not the same as the user's user connection account. Moreover, the third-party server of the server and the client may be a network server of the same system vendor. For example, when the third-party server is an instant messaging server, the server and the client must use the same type of communication server; Or the server and the third-party server of the client may be network servers of different system vendors. For example, when the third-party server is an e-mail server, the server and the client can use any E-mail accounts can achieve the purpose of message exchange.

The invention has the advantages that the trusted third party server and the account password provided by the server enable the server to directly establish a point-to-point connection with the user terminal, thereby avoiding unnecessary cumbersome setting and connection actions, and providing a more The simple way is to establish a virtual private network communication system between the private networks, and provide the point-to-point transmission capability of the devices between the private networks through the mechanism of the virtual private network communication system.

100‧‧‧ server side

110‧‧‧User side

200‧‧‧Internet

210‧‧‧ Third-party server

220‧‧‧Automatic timing (NTP) server

S301~S303, S310~S316‧‧‧ steps

FIG. 1 is a schematic diagram of a timing sequence of an invitation of the present invention.

FIG. 2 is a schematic diagram showing the sequence of establishing a connection between a virtual private network according to the present invention.

The detailed description of the present invention and the technical description of the present invention are further illustrated by the embodiments, but it should be understood that these embodiments are for illustrative purposes only and are not to be construed as limiting.

Referring to FIG. 1 and FIG. 2, the present invention discloses a method for establishing a virtual private network connection. To achieve the above object, the present invention discloses a method for establishing a virtual private network connection, which is applicable to a connection that can be connected to the Internet 200. The server 100 and the client 110 are respectively connected to the Internet 200.

The server 100 is a virtual private network (VPN) host. The server 100 has a virtual private network threaded with a connection method. The server 100 can be a router. The router has the function of connecting two or more individual networks; of course, the server 100 can also be a separate device. The server 100 can be installed on the back end or the front end of the general router. The client 110 can be any device that can access the Internet, such as a personal computer, a notebook computer, or the like, or the client 110 is a mobile device, and the VPN is connected to the thread (APP). The threaded method of the connection method of the present invention.

First, for the registration procedure, as shown in steps S301 to S303 of FIG. 1, the server 100 transmits the invitation message (including the verification code of the invitation) to the client 110 through the Internet 200. (Step S301), the invitation message delivery mode can be one of e-mail or instant messaging software (such as Twitter, WeChat, LINE, etc.), which can be the network delivery mode received by the user on the client 110, The invitation message includes a VPN and a threaded download link. Especially when the client 110 is a mobile mobile device, such as a smart phone or a tablet, the VPN must be downloaded first (APP). In the following description, the user terminal 110 in the embodiment and the figure uses a mobile phone as an illustrative example.

After receiving the invitation message, the client 110 responds to the invitation message by the client 110 (the client 110 is already loaded with the VPN thread) during the reply period (for example, 24 hours or 3 days), and the client 110 The VPN and threaded will automatically return via the e-mail or instant messaging account on the device, and return the registration information of the user connection account and the verification code at the time of the invitation. The server 100 is provided (step S302); wherein the user connection account may be different from the e-mail or instant messaging software account of the client 110 receiving the invitation message.

After receiving the registration information returned by the client 110 (the user connection account and the verification code), the server 100 stores the client 110 VPN threaded user connection account in a VPN connection. In the registration form, and whether the client 110 accepts or rejects the client 110 VPN threaded corresponding data (user connection account and verification code) (step S303), so that the client 110 VPN connection The thread type knows whether the registration is successful, and dynamically generates a set of passwords, and the server 100 transmits the VPN connection password to the VPN of the client 110 through the Internet 200.

The server account and the user connection account in the VPN-like invitation program of the server 100 and the client 110 are the connection accounts of the third-party server 210 trusted by the server 100 and the client 110. .

The third-party server 210 is used as a medium for message exchange in the present invention, so the third-party server 210 is any vendor server that provides Internet service; when the third-party server 210 is an email (e-mail) When the server is used, the server 100 and the client 110 can use any e-mail account to achieve the purpose of message exchange. For example, the third party server 210 used by the server 100 and the client 110 need not be the same Internet service system company, for example, the Gmail account and password of the Google Internet service.

However, when the third-party server 210 is an instant messaging server, the server 100 and the client 110 must use the same type of communication server to achieve the purpose of message exchange; of course, the server 100 and the client 110 can Also log in to different instant messaging servers. For example: login to Twitter, WeChat, LINE... at the same time.

The registration procedure is to confirm the user connection account and password of the VPN connection registration form, and the implementation can also be directly established by the server 100, without affecting the connection procedure described later.

In the connection procedure, as shown in steps S310 to S316 of FIG. 2, first, through the Internet 200, the server 100 logs in to the trusted third-party server 210 through the server connection account number and the server password (step S310). The VPN of the client 110 is logged into the trusted third-party server 210 through the user connection account and the user password (step S311); that is, the server 100 and the client 110 are respectively connected to the Internet 200. A third-party server 210 that is trusted by each.

As mentioned above, the third party server 210 used by the server 100 and the client 110 need not be the same Internet service system company. The third-party server 210 used by the server 100 and the client 110 may be the same Internet service system company, such as using the same type of communication server, Twitter, WeChat, LINE, and the like.

Then, the VPN of the client 110 sends a connection request through the third-party server 210 (step S312), and the connection information includes the user connection account of the client 110 and the client 110 VPN threaded. The public Internet Protocol (IP) address and public port (port); after this point-to-point (P2P) connection is successful, the VPN connection password is transmitted via this channel to prevent the possibility of password being stolen.

When the server end 100 receives the connection request and connection information of the client 110, if the user terminal 110VPN and the threaded user account are not in the registration form of the VPN connection or the connection account has expired, Or the connection account is not in a valid state, and the third-party server 210 is given the information to refuse to connect.

On the other hand, if the client 110VPN and the threaded user account are in the registration form of the VPN connection, when the response message is returned (step S313), the public internet protocol of the server 100 is transmitted through the third party server 210 ( Internet Protocol, IP) address and public port information are transmitted to the client 110 by a dynamically designated automatic timing (NTP) server 220.

Then, the server 100 will synchronize the connection time with the automatic calibration (NTP) server 220 (step S314), and the VPN of the client 110 is connected synchronously with the same automatic calibration (NTP) server 220 that is also used by the thread. Time (step S315); when the specified connection time arrives, the public Internet Protocol (IP) address and the public port (port) are transmitted through both parties. The VPN establishing the server end 100 and the client 110 is directly connected to the threaded point-to-point (P2P) (step S316).

Through the trusted third-party server 210 and the account and password login mechanism provided by the trusted third-party server 210, the third-party trust mechanism of the same system or different systems is used to make the VPN connection between the server 100 and the client 110 simple. Several steps to establish a point-to-point direct connection to avoid unnecessary cumbersome settings and connection actions when the current VPN connection. In the case of maintaining the security of the transmitted message, the connection of the virtual private network is completed in a more concise manner.

The above is only the preferred embodiment of the present invention, and the scope of the invention is not limited thereto, that is, the simple equivalent changes and modifications made by the scope of the invention and the description of the invention are All remain within the scope of the invention patent.

100‧‧‧ server side

110‧‧‧User side

200‧‧‧Internet

210‧‧‧ Third-party server

220‧‧‧Automatic timing (NTP) server

S310~S316‧‧‧Steps

Claims (5)

A method for establishing a connection between a virtual private network and a method for connecting to a server end and a user end of the Internet, the method comprising: the server end logins to a third-party server trusted by the server by using a server account and a server password The user terminal also logs in to the third-party server trusted by the user through the user connection account and the user password; the client sends the user connection account and the public internet protocol (IP) address through the third-party server. The connection between the address and the public port is sent to the server; the server responds to the user's connection account and responds to whether the connection and connection information is established, and the connection response includes the public internet protocol (IP). a address, a public port (port), and an automatic time-of-flight (NTP) server; after the specified connection time is determined by the synchronization connection time transmitted by the server and the third-party server of the client, the server is connected to the server The public Internet Protocol (IP) address of the client and the public port establish a point-to-point direct connection between the server and the client. The method for establishing a virtual private network as described in claim 1, wherein the third-party server trusted by the server and the third-party server trusted by the client provide an internet service system for any presence. Business network server. The method for establishing a connection between the virtual private network described in claim 2, wherein the third-party server trusted by the server and the third-party server trusted by the client are network servers of the same system vendor. . The method for establishing a connection between the virtual private network described in claim 2, wherein the third-party server trusted by the server and the third party trusted by the client The server is a network server of different system vendors. The method for establishing a connection between the virtual private network described in claim 1 is that the server account number of the server is different from the user connection account of the user.