A method and apparatus for establishing a VPN tunnel, and a computer-readable storage medium.

Abstract

This invention discloses a method and apparatus for establishing a VPN tunnel, as well as a computer-readable storage medium. The method for establishing a VPN tunnel includes the following steps: a client sends a VPN tunnel establishment request to a server, the establishment request including an encryption method to be negotiated; the client receives a confirmation message from the server in response to the establishment request; user information is encrypted using the encryption method, and the encrypted user information is sent to the server for the server to decrypt the encrypted user information using the encryption method; the decrypted user information is verified, and transmission parameters are configured after successful verification; the client receives the transmission parameters and uses the transmission parameters to configure routing information to complete the establishment of the VPN tunnel. This invention enables the rapid and secure establishment of a VPN tunnel.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a method and apparatus for establishing a VPN tunnel, and a computer-readable storage medium. Background Technology

[0002] A Virtual Private Network (VPN) can be established using a public network. A VPN gateway enables remote access by encrypting data packets and converting the destination address of the data packets.

[0003] However, traditional VPN protocols require complex encryption algorithms to establish VPN tunnels. Data transmission necessitates multiple key exchanges and packet encapsulation operations, which are time-consuming and consume significant CPU processing power. When processor power is insufficient or the required encryption level is low, using traditional VPN protocols for transmission consumes excessive time and computing power, making the cost of establishing a VPN tunnel prohibitively high. Summary of the Invention

[0004] The technical problem solved by this invention is that establishing a VPN tunnel using traditional VPN protocols consumes too much time and computing power.

[0005] To address the aforementioned technical problems, this invention provides a method for establishing a VPN tunnel. The method includes the following steps: sending a VPN tunnel establishment request to a server, the establishment request including an encryption method to be negotiated; receiving a confirmation message from the server in response to the establishment request; encrypting user information using the encryption method and sending the encrypted user information to the server for the server to decrypt the encrypted user information using the encryption method; verifying the decrypted user information and configuring transmission parameters after successful verification; receiving the transmission parameters and configuring routing information using the transmission parameters to complete the establishment of the VPN tunnel.

[0006] Optionally, the encryption method, the confirmation message, the encrypted user information, and the transmission parameters are carried in the UDP data packet.

[0007] Optionally, the method for establishing a VPN tunnel further includes the following steps: receiving an update data packet from the server, the update data packet carrying the server's new IP address and new port number, instructing the client to reconnect; renegotiating the encryption method with the server, encrypting the user information using the encryption method, and sending the encrypted user information to the server so that the server can decrypt the encrypted user information using the encryption method, and verifying the decrypted user information; after successful verification, receiving configuration transmission parameters sent by the server, configuring routing information using the transmission parameters to complete the establishment of the VPN tunnel.

[0008] Optionally, this embodiment of the invention also discloses another method for establishing a VPN tunnel, wherein the method for establishing a VPN tunnel includes the following steps: receiving a VPN tunnel establishment request from a client, the establishment request including an encryption method that needs to be negotiated; sending a confirmation message in response to the establishment request; receiving encrypted user information from the client, and decrypting the encrypted user information using the encryption method, verifying the decrypted user information, wherein the encrypted user information is obtained by the client encrypting user information using the encryption method; configuring transmission parameters after successful verification, and sending them to the client so that the client can use the transmission parameters to configure routing information to complete the establishment of the VPN tunnel.

[0009] Optionally, the transmission parameters include one or more of the following: IP address, IP address range mask, server gateway IP address, and maximum transmission unit.

[0010] Optionally, the user information includes a username and a password, and the encryption method includes swapping the bytes of the username at a preset position with the bytes of the password at a preset position.

[0011] Optionally, the client receives a first AT command from the control device, which is used to trigger the establishment of a VPN tunnel.

[0012] Optionally, the first AT command may include opening the tunnel, the server address, the server port number, and user information.

[0013] Optionally, the client receives a second AT command from the control device, which is used to close the VPN tunnel.

[0014] Optionally, the second AT command may include closing the tunnel, the server address, and the server port number.

[0015] Optionally, the method for establishing a VPN tunnel further includes the following steps: receiving a reconnection data packet from the server, the reconnection data packet indicating a reconnection.

[0016] This invention also discloses an apparatus for establishing a VPN tunnel, the apparatus comprising: a request module for sending a VPN tunnel establishment request to a server, the establishment request including an encryption method to be negotiated; a confirmation receiving module for receiving a confirmation message from the server in response to the establishment request; an encryption module for encrypting user information using the encryption method and sending the encrypted user information to the server, so that the server can decrypt the encrypted user information using the encryption method, verify the decrypted user information, and configure transmission parameters after successful verification; and a transmission parameter receiving module for receiving the transmission parameters and configuring routing information using the transmission parameters to complete the establishment of the VPN tunnel.

[0017] This invention also discloses another apparatus for establishing a VPN tunnel, the apparatus comprising: a request receiving module for receiving a VPN tunnel establishment request from a client, the establishment request including an encryption method to be negotiated; a request feedback module for sending confirmation information of the establishment request feedback to the client; a decryption module for decrypting the encrypted user information of the client using the encryption method, verifying the decrypted user information, and sending transmission parameters after successful verification; and a transmission parameter sending module for sending the transmission parameters to the client to complete the establishment of the VPN tunnel.

[0018] This invention also discloses a computer-readable storage medium storing a computer program thereon, which, when run by a processor, executes the steps of any of the methods for establishing a VPN tunnel according to this invention.

[0019] This invention also discloses a client, including a memory and a processor. The memory stores a computer program that can run on the processor. When the program is run by the processor, it executes the steps of any of the methods for establishing a VPN tunnel on the client side of this invention.

[0020] This invention also discloses a server, including a memory and a processor. The memory stores a computer program that can run on the processor. When the program is run by the processor, it executes the steps of any of the methods for establishing a VPN tunnel on the server side of this invention.

[0021] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects:

[0022] This invention proposes a method for establishing a VPN tunnel. Before establishing the VPN tunnel, the client negotiates an encryption method with the server. After negotiation, the client sends encrypted user information to the server. The server decrypts the encrypted user information and verifies it. Once verification is successful, the server can configure transmission parameters to complete the VPN tunnel establishment. After the VPN tunnel is established, data transmission begins. Data packets do not require complex encryption processing, allowing for rapid VPN tunnel establishment at a very low cost. Attached Figure Description

[0023] Figure 1 This is an overall flowchart of a method for establishing a VPN tunnel provided by an embodiment of the present invention;

[0024] Figure 2 This is an interactive flowchart of establishing a VPN tunnel between a client and a server, provided by an embodiment of the present invention;

[0025] Figure 3 This is a flowchart illustrating the specific steps of using update data packets after establishing a VPN tunnel, as provided in an embodiment of the present invention.

[0026] Figure 4 This is a flowchart illustrating the specific steps of using reconnection data packets after establishing a VPN tunnel, as provided in an embodiment of the present invention.

[0027] Figure 5 This is a schematic diagram of a device for establishing a VPN tunnel provided in an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of another device for establishing a VPN tunnel provided in an embodiment of the present invention. Detailed Implementation

[0029] As described in the background section, traditional VPN protocols require complex encryption algorithms to establish VPN tunnels. During data transmission, multiple key exchanges and data packet encapsulation operations are required, which takes a long time and consumes CPU processing power. When processor computing power is insufficient and the required encryption level is not high, using traditional VPN protocols for transmission will consume too much time and computing power, resulting in excessively high costs for establishing VPN tunnels.

[0030] In this embodiment of the invention, the client negotiates an encryption method with the server before establishing a VPN tunnel. After negotiation, the client sends encrypted user information to the server. The server decrypts the encrypted user information and verifies it. Once verification is successful, the server can configure transmission parameters to complete the establishment of the VPN tunnel. After the VPN tunnel is established, data transmission begins. Data packets do not require complex encryption processing, allowing for the rapid establishment of the VPN tunnel at a very low cost.

[0031] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Figure 1 This is an overall flowchart of a method for establishing a VPN tunnel provided in this embodiment.

[0033] The method for establishing a VPN tunnel can be used on the client side, meaning that the client can execute each step of the method. The client can be a mobile phone, computer, tablet, or other suitable terminal device.

[0034] Specifically, establishing a VPN tunnel may include the following steps:

[0035] In step 101, the client sends a VPN tunnel establishment request to the server, the request including an encryption method that needs to be negotiated. Accordingly, the server receives the establishment request and confirms the encryption method to be negotiated. If the encryption method is confirmed, a confirmation message is sent in response to the establishment request.

[0036] In step 102, the client receives a confirmation message from the server in response to the establishment request.

[0037] In step 103, the client encrypts the user information using the encryption method and sends the encrypted user information to the server. Correspondingly, the server receives the encrypted user information from the client, decrypts the encrypted user information using the encryption method, and verifies the decrypted user information. If the verification passes, the server configures the transmission parameters and sends them to the client.

[0038] In step 104, the client receives the transmission parameters and uses them to configure routing information to complete the establishment of the VPN tunnel.

[0039] At this point, a VPN tunnel is established between the client and the server, which can then be used for data transmission.

[0040] It should be noted that the sequence number of each step in this embodiment does not represent a limitation on the execution order of each step.

[0041] It is understood that, in specific implementations, the method for establishing a VPN tunnel can be implemented using software programs that run within a processor integrated into a chip or chip module. This method can also be implemented using a combination of software and hardware; this application does not impose any limitations on this approach.

[0042] In this embodiment of the invention, the client negotiates an encryption method with the server before establishing a VPN tunnel. After negotiation, the client sends encrypted user information to the server. The server decrypts the encrypted user information and verifies it. Once verification is successful, the server can configure transmission parameters to complete the establishment of the VPN tunnel. After the VPN tunnel is established, data transmission begins. Data packets do not require complex encryption processing, allowing for the rapid establishment of the VPN tunnel at a very low cost.

[0043] Figure 2 The flowchart illustrating the interaction process for establishing a VPN tunnel between the client and the server is shown. In this embodiment, the control device 13 and the client 11 are connected via a serial port.

[0044] The control device 13 sends the first AT command 131 to the client 11, triggering the process of establishing a VPN tunnel.

[0045] In step 21, client 11 sends a CON data packet to server 12, which carries the encryption method to be negotiated.

[0046] In a non-limiting embodiment, the user information includes a username and a password, and the encryption method includes swapping bytes of the username at a preset position with bytes of the password at a preset position. For example, it could be swapping the first four bytes of the username starting from the third byte with bytes at the corresponding positions in the password.

[0047] In another specific implementation, the encryption method may be to reverse the individual strings of the username and / or password.

[0048] It should be noted that other feasible encryption methods can also be used, and the embodiments of the present invention do not impose any restrictions on this.

[0049] In step 22, after receiving the CON data packet, server 12 sends an ACK data packet to client 11. The ACK data packet carries a confirmation message from the server in response to the connection request. After receiving the ACK data packet, client 11 encrypts the user information using the agreed-upon encryption method.

[0050] In step 23, client 11 sends a REG data packet to server 12. The REG data packet carries user information encrypted according to the negotiated encryption method. After receiving the REG data packet, server 12 decrypts the encrypted user information using the negotiated encryption method, verifies the decrypted user information, and configures the transmission parameters after successful verification.

[0051] In step 24, server 12 sends a CFG data packet to client 11, which carries transmission parameters. After receiving the transmission parameters, client 11 uses them to configure routing information and completes the establishment of the VPN tunnel.

[0052] In step 25, after the VPN tunnel is established, client 11 and server 12 begin data transmission. Specifically, this can involve transmitting DATA data packets.

[0053] In a non-limiting embodiment, client 11 can send heartbeat packets at preset time intervals to determine whether the VPN tunnel is disconnected. For example, client 11 sends a heartbeat packet to server 12 every 180 seconds. If it does not receive data from server 12 within 180 seconds, it is determined that the connection has dropped, and client 11 needs to reconnect.

[0054] Control device 13 sends a second AT command 132 to client 11, and client 11 responds to the second AT command 132 by disconnecting the VPN tunnel.

[0055] Figure 3 This is a flowchart illustrating the specific steps involved in establishing a VPN tunnel and using update data packets, as provided in this embodiment of the invention.

[0056] Unlike the previous embodiments, in this embodiment, in step 26, server 12 sends a ROUTE type update data packet to client 11. The ROUTE data packet carries a new server IP address and a new server port number. After receiving the ROUTE data packet, client 11 disconnects the existing connection and configures the new server IP address and the new server port number. After the configuration is completed, it resends a CON data packet to server 12 to start the VPN tunnel establishment process.

[0057] Figure 4 This is a flowchart illustrating the specific steps of using reconnection data packets after establishing a VPN tunnel, as provided in an embodiment of the present invention.

[0058] Unlike the previous embodiment where the connection was disconnected via the second AT command 132, in this embodiment, in step 27, the server 12 sends a DIS-type reconnection data packet to the client 11, informing the client 11 that the server 12 has actively disconnected and instructing the client 11 to reconnect. If the client needs to continue data transmission, it needs to re-initiate the VPN tunnel establishment process.

[0059] It is understandable that the specific process for client 11 to re-establish the VPN tunnel can refer to the aforementioned embodiment, and will not be repeated here.

[0060] In a non-limiting embodiment, the format of the first AT command is as follows: AT+TUN=1,175.170.149.24,6005,123,123456. Wherein, AT+TUN=1 indicates opening a tunnel, 175.170.149.24 represents the server address, 6005 represents the server port number, 123 represents the username, and 123456 represents the username and password.

[0061] In a non-limiting embodiment, the second AT command has the following format: AT+TUN=0,175.170.149.24,6005. Here, AT+TUN=0 indicates closing the tunnel, 175.170.149.24 represents the server address, and 6005 represents the server port number, used by the client to delete routing rules based on the aforementioned server address and port number.

[0062] In a non-limiting embodiment, all packet formats negotiated between the client and the server are shown in Table 1:

[0063] Table 1

[0064] len code data Length of the data portion 2 bytes Length

[0065] Where: len is the length of the data part, code is the data packet type, and data is the data carried, which can be the encryption method, encrypted user information, transmission parameters, or transmitted data.

[0066] In practice, the data packet type is defined through negotiation between the client and the server. There are a total of 8 types, as follows:

[0067] 1. The format of the CON data packet is shown in Table 2. When a client sends a CON data packet, it indicates that the client is requesting a connection.

[0068] Table 2

[0069] Len Code Seed1 Seed2 2 bytes 2 bytes 2 bytes 4 bytes 0x00

[0070] Here, 4 bytes represent the length of the CON data packet, 0x00 represents the type of the CON data packet, Seed1 represents the position where the first byte to be exchanged (that is, the position where the first byte to be exchanged is the 2nd byte), and Seed2 represents the length of the exchanged bytes (that is, the length of the exchanged bytes is 2 bytes).

[0071] 2. The format of the ACK packet is shown in Table 3. When the server sends an ACK packet, it indicates that the server is responding to the client's request.

[0072] Table 3

[0073] Len Code Seed1 Seed2 2 bytes 2 bytes 2 bytes 4 bytes 0x00

[0074] In this ACK packet, 4 bytes represent the length of the ACK packet, 0x00 represents the type of ACK packet, Seed1 represents the position of the acknowledgment start byte exchange (i.e., the acknowledgment start byte position is the 2nd byte), and Seed2 represents the length of the acknowledgment exchange bytes (i.e., the length of the exchange bytes is 2 bytes). If Seed1 and Seed2 in the ACK packet are the same as Seed1 and Seed2 in the CON packet, it indicates that the encryption negotiation was successful; otherwise, it indicates that the negotiation failed.

[0075] 3. The format of the REG data packet is shown in Table 4. A client sending a REG data packet indicates that the client is registering.

[0076] Table 4

[0077] Len Code DeviceId Password 2 bytes Length Length DeviceId+Password 0x01

[0078] The length of the REG data packet is the sum of the actual lengths of the DeviceId and Password fields. 0x01 indicates the type of REG data packet. DeviceId represents the encrypted username (the encrypted username is a string ending with \0, and its storage requirements depend on the actual length of the encrypted username). Password represents the encrypted password (the encrypted password is a string ending with \0, and its storage requirements depend on the actual length of the encrypted password).

[0079] 4. The format of the CFG data packet is shown in Table 5. The server sends the CFG data packet to indicate the configuration of transmission parameters.

[0080] Table 5

[0081] Len Code IP mask gateway mtu 2 bytes 4 bytes 4 bytes 4 bytes 2 bytes 14 bytes 0x02

[0082] In this data structure, 14 bytes represent the length of the CFG data packet, 0x02 represents the type of CFG data packet, ip represents the IP address assigned to the client by the server (i.e., the length of the assigned IP address is 2 bytes), mask represents the IP address range mask (i.e., the length of the assigned IP address range mask is 4 bytes), gateway represents the server gateway IP address (i.e., the length of the assigned server gateway IP address is 4 bytes), and mtu represents the maximum transmission unit (i.e., the length of the maximum transmission unit is 2 bytes, and the length of the Data field in the PKG data packet cannot exceed the length of the mtu).

[0083] 5. The format of the PKG data packet is shown in Table 6. The client and server exchange PKG data packets to indicate data transmission.

[0084] Table 6

[0085] Len Code Data 2 bytes Length Length of Data 0x03

[0086] The length of the PKG packet is the actual length of the Data field. 0x03 indicates the type of the PKG packet, and Data indicates the transmitted data, which is a complete IP layer packet (its storage requirements depend on the actual length of the data).

[0087] 6. The format of the HB data packet is shown in Table 7. The HB data packet represents a heartbeat packet. The client sends a heartbeat packet to the server every 180 seconds. If no data is received from the server within 180 seconds, it is considered a disconnection and a reconnection needs to be initiated.

[0088] Table 7

[0089] Len Code Ip 2 bytes 4 bytes 4 bytes 0xFE

[0090] Here, 4 bytes represent the length of the HB packet, 0xFE represents the type of the HB packet, and Ip represents the local IP address assigned to the client by the server (that is, the length of the assigned local IP address is 4 bytes, which is used for judgment).

[0091] 7. The format of the ROUTE packet is shown in Table 8. When the server sends a ROUTE packet, it indicates that the server has changed its IP address and port, instructing the client to disconnect and connect to the server using the new IP address and port.

[0092] Table 8

[0093] Len Code ServerIp ServerPort 2 bytes 4 bytes 2 bytes 6 bytes 0xFD

[0094] In this packet, 6 bytes represent the length of the ROUTE packet, 0xFD represents the type of the ROUTE packet, ServerIp represents the new server IP (i.e., the length of the new server IP is 4 bytes), and ServerPort represents the new server port (i.e., the length of the new server port is 2 bytes).

[0095] 8. The format of the DIS data packet is shown in Table 9. When the server sends a DIS data packet, it indicates that the server has actively disconnected the connection. When the client receives the DIS data packet, the server has already closed the VPN tunnel and a reconnection is required.

[0096] Table 9

[0097] Len Code 2 bytes 0 0x11

[0098] Here, 0x11 indicates the type of DIS data packet.

[0099] like Figure 5 As shown, this embodiment of the invention also discloses an apparatus for establishing a VPN tunnel. The apparatus 50 includes:

[0100] The request module 501 is used to send a VPN tunnel establishment request to the server, the establishment request including the encryption method that needs to be negotiated;

[0101] The confirmation receiving module 502 is used to receive the confirmation message returned by the server in response to the establishment request;

[0102] The encryption module 503 is used to encrypt user information using the encryption method and send the encrypted user information to the server so that the server can decrypt the encrypted user information using the encryption method, verify the decrypted user information, and configure transmission parameters after the verification is successful.

[0103] The transmission parameter receiving module 504 receives the transmission parameters and uses the transmission parameters to configure routing information to complete the establishment of the VPN tunnel.

[0104] In specific implementations, the aforementioned device for establishing a VPN tunnel can correspond to a chip in the client that has the function of establishing a VPN tunnel, such as a SOC (System-On-a-Chip), a baseband chip, etc.; or correspond to a chip module in the client that includes the function of establishing a VPN tunnel; or correspond to a chip module with a data processing chip; or correspond to the client.

[0105] like Figure 6 As shown, this embodiment of the invention also discloses an apparatus for establishing a VPN tunnel. The apparatus 60 for establishing a VPN tunnel includes:

[0106] The request receiving module 601 is used to receive a VPN tunnel establishment request from the client, the establishment request including the encryption method that needs to be negotiated;

[0107] The request feedback module 602 is used to send confirmation information for establishing the request feedback to the client;

[0108] The decryption module 603 is used to decrypt the encrypted user information of the client using the encryption method, verify the decrypted user information, and send transmission parameters after successful verification.

[0109] The transmission parameter sending module 604 is used to send the transmission parameters to the client to complete the establishment of the VPN tunnel.

[0110] In specific implementations, the aforementioned device for establishing a VPN tunnel can correspond to a chip in a server that has the function of establishing a VPN tunnel, such as a SOC (System-On-a-Chip), a baseband chip, etc.; or correspond to a chip module in a server that includes the function of establishing a VPN tunnel; or correspond to a chip module with a data processing function; or correspond to a server.

[0111] For more information on the working principles and methods of the VPN tunnel establishment devices 50 and 60, please refer to [link / reference needed]. Figures 1 to 4 The relevant descriptions in the text will not be repeated here.

[0112] This invention also discloses a storage medium, which is a computer-readable storage medium storing a computer program thereon, the computer program being executable during runtime. Figures 1 to 4 The steps of establishing a VPN tunnel are shown below. The storage medium may include ROM, RAM, disk, or optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0113] This invention also discloses a client, which may include a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it can execute... Figures 1 to 4 The steps of the method shown are as follows.

[0114] This invention also discloses a server, which may include a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it can execute... Figures 1 to 4 The steps of the method shown are as follows.

[0115] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article indicates that the preceding and following related objects have an "or" relationship.

[0116] The descriptions of "first," "second," etc., appearing in the embodiments of this application are for illustrative purposes and to distinguish the objects being described. They have no order and do not indicate any special limitation on the number of devices in the embodiments of this application, nor do they constitute any limitation on the embodiments of this application.

[0117] In this application embodiment, "connection" refers to various connection methods such as direct connection or indirect connection to realize communication between devices. This application embodiment does not limit this in any way.

[0118] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatus, and systems can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the negotiation of the encryption method is merely an example of one encryption method, and other encryption methods may be used in actual implementation; for example, the control device may be a button, a computer, or other device; or some features may be ignored or not executed.

[0120] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0121] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0122] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, and systems can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the division of units is merely a logical functional division, and other division methods may exist in actual implementation; for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0123] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0124] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware or in the form of hardware plus software functional units.

[0125] The integrated unit implemented as a software functional unit described above can be stored in a computer-readable storage medium. This software functional unit, stored in a storage medium, includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute some steps of the methods described in the various embodiments of the present invention.

[0126] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A method of establishing a VPN tunnel, characterized by, The method comprises the following steps: sending a VPN tunnel establishment request to a server, the establishment request comprising an encryption method to be negotiated; receiving a confirmation message fed back by the server in response to the establishment request; encrypting user information by using the encryption method, and sending the encrypted user information to the server, so that the server decrypts the encrypted user information by using the encryption method, verifies the decrypted user information, and configures transmission parameters after verification; receiving the transmission parameters, and configuring routing information by using the transmission parameters, so as to complete establishment of the VPN tunnel; using the established VPN tunnel for data transmission, and the data packets used for data transmission do not need to be encrypted.

2. The method of establishing a VPN tunnel of claim 1, wherein, The encryption method, the confirmation message, the encrypted user information, and the transmission parameters are carried in a UDP packet.

3. The method of establishing a VPN tunnel of claim 1, wherein, Before the step of sending the VPN tunnel establishment request to the server, the method further comprises the following steps: receiving a first AT instruction from a control device, the first AT instruction being used to trigger establishment of a VPN tunnel.

4. The method of establishing a VPN tunnel of claim 3, wherein, The first AT instruction comprises opening a tunnel, a server address, a server port number, and user information.

5. The method of establishing a VPN tunnel of claim 1, wherein, The method further comprises the following steps: receiving an update packet from the server, the update packet carrying a new IP address and a new port number of the server, and the update packet indicating reconnection; re-negotiating the encryption method with the server, encrypting user information by using the encryption method, and sending the encrypted user information to the server, so that the server decrypts the encrypted user information by using the encryption method, and verifies the decrypted user information; after verification, receiving configuration transmission parameters sent by the server, and configuring routing information by using the transmission parameters, so as to complete establishment of the VPN tunnel.

6. The method of establishing a VPN tunnel of claim 1, wherein, The method further comprises the following steps: receiving a reconnection packet from the server, the reconnection packet indicating reconnection.

7. The method of establishing a VPN tunnel of claim 1, wherein, The method further comprises the following steps: receiving a second AT instruction from a control device, the second AT instruction being used to close the VPN tunnel.

8. The method for establishing a VPN tunnel according to claim 7, wherein, The second AT instruction comprises closing a tunnel, a server address, and a server port number.

9. The method of establishing a VPN tunnel according to any one of claims 1 to 8, wherein, The transmission parameters comprise one or more of an IP address, an IP address segment mask, a server gateway IP address, and a maximum transmission unit.

10. The method of establishing a VPN tunnel according to any one of claims 1 to 8, wherein, The user information comprises a username and a password, and the encryption method comprises exchanging bytes of the username at a preset position with bytes of the password at the preset position.

11. A method of establishing a VPN tunnel, characterized by, The method comprises the following steps: receiving a VPN tunnel establishment request from a client, the establishment request comprising an encryption method to be negotiated; sending a confirmation message in response to the establishment request; receiving encrypted user information from the client, decrypting the encrypted user information by using the encryption method, and verifying the decrypted user information, the encrypted user information being obtained by encrypting user information by using the encryption method by the client. After the verification, the transmission parameters are configured and sent to the client, so that the client configures routing information by using the transmission parameters to complete establishment of the VPN tunnel.

12. The method for establishing a VPN tunnel according to claim 11, wherein, The transmission parameters include one or more of the following: IP address, IP address segment mask, server gateway IP address, and maximum transmission unit.

13. The method of establishing a VPN tunnel of claim 11, wherein, The method comprises the following steps: An update data packet is sent to the client, the update data packet carrying a new IP address and a new port number of the server, instructing the client to reconnect; The encryption method is re-negotiated with the client, encrypted user information of the client is received by using the encryption method, the encrypted user information is decrypted by using the encryption method, and the decrypted user information is verified; After the verification, the transmission parameters are configured and sent to the client, so that the client configures routing information by using the transmission parameters to complete establishment of the VPN tunnel.

14. The method of establishing a VPN tunnel of claim 12, wherein, Further comprising: A reconnection data packet is sent to the client, the reconnection data packet instructing reconnection.

15. The method of establishing a VPN tunnel according to any one of claims 11 to 14, wherein, The encryption method, the confirmation message, the encrypted user information, and the transmission parameters are carried in a UDP data packet.

16. The method of establishing a VPN tunnel according to any one of claims 11 to 14, wherein, The user information includes a username and a password, and the encryption method includes exchanging bytes at a preset position of the username with bytes at a preset position of the password.

17. An apparatus for establishing a VPN tunnel, the apparatus comprising: Comprise: A request module is configured to send an establishment request of a VPN tunnel to a server, the establishment request including an encryption method to be negotiated; A confirmation receiving module is configured to receive a confirmation message fed back by the server in response to the establishment request; An encryption module is configured to encrypt user information by using the encryption method, and send the encrypted user information to the server, so that the server decrypts the encrypted user information by using the encryption method, verifies the decrypted user information, and configures transmission parameters after the verification; A transmission parameter receiving module receives the transmission parameters, and configures routing information by using the transmission parameters to complete establishment of the VPN tunnel; Data transmission is performed by using the established VPN tunnel, and data packets used in the data transmission do not need to be encrypted.

18. An apparatus for establishing a VPN tunnel, the apparatus comprising: Comprise: A request receiving module is configured to receive an establishment request of a VPN tunnel from a client, the establishment request including an encryption method to be negotiated; A request feedback module is configured to send a confirmation message fed back in response to the establishment request to the client; A decryption module is configured to decrypt encrypted user information of the client by using the encryption method, verify the decrypted user information, and send transmission parameters after the verification; A transmission parameter sending module is configured to send the transmission parameters to the client to complete establishment of the VPN tunnel, the client performs data transmission by using the established VPN tunnel, and data packets used in the data transmission do not need to be encrypted.

19. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, which the processor executes, performs the steps of the method of establishing a VPN tunnel according to any one of claims 1 to 16.

20. A client comprising a memory and a processor, said memory having stored thereon a computer program operable to run on said processor, characterized in that, The processor, when executing the computer program, performs the steps of the method of establishing a VPN tunnel according to any one of claims 1 to 10.

21. A server comprising a memory and a processor, said memory having stored thereon a computer program operable to run on said processor, characterized in that, The processor, when executing the computer program, performs the steps of the method of establishing a VPN tunnel according to any one of claims 11 to 16.

Images