WO2016106560A1

WO2016106560A1 - Remote access implementation method, device and system

Info

Publication number: WO2016106560A1
Application number: PCT/CN2014/095582
Authority: WO
Inventors: 张亚军; 和江涛; 吴向阳; 刘晓
Original assignee: 华为技术有限公司
Priority date: 2014-12-30
Filing date: 2014-12-30
Publication date: 2016-07-07
Also published as: CN105493453A; CN105493453B

Abstract

Provided are a method, system and device for enabling a user terminal to have access to a private network remotely. During initial configuration, an IP address of a VPN gateway in a private network is configured in a VPN server; and when a user terminal activates the VPN server, the VPN server sends a verification code message to the VPN gateway, the VPN gateway authenticates the VPN server, after the authentication is passed, the VPN gateway allocates a private network address field and an encryption key for the VPN server, and the VPN gateway sends the private network address field and the encryption key to the VPN server, such that the VPN server allocates the IP address for the user terminal in the private network address field, and data transferred to the VPN gateway is encrypted by utilizing the encryption key. Thus, the user terminal can have access to an enterprise intranet via the VPN server, and an end-to-end security flow from user access to data transmission is ensured by means of the above-mentioned secure encryption and authentication mechanism.

Description

Method, device and system for realizing remote access

Technical field

The present invention relates to the field of communications, and in particular, to a method, apparatus, and system for implementing remote access.

Background technique

Virtual Private Network (VPN) is widely used in enterprise networks to establish encrypted communication over public networks. The VPN uses the encrypted Tunneling Protocol (TP) to achieve private message security such as confidentiality, sender authentication, and message accuracy. It can use an insecure network (for example, the Internet) to send reliable and secure messages.

For example, if a company employee travels to a foreign country, it needs to access the server resources in the intranet of the enterprise headquarters. This access belongs to remote access. By setting up a VPN gateway in the internal network, the foreign employees connect to the Internet through the Internet after connecting to the Internet, and then enter the intranet through the VPN gateway, so that foreign employees can access the intranet resources, in order to ensure data security. The communication data between the VPN gateway and the clients used by the foreign employees are encrypted.

IPSec (Internet Protocol Security) VPN refers to a VPN technology that uses IPSec protocol to implement remote access. It is a security standard framework defined by the Internet Engineering Task Force (IETF) to provide public and private networks. End-to-end encryption and authentication services. IPSec VPN exposes a Site-to-Site scenario (ie, site-to-site or gateway-to-gateway): for example, a company's headquarters and branches are distributed in two different places on the Internet, each using a VPN gateway to establish a VPN tunnel. Secure interconnection. However, the premise of this method is that it needs to be configured according to the agreed parameters on the respective VPN gateways, and the encryption algorithm, the key and the subnet are determined in advance, and the configuration and negotiation methods are complicated.

Summary of the invention

The object of the present invention is to provide a method, device and system for implementing remote access, which solves the problem that the configuration and negotiation mode of the VPN gateway in the existing IPSec VPN technology is complicated.

In a first aspect, an embodiment of the present invention provides a method for implementing a remote access private network of a user terminal, where the method is applied to a remote access system, where the remote access system includes a VPN server and a VPN gateway in a private network. The public network IP address of the VPN gateway is configured in the VPN server, and the method includes:

The VPN server generates a verification code message, and sends the verification code message to the VPN gateway, where the verification code message includes an identifier of the VPN server;

The VPN server receives the private network IP address segment and the encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically verified by the VPN gateway to verify the identifier of the VPN server. After being allocated for the VPN server;

The VPN server performs system configuration according to the private network IP address segment and an encryption key;

The VPN server receives a login request sent by the user terminal, allocates an IP address to the user terminal in the private network IP address segment, and transmits the data sent by the user terminal to the VPN gateway by using the encryption key.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the VPN gateway,

The VPN server generates a verification code message, and sending the verification code message to the VPN gateway includes:

The VPN server encrypts the verification code message by using the RSA private key, and sends the encrypted verification code message to the VPN gateway, so that the VPN gateway uses the RSA private key to correspond to The public key decrypts the verification code message, and obtains and verifies the identifier of the VPN server.

With the first possible implementation of the first aspect, in a second possible implementation, before the VPN server sends the verification code message to the VPN gateway, the method further includes:

The VPN server receives a configuration instruction, and stores the RSA private key and a public network IP address of the VPN gateway.

With the first aspect, the first possible implementation of the first aspect, or the second possible implementation of the first aspect, in a third possible implementation, the VPN server is further provided with an activation password. Before the VPN server generates the verification code message, the method further includes:

Receiving, by the VPN server, an activation request sent by the user terminal, where the activation request carries the activation password;

The VPN server verifies the activation password carried in the activation request.

With reference to the first aspect, the first possible implementation manner of the first aspect, or the second possible implementation manner of the first aspect, in a fourth possible implementation manner, the VPN server is configured with a filtering rule to limit The port opened on the VPN server is a port used for VPN data transmission, and the open address is a public network IP address of the VPN gateway.

In conjunction with the first aspect, in a fifth possible implementation, the identifier of the VPN server is a device serial number of the VPN server.

In conjunction with the third possible implementation of the first aspect, in a sixth possible implementation, the activation password includes at least one of a password, a fingerprint, a palm print, or an iris.

In a second aspect, an embodiment of the present invention provides another method for implementing a remote access private network of a user terminal, which is applied to a remote access system, where the remote access system includes a VPN server, a third-party authentication center, and a private network. a VPN gateway, where the VPN server is configured with a public network IP address of the VPN gateway, and the method includes:

The VPN server generates a verification code message, and sends the verification code message to the third-party authentication center, where The verification code message includes an identifier of the VPN server;

The VPN server receives the private network IP address segment and the encryption key of the VPN gateway, and the private network IP address segment and the encryption key are specifically verified by the third-party authentication center for the identifier of the VPN server. After the request, the VPN gateway is requested to be allocated to the VPN server;

With reference to the second aspect, in a first possible implementation manner of the second aspect, the VPN server is further configured with an RSA private key, and correspondingly, the third-party authentication center is configured with a public corresponding to the RSA private key. key,

The VPN server generates a verification code message, and the sending the verification code message to the third-party authentication center includes:

The VPN server encrypts the verification code message by using the RSA private key, and sends the encrypted verification code message to the third-party authentication center, so that the third-party authentication center uses the The public key corresponding to the RSA private key decrypts the verification code packet, and obtains and verifies the identifier of the VPN server.

With reference to the second aspect or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the VPN server is configured with a filtering rule to limit the open port on the VPN server to The port used for VPN data transmission and the port that interacts with the third-party authentication center, the open address is the IP address of the third-party authentication center, and the public network IP address of the VPN gateway.

In a third aspect, an embodiment of the present invention provides a system for implementing a remote access private network of a user terminal, where the remote access system includes a VPN server and a VPN gateway in a private network, where the VPN server is configured with the VPN. The public IP address of the gateway,

The VPN server is configured to generate a verification code message, and send the verification code message to the VPN gateway, where the verification code message includes an identifier of the VPN server;

The VPN gateway is configured to allocate a private network IP address segment and an encryption key to the VPN server after verifying the identifier of the VPN server, and configure the private network IP address segment and the encryption key Sent to the VPN server;

The VPN server is further configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, and perform system configuration according to the private network IP address segment and an encryption key;

The VPN server is further configured to receive a login request sent by the user terminal, allocate an IP address to the user terminal in the private network IP address segment, and transmit the user terminal to the VPN gateway by using the encryption key. The data sent.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the VPN gateway. ,

The VPN server is specifically configured to encrypt the verification code message by using the RSA private key, and encrypt the encrypted message. Sending the verification code message to the VPN gateway;

The VPN gateway is specifically configured to decrypt the verification code packet by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server.

With reference to the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the VPN server receives a configuration command, and stores the RSA private key and the public network of the VPN gateway. IP address.

In combination with the third aspect, the first possible implementation manner of the third aspect, or the second possible implementation manner of the third aspect, in a third possible implementation manner of the third aspect, the VPN server is further configured with an activation password. ,

The VPN server is further configured to receive and verify an activation request sent by the user terminal, where the activation request carries an activation password.

With reference to the third aspect, the first possible implementation manner of the third aspect, or the second possible implementation manner of the third aspect, in a fourth possible implementation manner of the third aspect, the VPN server is configured with a filtering rule, The port used for VPN data transmission is defined by the port that is open on the VPN server, and the open address is the public network IP address of the VPN gateway.

In a fourth aspect, the embodiment of the present invention further provides a system for implementing a remote access private network of a user terminal, where the system includes a VPN server and a VPN gateway in a private network, where the VPN server is configured with the VPN gateway. Public IP address,

The VPN server is configured to generate a verification code message, and send the verification code message to the third-party authentication center, where the verification code message includes an identifier of the VPN server;

The VPN gateway is configured to receive a notification message that is sent by the third-party authentication center after the identity verification of the VPN server is passed, where the notification message carries the identifier of the VPN server;

The VPN gateway is further configured to allocate a private network IP address segment and an encryption key to the VPN server, and send the private network IP address segment and an encryption key to the VPN server;

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the system further includes a third-party authentication center,

The third-party authentication center is configured to verify the identifier of the VPN server.

With reference to the first possible implementation manner of the fourth aspect, in the second possible implementation manner of the fourth aspect, the VPN server is further configured with an RSA private key, and correspondingly, the third-party authentication center is configured The public key corresponding to the RSA private key,

The VPN server is configured to encrypt the verification code message by using the RSA private key, and send the encrypted verification code message to the third-party authentication center;

The third-party authentication center is configured to decrypt the verification code message by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server.

In conjunction with the second possible implementation of the fourth aspect, in a third possible implementation manner of the fourth aspect, the VPN server is configured with a filtering rule to limit the open port on the VPN server for performing VPN data transmission. The port used and the port interacting with the third-party authentication center, the open address is the IP address of the third-party authentication center, and the public network IP address of the VPN gateway.

In a fifth aspect, an embodiment of the present invention provides a VPN server that implements a remote access private network of a user terminal, where the VPN server is configured with a public network IP address of a VPN gateway in the private network.

a generating unit, configured to generate a verification code message, where the verification code message includes an identifier of the VPN server;

a sending unit, configured to send the verification code message generated by the generating unit to the VPN gateway;

a receiving unit, configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically configured by the VPN gateway to verify the identifier of the VPN server After being passed through for the VPN server;

a configuration unit, configured to perform system configuration according to the private network IP address segment and the encryption key received by the receiving unit;

The receiving unit is further configured to receive a login request sent by the user terminal;

a data transmission unit, configured to: after the receiving unit receives the login request, allocate an IP address to the user terminal in the private network IP address segment, and use the encryption key to transmit to the VPN gateway The data sent by the user terminal.

With reference to the fifth aspect, in a first possible implementation manner of the fifth aspect, the VPN server is further configured with an RSA private key,

The generating unit is specifically configured to encrypt the verification code message by using the RSA private key;

The sending unit is configured to send the encrypted verification code message generated by the generating unit to the VPN gateway, so that the VPN gateway uses the public key corresponding to the RSA private key to The verification code message is decrypted, and the identifier of the VPN server is obtained and verified.

With reference to the first possible implementation manner of the fifth aspect, in a second possible implementation manner, the receiving unit is further configured to receive a configuration instruction, and store the RSA private key and a public network IP address of the VPN gateway. .

With reference to the fifth aspect, in a third possible implementation manner of the fifth aspect, the receiving unit is further configured to receive an activation request sent by the user terminal, where the activation request carries the activation password;

Correspondingly, the VPN server further includes an authentication unit, configured to verify the activation password carried in the activation request received by the receiving unit.

The embodiment of the invention provides a method, a system and a device for realizing a remote access of a user terminal to a private network. In an initial configuration, an IP address of a VPN gateway in a private network is configured in a VPN server, and after the user terminal activates the VPN server, The VPN server sends a verification code message to the VPN gateway, and the VPN gateway authenticates the VPN server. After the authentication is passed, the VPN gateway allocates a private network address segment and an encryption key to the VPN server. The VPN gateway sends the private network address segment and the encryption key to the VPN server, so that the VPN server allocates an IP address to the user terminal in the private network address segment, and uses the encryption key. The key encrypts the data passed to the VPN gateway. Therefore, the user terminal accesses the intranet through the VPN server, and the above-mentioned secure encryption and authentication mechanism ensures the end-to-end security process from user access to data transmission.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, other drawings may be obtained from those skilled in the art without any inventive labor.

1 is a schematic flowchart of a method for implementing a remote access private network of a user terminal according to an embodiment of the present invention;

2 is a schematic structural diagram of a system for remote access according to an embodiment of the present invention;

3 is a schematic flowchart of a method for implementing a remote access private network of a user terminal according to an embodiment of the present invention;

4 is a schematic flowchart of another method for implementing a remote access private network of a user terminal according to an embodiment of the present invention;

5 is a schematic flowchart of another method for implementing a remote access private network of a user terminal according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a system for implementing a remote access private network of a user terminal according to an embodiment of the present invention; FIG.

FIG. 7 is a schematic structural diagram of another system for implementing a remote access private network of a user terminal according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic structural diagram of a VPN server for implementing a remote access private network of a user terminal according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic structural diagram of a VPN server hardware according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts, All fall within the scope of protection of the present invention.

FIG. 1 is a schematic flowchart of a method for implementing a remote access private network of a user terminal according to an embodiment of the present invention. The method is applied to a remote access system, where the remote access system includes a VPN server and a private network. a VPN gateway in which the public IP address of the VPN gateway is configured, the method includes:

Step 101: The VPN server generates a verification code message, and sends the verification code message to the VPN gateway, where the verification code message includes an identifier of the VPN server.

Step 102: The VPN server receives a private network IP address segment and an encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically used by the VPN gateway to identify the VPN server. After the verification is passed, it is allocated to the VPN server;

Step 103: The VPN server performs system configuration according to the private network IP address segment and an encryption key.

Step 104: The VPN server receives a login request sent by the user terminal, allocates an IP address to the user terminal in the private network IP address segment, and transmits the user terminal to the VPN gateway by using the encryption key. The data.

In the initial configuration, the VPN server is configured with the IP address of the VPN gateway in the private network. After the user terminal activates the VPN server, the VPN server sends a verification code message to the VPN gateway, and the VPN gateway pairs the VPN. The server performs authentication. After the authentication is passed, the VPN gateway allocates a private network address segment and an encryption key to the VPN server, and the VPN gateway sends the private network address segment and the encryption key to the VPN server. So that the VPN server allocates an IP address to the user terminal in the private network address segment, and encrypts data transmitted to the VPN gateway by using the encryption key. Therefore, the user terminal accesses the intranet through the VPN server, and the above-mentioned secure encryption and authentication mechanism ensures the end-to-end security process from user access to data transmission.

Further, the RSA private key may be set in the VPN server. Correspondingly, the public key corresponding to the RSA private key is configured in the VPN gateway, so that the VPN server can use the RSA private key pair to send to the VPN. The gateway's verification code message is encrypted. Specifically, the VPN server encrypts the verification code message by using the RSA private key, and sends the encrypted verification code message to the VPN gateway, so that the VPN gateway uses the RSA. The public key corresponding to the private key decrypts the verification code message, and obtains and verifies the identifier of the VPN server.

When the user terminal needs to access the VPN gateway of the headquarters through the VPN server, the user terminal sends an activation request to the VPN server, where the activation request carries the activation password; and the VPN server verifies the activation carried in the activation request. A password, the activation password including at least one of a password, a fingerprint, a palm print, or an iris.

The identifier of the VPN server is a device serial number of the VPN server.

FIG. 2 is a schematic structural diagram of a system for remote access according to an embodiment of the present invention. A user terminal is connected to a public network through a VPN server, and then connected to a VPN gateway of an internal private network of the enterprise, through a VPN gateway and an intranet. get on data transmission. The VPN server presets the parameters for connecting to the headquarters, including the public IP address of the headquarters, and further includes the private key required for channel encryption and the activation password. The VPN server itself provides wireless and wired access capabilities, and can perform MAC address filtering on the accessed terminals. The user terminal accesses the VPN server to access the headquarters through the high-security authentication mode (WPA2). After the VPN server is activated, it will automatically interact with the VPN gateway at the headquarters to implement identity authentication, configuration negotiation, and automatic configuration. Each time the VPN server starts a new connection or changes its IP address, it needs to be reactivated to provide the service.

Before the user terminal performs remote access through the VPN server, the VPN server needs to be initially configured to achieve the available purposes. Specifically, in a real-life scenario, the employee may apply for a VPN server to the headquarters before the employee travels, and the initial configuration of the VPN server may be performed by the headquarters IT manager. The initial configuration may include the following:

Write the public IP address of the VPN gateway of the headquarters to the VPN server.

The shared RSA private key is written in the VPN server by the dedicated device, and the public key corresponding to the RSA is stored in the headquarters system, and the RSA private key can be stored in the chip of the VPN server, so that the external system cannot be Read to

When the user applies for the VPN server at the overall IT administrator, the activation password is set on the VPN server, and the activation password may be a password, a fingerprint, a palm print, an iris, or the like, which is not limited by the embodiment of the present invention;

Open the qualified port and address on the VPN server. For example, open only the port (500 or 4500) used for VPN data transmission and the public IP address of the VPN gateway on the VPN server. Specifically, the filtering rule can be set on the VPN server, and the filtering rule is for the IP address and the port, so that the VPN server can only access the VPN gateway and cannot access other public network addresses. On the other hand, when the third-party authentication center is responsible for verifying the VPN server, it is also required to set a filtering rule on the VPN server to limit the open port on the VPN server for VPN data transmission. The port and the port interacting with the third-party authentication center, the open address are the IP address of the third-party authentication center, and the public network IP address of the VPN gateway.

The embodiment of the invention provides a VPN server, and the remote terminal accesses the VPN gateway of the intranet through the VPN server, so as to provide a simple, secure and convenient plug-and-play VPN service for the mobile office.

As shown in FIG. 3, a schematic flowchart of a method for implementing a remote access private network of a user terminal according to an embodiment of the present invention includes:

Step 301: Connect the VPN server to the Internet, and start the VPN server. The VPN server obtains a public network IP address. Specifically, it can be configured through static manual configuration, Dynamic Host Configuration Protocol (DHCP), or Ethernet. A public IP address is obtained by means of a point-to-point protocol over Ethernet (PPOE).

Step 302: The user sends an activation request to the VPN server through the user terminal, so that the VPN server performs legality verification on the user.

The user can activate the VPN server by inputting an activation password, scanning a fingerprint, or a palm print according to the activation mode set by the VPN server. This embodiment of the present invention does not limit this.

Step 303: The VPN server generates an authentication message, where the authentication message includes a verification code message, and the content of the message is a device serial number of the VPN server, and the VPN server encrypts the verification code message in the authentication message by using a preset RSA private key. And signing, sending an authentication message to the VPN gateway of the headquarters;

Step 304: The VPN gateway of the headquarters receives the authentication message, and after obtaining the encrypted verification code message, decrypts the verification code message by using the public key corresponding to the RSA private key stored in advance, and decrypts the obtained device. The serial number is verified to determine whether the device serial number is registered in the system. If the device device serial number is known and the device has not been registered in the system, the verification is passed.

Step 305: After the verification is completed, the VPN gateway of the headquarters allocates an IP address segment of the private network to the VPN server, and an encryption key for subsequent VPN transmission, and the encryption key may be a symmetric key.

Step 306: The VPN gateway of the headquarters encrypts and signs the private network IP address segment and the encryption key by using the RSA public key, and carries the encrypted private network IP address segment and the encryption key in the authentication response message and sends the message to the VPN. server;

Step 307: The VPN server decrypts the packet in the received authentication response message, and obtains a private network IP address segment and an encryption key allocated by the VPN gateway to the VPN server.

Step 308: The VPN server automatically performs VPN configuration according to the received private network IP address segment and the encryption key.

Step 309: The user accesses the VPN server through the user terminal, and the VPN server performs legality verification on the access user. After the verification is passed, the user terminal allocates an IP address in the private network IP address segment.

Specifically, the user can access the VPN server through the high-security authentication mode (WPA2) of the user terminal, and start to access the data of the headquarters. The VPN server authenticates the connection validity of the password in the access mode.

Step 310: The user terminal and the headquarters VPN gateway use the standard IPSec VPN protocol for data interaction, and use Data Encryption Standard (DES) to encrypt data.

In the embodiment of the present invention, in the initial configuration, the VPN server is configured with the IP address of the VPN gateway in the private network. After the user terminal activates the VPN server, the VPN server sends the verification code message to the VPN gateway. The VPN server authenticates the VPN server. After the authentication is passed, the VPN gateway allocates a private network address segment and an encryption key to the VPN server, and the VPN gateway uses the private network address segment and the encryption key. Sending to the VPN server, so that the VPN server allocates an IP address to the user terminal in the private network address segment, and encrypts data transmitted to the VPN gateway by using the encryption key. Therefore, the user terminal accesses the intranet through the VPN server, and the above-mentioned secure encryption and authentication mechanism ensures the end-to-end security process from user access to data transmission.

As shown in FIG. 4, another schematic flowchart of a method for implementing a remote access private network of a user terminal according to an embodiment of the present disclosure is different from the foregoing embodiment. In the embodiment of the present invention, the third-party authentication center is The entire system is provided with Specific vendor-independent authentication services and a unified VPN device delivery service. When the VPN is applied, the third-party authentication center provides the initial configuration for the VPN server. When the user accesses the intranet through the VPN server, the third-party authentication center authenticates the VPN server accordingly. After the initial configuration of the VPN server, the user remotely accesses the intranet through the VPN server.

The method includes:

Step 401: The VPN server is connected to the Internet and obtains a public network IP address. Specifically, the public network IP address is obtained by static manual configuration, DHCP, or PPOE.

Step 402: The user sends an activation request to the VPN server through the user terminal, so that the VPN server performs legality verification on the user.

Step 403: The VPN server generates an authentication message, where the authentication message includes a verification code message, and the content of the message is a device serial number of the VPN server, and the VPN server uses the preset RSA private key to encrypt the verification code message in the authentication message. And signing, sending the encrypted verification code message to the third-party authentication center;

Step 404: The third-party authentication center receives the authentication message, and after obtaining the encrypted verification code message, decrypts the encrypted verification code message by using the public key corresponding to the RSA private key stored in advance, and decrypts the encrypted verification code message. The obtained device serial number is checked to determine whether the device serial number is registered in the system. If the device device serial number is a known unregistered device, the verification is passed.

Step 405: After the verification is passed, the third-party authentication center sends a notification message to the VPN gateway of the headquarters, where the notification message carries the identifier and IP address information of the VPN server.

Step 406: The VPN gateway of the headquarters allocates an IP address segment of the private network to the VPN server, and an encryption key for subsequent VPN transmission. Specifically, the encryption key may be a symmetric key.

Step 407: The VPN gateway of the headquarters encrypts and signs the private network IP address segment and the encryption key by using the RSA public key, and carries the encrypted private network IP address segment and the encryption key in the distribution message and sends the message to the VPN server. ;

Step 408: The VPN server decrypts the received distribution message, and obtains a private network IP address segment and an encryption key allocated by the VPN gateway to the VPN server.

Step 409: The VPN server automatically performs VPN configuration according to the received private network IP address segment and the encryption key.

Step 410: The user accesses the VPN server through the user terminal, and the VPN server performs legality verification on the access user. After the verification is passed, the user terminal allocates an IP address in the private network IP address segment.

Step 411: The user terminal communicates with the VPN gateway of the headquarters using a standard IPSec VPN protocol, and uses Data Encryption Standard (DES) to encrypt data.

It should be noted that, in the foregoing activation process, the VPN server performs activation password verification to determine whether the user has the qualification to activate the VPN server. In the above-mentioned user legality verification process, the VPN server performs user identity verification to determine whether the user has the user authentication. Qualification of accessing intranet data through the VPN server.

The embodiment of the present invention provides a secure and convenient remote access mode. The third-party authentication center serves as the management center of the VPN server, and the IP address of the third-party authentication center is pre-configured in the VPN server, and the user accesses through the VPN server. When the intranet is connected to the intranet, the VPN server is connected to the third-party authentication center to perform VPN server authentication. After the authentication is passed, the third-party authentication center applies to the VPN gateway of the headquarters to allocate a private network address segment to the VPN server. And the encryption key, the VPN gateway sends the private network address segment and the encryption key to the VPN server, so that the VPN server allocates an IP address to the user terminal in the private network address segment, and utilizes The encryption key encrypts data passed to the VPN gateway. Therefore, the user terminal accesses the intranet through the VPN server, and the above-mentioned secure encryption and authentication mechanism ensures the end-to-end security process from user access to data transmission.

As shown in FIG. 5, the embodiment of the present invention further provides another schematic diagram of a method for implementing a remote access private network of a user terminal, where the method is applied to a remote access system, where the remote access system includes a VPN server and a third party. a public network IP address of the VPN gateway is configured in the authentication center and the VPN gateway in the private network, and the method includes:

Step 501: The VPN server generates a verification code message, and sends the verification code message to the third-party authentication center, where the verification code message includes an identifier of the VPN server.

Step 502: The VPN server receives the VPN gateway to return a private network IP address segment and an encryption key, where the private network IP address segment and the encryption key are specifically the identifier of the third-party authentication center in the VPN server. After the verification is passed, requesting the VPN gateway to allocate the VPN server;

Step 503: The VPN server performs system configuration according to the private network IP address segment and the encryption key.

Step 504: The VPN server receives a login request sent by the user terminal, allocates an IP address to the user terminal in the private network IP address segment, and transmits the user terminal to the VPN gateway by using the encryption key. The data.

In the embodiment of the present invention, after the VPN server is activated, the third-party authentication center checks the VPN server. After the verification is passed, the VPN gateway of the private network allocates the private network IP address segment and the encryption key to the VPN server. a key, such that when the user terminal accesses the private network through the VPN server, the VPN server can assign the IP address in the private network IP address segment to the user terminal, and use the encryption key to transmit to the VPN gateway The data sent by the user terminal is described, thereby realizing the transmission of user data to the private network.

Further, the VPN server is further configured with an RSA private key, and correspondingly, the third-party authentication center is configured. There is a public key corresponding to the RSA private key,

In a process of initial configuration of the VPN server by a third-party authentication center, a filtering rule may be set in the VPN server to limit a port opened on the VPN server to a port used for VPN data transmission, and The port interacted by the third-party authentication center, the open address is the IP address of the third-party authentication center, and the public network IP address of the VPN gateway. By defining the address and port that the VPN server can access, the VPN server can be used only to communicate with the private network, thereby improving the security of network transmission.

Corresponding to the foregoing method embodiments, the embodiment of the present invention further provides a system structure for implementing a remote access private network of a user terminal. As shown in FIG. 6, the remote access system includes a VPN server 601 and a private network. a VPN gateway 602, wherein the VPN server 601 is configured with a public network IP address of the VPN gateway 602.

The VPN server 601 is configured to generate a verification code message, and send the verification code message to the VPN gateway 602, where the verification code message includes an identifier of the VPN server 601.

The VPN gateway 602 is configured to allocate a private network IP address segment and an encryption key to the VPN server 601 after verifying the identifier of the VPN server 601, and configure the private network IP address segment and Sending an encryption key to the VPN server 601;

The VPN server 601 is further configured to receive a private network IP address segment and an encryption key returned by the VPN gateway 602, and perform system configuration according to the private network IP address segment and an encryption key;

The VPN server 601 is further configured to receive a login request sent by the user terminal, allocate an IP address to the user terminal in the private network IP address segment, and transmit the identifier to the VPN gateway 602 by using the encryption key. The data sent by the user terminal.

Further, the VPN server 601 is further configured with an RSA private key, and correspondingly, the VPN gateway 602 is configured with a public key corresponding to the RSA private key.

The VPN server 601 is specifically configured to use the RSA private key to encrypt the verification code message, and send the encrypted verification code message to the VPN gateway 602;

The VPN gateway 602 is specifically configured to decrypt the verification code message by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server 601.

In the initial configuration phase of the VPN, the VPN server 601 is further configured to receive a configuration command, and store the RSA private key and a public network IP address of the VPN gateway 602.

The VPN server 601 is further provided with an activation password, and the VPN server 601 is further configured to receive and verify. An activation request sent by the user terminal, where the activation request carries an activation password. Optionally, the VPN server 601 is configured with a filtering rule to limit the port opened on the VPN server 601 to a port used for VPN data transmission, and the open address is a public network IP address of the VPN gateway 602.

On the other hand, the embodiment of the present invention further provides another system structure for implementing a remote access private network of a user terminal. As shown in FIG. 7, the system includes a VPN server 701 and a VPN gateway 702 in a private network. The public network IP address of the VPN gateway 702 is configured in the VPN server 701.

The VPN server 701 is configured to generate a verification code message, and send the verification code message to the third-party authentication center, where the verification code message includes an identifier of the VPN server 701.

The VPN gateway 702 is configured to receive a notification message that is sent by the third-party authentication center after the identifier verification of the VPN server 701 is passed, where the notification message carries the identifier of the VPN server 701.

The VPN gateway 702 is further configured to allocate a private network IP address segment and an encryption key to the VPN server 701, and send the private network IP address segment and an encryption key to the VPN server 701;

The VPN server 701 is further configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, and perform system configuration according to the private network IP address segment and an encryption key;

The VPN server 701 is further configured to receive a login request sent by the user terminal, allocate an IP address to the user terminal in the private network IP address segment, and transmit the identifier to the VPN gateway 702 by using the encryption key. The data sent by the user terminal.

Further, the system further includes a third-party authentication center 703, and the third-party authentication center 703 is configured to check the identifier of the VPN server 701.

The VPN server 701 is further configured with an RSA private key, and correspondingly, the third-party authentication center 703 is configured with a public key corresponding to the RSA private key.

The VPN server 701 is specifically configured to encrypt the verification code message by using the RSA private key, and send the encrypted verification code message to the third-party authentication center 703;

The third-party authentication center 703 is specifically configured to decrypt the verification code message by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server 701.

During the initial configuration of the VPN server, the VPN server 701 is further configured to receive a configuration command, and store the RSA private key and a public network IP address of the VPN gateway.

Further, in the initial configuration process, the VPN server 701 is further provided with an activation password.

The VPN server 701 is further configured to receive and verify an activation request sent by the user terminal, where the activation request carries an activation password.

A filtering rule is set in the VPN server 701 to limit the open port on the VPN server 701. The port used for the VPN data transmission and the open address are the public network IP address of the VPN gateway 702.

As shown in FIG. 8 , a VPN server for implementing a remote access private network of a user terminal is provided in an embodiment of the present invention, where the VPN server is configured with a public network IP address of a VPN gateway in the private network.

a generating unit 801, configured to generate a verification code message, where the verification code message includes an identifier of the VPN server;

The sending unit 802 is configured to send the verification code message generated by the generating unit 801 to the VPN gateway;

The receiving unit 803 is configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically configured by the VPN gateway to identify the VPN server. After the verification is passed, it is allocated for the VPN server;

The configuration unit 804 is configured to perform system configuration according to the private network IP address segment and the encryption key received by the receiving unit 803;

The receiving unit 803 is further configured to receive a login request sent by the user terminal;

a data transmission unit 805, configured to: after the receiving unit 803 receives the login request, allocate an IP address to the user terminal in the private network IP address segment, and use the encryption key to the VPN gateway. Transmitting data transmitted by the user terminal.

The RSA private key is also configured in the VPN server.

The generating unit 801 is specifically configured to encrypt the verification code message by using the RSA private key.

The sending unit 802 is specifically configured to send the encrypted verification code message generated by the generating unit 801 to the VPN gateway, so that the VPN gateway uses a public key pair corresponding to the RSA private key. The verification code message is decrypted, and the identifier of the VPN server is obtained and verified.

The receiving unit 803 is further configured to receive a configuration instruction, and store the RSA private key and a public network IP address of the VPN gateway.

The receiving unit 803 is further configured to receive an activation request sent by the user terminal, where the activation request carries the activation password;

Correspondingly, the VPN server further includes an authentication unit 806, configured to verify the activation password carried in the activation request received by the receiving unit 803.

The embodiment of the present invention further provides a VPN server, as shown in FIG. 9, comprising: a receiver 901, a transmitter 902, a processor 903, and a memory 904; wherein the memory 904 can be applied to storage of various configuration information in an initial configuration process. . specific,

The memory 904 is configured to store a public network IP address of a VPN gateway in the private network;

The processor 903 is configured to generate a verification code message, where the verification code message includes an identifier of the VPN server;

The transmitter 902 is configured to send the verification code message generated by the processor 903 to the VPN gateway;

The receiver 901 is configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, and receive a login request sent by the user terminal, where the private network IP address segment and the encryption key are specifically the VPN gateway. After the verification of the identifier of the VPN server is performed, the VPN server is allocated;

The processor 903 is further configured to perform system configuration according to the private network IP address segment and the encryption key received by the receiver 901, and allocate an IP address to the user terminal in the private network IP address segment. Transmitting, by the encryption key, data sent by the user terminal to the VPN gateway.

Further storing an RSA private key in the memory 904;

The processor 903 is specifically configured to encrypt the verification code message by using the RSA private key.

The transmitter 902 is specifically configured to send the encrypted verification code message generated by the processor 903 to the VPN gateway, so that the VPN gateway uses a public key pair corresponding to the RSA private key. The verification code message is decrypted, and the identifier of the VPN server is obtained and verified.

The receiver 901 is further configured to receive a configuration instruction, where the configuration command includes the RSA private key and a public network IP address of the VPN gateway.

The receiver 901 is further configured to receive an activation request sent by the user terminal, where the activation request carries the activation password;

The processor 903 is further configured to verify the activation password carried in the activation request received by the receiver 901.

It can be clearly understood by those skilled in the art that all or part of the steps in the foregoing embodiment may be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product, which may be stored in a storage medium such as a ROM/RAM or a disk. , an optical disk, etc., comprising instructions for causing a computer device (which may be a personal computer, a resource management server, or a network communication device such as a media gateway, etc.) to perform portions of various embodiments or embodiments of the present invention. The method described.

It should be noted that each embodiment in this specification is described in a progressive manner, and the embodiments are the same. Similar parts can be referred to each other, and each embodiment focuses on differences from other embodiments. In particular, for the device and the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The apparatus and system embodiments described above are merely illustrative, wherein the units illustrated as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without any creative effort.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

A method for realizing remote access of a user terminal to a private network, wherein the method is applied to a remote access system, the remote access system comprising a virtual private network VPN server and a VPN gateway in a private network, the VPN A public network IP address of the VPN gateway is configured in the server, where the method includes:

The VPN server generates a verification code message, and sends the verification code message to the VPN gateway, where the verification code message includes an identifier of the VPN server;

The VPN server receives the private network IP address segment and the encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically verified by the VPN gateway to verify the identifier of the VPN server. After being allocated for the VPN server;

The VPN server performs system configuration according to the private network IP address segment and an encryption key;

The VPN server receives a login request sent by the user terminal, allocates an IP address to the user terminal in the private network IP address segment, and transmits the data sent by the user terminal to the VPN gateway by using the encryption key.
The method of claim 1, wherein the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the VPN gateway.

The VPN server generates a verification code message, and sending the verification code message to the VPN gateway includes:

The VPN server encrypts the verification code message by using the RSA private key, and sends the encrypted verification code message to the VPN gateway, so that the VPN gateway uses the RSA private key to correspond to The public key decrypts the verification code message, and obtains and verifies the identifier of the VPN server.
The method of claim 2, wherein before the sending, by the VPN server, the verification code message to the VPN gateway, the method further comprises:

The VPN server receives a configuration instruction, and stores the RSA private key and a public network IP address of the VPN gateway.
The method according to any one of claims 1-3, wherein the VPN server is further provided with an activation password. Before the VPN server generates the verification code message, the method further includes:

Receiving, by the VPN server, an activation request sent by the user terminal, where the activation request carries the activation password;

The VPN server verifies the activation password carried in the activation request.
The method according to any one of claims 1-3, wherein the VPN server is provided with a filtering rule to limit a port opened on the VPN server to a port used for VPN data transmission, and an open address is The public network IP address of the VPN gateway.
The method of claim 1 wherein the identity of the VPN server is a device serial number of the VPN server.
The method of claim 4 wherein said activation password comprises at least one of a password, a fingerprint, a palm print or an iris.
A method for realizing a remote access private network of a user terminal, which is characterized in that it is applied to a remote access system, and the remote access system includes a VPN server, a third-party authentication center, and a VPN gateway in a private network, the VPN server The public network IP address of the VPN gateway is configured, and the method includes:

The VPN server generates a verification code message, and sends the verification code message to the third-party authentication center, where the verification code message includes an identifier of the VPN server;

The VPN server receives the private network IP address segment and the encryption key of the VPN gateway, and the private network IP address segment and the encryption key are specifically verified by the third-party authentication center for the identifier of the VPN server. After the request, the VPN gateway is requested to be allocated to the VPN server;

The VPN server performs system configuration according to the private network IP address segment and an encryption key;

The VPN server receives a login request sent by the user terminal, allocates an IP address to the user terminal in the private network IP address segment, and transmits the data sent by the user terminal to the VPN gateway by using the encryption key.
The method of claim 8, wherein the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the third-party authentication center.

The VPN server generates a verification code message, and the sending the verification code message to the third-party authentication center includes:

The VPN server encrypts the verification code message by using the RSA private key, and sends the encrypted verification code message to the third-party authentication center, so that the third-party authentication center uses the The public key corresponding to the RSA private key decrypts the verification code packet, and obtains and verifies the identifier of the VPN server.
The method according to any one of claims 8 or 9, wherein the VPN server is provided with a filtering rule to define an open port on the VPN server as a port for performing VPN data transmission and The port that the three-party authentication center interacts with, the open address is the IP address of the third-party authentication center and the public network IP address of the VPN gateway.
A system for realizing a remote access private network of a user terminal, wherein the remote access system comprises a VPN server and a VPN gateway in a private network, wherein the VPN server is configured with a public network IP address of the VPN gateway ,

The VPN server is configured to generate a verification code message, and send the verification code message to the VPN gateway, where the verification code message includes an identifier of the VPN server;

The VPN gateway is configured to allocate a private network IP address segment and an encryption key to the VPN server after verifying the identifier of the VPN server, and configure the private network IP address segment and the encryption key Sent to the VPN server;

The VPN server is further configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, and perform system configuration according to the private network IP address segment and an encryption key;

The VPN server is further configured to receive a login request sent by the user terminal, allocate an IP address to the user terminal in the private network IP address segment, and transmit the user terminal to the VPN gateway by using the encryption key. The data sent.
The system according to claim 11, wherein the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the VPN gateway.

The VPN server is configured to encrypt the verification code message by using the RSA private key, and send the encrypted verification code message to the VPN gateway;

The VPN gateway is specifically configured to decrypt the verification code packet by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server.
The system of claim 12 wherein:

The VPN server is further configured to receive a configuration instruction, and store the RSA private key and a public network IP address of the VPN gateway.
The system according to any one of claims 11-13, wherein the VPN server is further provided with an activation password.

The VPN server is further configured to receive and verify an activation request sent by the user terminal, where the activation request carries an activation password.
The system according to any one of claims 11-13, wherein the VPN server is provided with a filtering rule to define a port opened on the VPN server as a port for performing VPN data transmission, and an open address is the Public IP address of the VPN gateway.
A system for implementing a remote access private network of a user terminal, wherein the system includes a VPN server and a VPN gateway in a private network, where the VPN server is configured with a public network IP address of the VPN gateway.

The VPN server is configured to generate a verification code message, and send the verification code message to the third-party authentication center, where the verification code message includes an identifier of the VPN server;

The VPN gateway is configured to receive a notification message that is sent by the third-party authentication center after the identity verification of the VPN server is passed, where the notification message carries the identifier of the VPN server;

The VPN gateway is further configured to allocate a private network IP address segment and an encryption key to the VPN server, and send the private network IP address segment and an encryption key to the VPN server;

The VPN server is further configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, and perform system configuration according to the private network IP address segment and an encryption key;

The VPN server is further configured to receive a login request sent by the user terminal, where the private network IP address segment is The user terminal allocates an IP address, and transmits the data sent by the user terminal to the VPN gateway by using the encryption key.
The system of claim 16 wherein said system further comprises a third party authentication center.

The third-party authentication center is configured to verify the identifier of the VPN server.
The system of claim 17, wherein the VPN server is further configured with an RSA private key, and correspondingly, the public key corresponding to the RSA private key is configured in the third-party authentication center.

The VPN server is configured to encrypt the verification code message by using the RSA private key, and send the encrypted verification code message to the third-party authentication center;

The third-party authentication center is configured to decrypt the verification code message by using a public key corresponding to the RSA private key, and obtain and verify the identifier of the VPN server.
The system according to claim 18, wherein the VPN server is provided with a filtering rule to define a port open on the VPN server for use in performing VPN data transmission and interacting with the third-party authentication center. The port and the open address are the IP address of the third-party authentication center and the public network IP address of the VPN gateway.
A VPN server for realizing remote access to a private network of a user terminal, wherein the VPN server is configured with a public network IP address of a VPN gateway in the private network, and the VPN server includes:

a generating unit, configured to generate a verification code message, where the verification code message includes an identifier of the VPN server;

a sending unit, configured to send the verification code message generated by the generating unit to the VPN gateway;

a receiving unit, configured to receive a private network IP address segment and an encryption key returned by the VPN gateway, where the private network IP address segment and the encryption key are specifically configured by the VPN gateway to verify the identifier of the VPN server After being passed through for the VPN server;

a configuration unit, configured to perform system configuration according to the private network IP address segment and the encryption key received by the receiving unit;

The receiving unit is further configured to receive a login request sent by the user terminal;

a data transmission unit, configured to: after the receiving unit receives the login request, allocate an IP address to the user terminal in the private network IP address segment, and use the encryption key to transmit to the VPN gateway The data sent by the user terminal.
The VPN server according to claim 20, wherein the VPN server is further configured with an RSA private key.

The generating unit is specifically configured to encrypt the verification code message by using the RSA private key;

The sending unit is specifically configured to send the encrypted verification code message generated by the generating unit to the And the VPN gateway, so that the VPN gateway decrypts the verification code packet by using a public key corresponding to the RSA private key, and obtains and verifies the identifier of the VPN server.
A VPN server according to claim 21, wherein

The receiving unit is further configured to receive a configuration instruction, and store the RSA private key and a public network IP address of the VPN gateway.
A VPN server according to claim 20, wherein

The receiving unit is further configured to receive an activation request sent by the user terminal, where the activation request carries the activation password;

Correspondingly, the VPN server further includes an authentication unit, configured to verify the activation password carried in the activation request received by the receiving unit.