Communication method, device, electronic device and storage medium between private network and external network

Abstract

The embodiment of the present invention provides a method, device, electronic device and readable storage medium for communication between a private network and an external network, the method comprising: constructing a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device; the ping message is sent to the external network terminal device through the private network gateway; the ICMP message sent by the external network terminal device is received, the ICMP message is generated by the external network terminal device according to the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information. In the embodiment of the present invention, the private network terminal device and the external network terminal device create a private network communication tunnel based on the information agreed upon by the private network terminal device.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of wireless communication technology, and in particular, to a communication method between a private network and an external network, a communication device between a private network and an external network, an electronic device, and a computer-readable storage medium. Background Art

[0002] The network is divided into intranet and extranet. Specifically, the private network (intranet) is the local area network (LAN) within the enterprise or functional department, and the extranet (public network) is the Internet for the public. In order to ensure data security, the external terminal devices of the external network cannot access the internal terminal devices of the internal network at will. However, the enterprise or functional department usually requires the external terminal devices of the external network to access the internal terminal devices of the internal network, so that the users of the external terminal devices of the external network can use the functions of the internal network or obtain the data of the internal network, etc.

[0003] However, when an external network terminal device needs to access an internal network terminal device, it needs to penetrate the private network gateway to access the internal network terminal device. However, currently, the external network terminal device cannot easily penetrate the private network gateway and needs to perform NAT (Network Address Translation) conversion and routing configuration on the private network gateway. It cannot flexibly access the private network, resulting in the private network being unable to conveniently provide various functions or services to external network users. Summary of the invention

[0004] The embodiment of the present invention provides a method, device, electronic device and computer-readable storage medium for communication between a private network and an external network to solve the problem of private network penetration.

[0005] The embodiment of the present invention discloses a method for communication between a private network and an external network, which is applied to a private network terminal device of the private network, and the method includes:

[0006] Constructing a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device;

[0007] The ping message is sent through the private network gateway to the external network terminal device of the external network;

[0008] Receive the ICMP message sent by the external network terminal device, where the ICMP message is generated by the external network terminal device based on the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

[0009] Optionally, the step of transmitting the ping message through the private network gateway to an external network terminal device of an external network includes:

[0010] Polling available ports of the private network terminal device;

[0011] Based on the available port, the ping message is transmitted through the private network gateway to the external network terminal device of the external network.

[0012] Optionally, the constructing a ping message includes:

[0013] Get the ICMP_ECHO message of the ICMP protocol;

[0014] The configuration information of the private network gateway and the identity authentication information of the private network terminal device are written into the ICMP_ECHO message to obtain a ping message.

[0015] Optionally, the receiving an ICMP message sent by the external network terminal device includes:

[0016] The external network terminal device extracts the configuration information of the private network gateway and the identity authentication information of the private network terminal device based on the ping message, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHOREPLY message of the ICMP protocol to obtain the ICMP message, and then receives the ICMP message sent by the external network terminal device.

[0017] Optionally, the identity authentication information of the private network terminal device includes address information of the private network terminal device, and before receiving the ICMP message sent by the external network terminal device, the method further includes:

[0018] The available port is monitored to receive the ICMP message sent by the external network terminal device and containing the address information of the private network terminal device.

[0019] Optionally, a software code module is provided in the private network terminal device, and the software code module is used to communicate with the external network terminal device, and the software code module is obtained in the following manner:

[0020] When the private network terminal device is in an online state, the installation package is remotely obtained through the over-the-air download technology;

[0021] The software code module is installed in the private network terminal device according to the installation package.

[0022] Optionally, the software code module allows the functional modules it possesses to be increased or decreased.

[0023] The embodiment of the present invention further discloses a communication device between a private network and an external network, which is applied to a private network terminal device of a private network, and the device includes:

[0024] A construction module, used to construct a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device;

[0025] A sending module, used for sending the ping message through the private network gateway to an external network terminal device of the external network;

[0026] A receiving module is used to receive an ICMP message sent by the external network terminal device, wherein the ICMP message is generated by the external network terminal device according to the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

[0027] Optionally, the sending module is specifically used to:

[0028] Polling available ports of the private network terminal device;

[0029] Based on the available port, the ping message is transmitted through the private network gateway to the external network terminal device of the external network.

[0030] Optionally, the building module is specifically used to:

[0031] Get the ICMP_ECHO message of the ICMP protocol;

[0032] The configuration information of the private network gateway and the identity authentication information of the private network terminal device are written into the ICMP_ECHO message to obtain a ping message.

[0033] Optionally, the receiving module is specifically used to:

[0034] The external network terminal device extracts the configuration information of the private network gateway and the identity authentication information of the private network terminal device based on the ping message, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHOREPLY message of the ICMP protocol to obtain the ICMP message, and then receives the ICMP message sent by the external network terminal device.

[0035] Optionally, the device further includes a monitoring module, configured to:

[0036] The available port is monitored to receive the ICMP message sent by the external network terminal device and containing the address information of the private network terminal device.

[0037] Optionally, a software code module is provided in the private network terminal device, and the software code module is used to communicate with the external network terminal device. The apparatus further includes a software code module installation module, which is used to:

[0038] When the private network terminal device is in an online state, the installation package is remotely obtained through the over-the-air download technology;

[0039] The software code module is installed in the private network terminal device according to the installation package.

[0040] Optionally, the software code module allows the functional modules it possesses to be increased or decreased.

[0041] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0042] The memory is used to store computer programs;

[0043] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0044] The embodiment of the present invention further discloses a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the embodiment of the present invention.

[0045] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0046] The embodiments of the present invention include the following advantages:

[0047] In an embodiment of the present invention, a ping message is constructed, and the ping message can penetrate the private network gateway of the private network. The ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device. Subsequently, the ping message is penetrated by the private network gateway and sent to the external network terminal device of the external network. The external network terminal device can generate an ICMP message according to the configuration information and identity authentication information of the private network gateway in the ping message and send it to the private network. Among them, the ICMP message can penetrate the private network gateway according to the configuration information of the private network gateway, and be sent to the corresponding private network terminal device according to the identity authentication information. In an embodiment of the present invention, when a private network terminal device establishes a private network tunnel link to communicate with an external network terminal device, the private network terminal device can first send the configuration information and identity authentication information of the private network gateway through a ping message, so that the external network terminal device can generate an ICMP message based on the configuration information and identity authentication information of the private network gateway. Since the ICMP message is generated based on the configuration information of the private network gateway and the identity authentication information of the private network terminal device that are agreed upon with the private network terminal device, there is no need to perform operations such as NAT address conversion and routing configuration. The private network terminal device can flexibly access the private network, and then the private network terminal device of the private network can provide various functions or services for the external network terminal devices of the external network. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is a schematic diagram of an application environment provided in an embodiment of the present invention;

[0049] Figure 2 It is a flow chart of the steps of a method for communication between a private network and an external network provided in an embodiment of the present invention;

[0050] Figure 3 It is a schematic diagram of establishing a private network penetration tunnel provided in an embodiment of the present invention;

[0051] Figure 4 It is a schematic diagram of a process of establishing a private network penetration tunnel provided in an embodiment of the present invention;

[0052] Figure 5 It is a structural block diagram of a communication device between a private network and an external network provided in an embodiment of the present invention;

[0053] Figure 6 It is a schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0055] Since the official issuance of domestic 5G (5th Generation Mobile Communication Technology) commercial licenses, the scale of base stations has repeatedly set new records, key technological innovations have made new progress, and user network experience has been significantly improved. Today, China has built the world's largest 5G network. The development of 5G has reached a new level, not only promoting the leapfrog growth of the information and communication industry, but also injecting strong impetus into the digital transformation of the economy and society. The latest statistics from the Ministry of Industry and Information Technology show that as of the end of July 2022, a total of 1.968 million 5G base stations have been built and put into operation in China, and the number of 5G mobile phone users has reached 475 million, and the world's largest 5G network has been built.

[0056] At present, domestic services, especially 5G services, are mainly used for Internet of People services for consumer users and Internet of Things services for industry applications. Among them, Internet of Things services for industry applications are a new growth point for wireless services that operators are vigorously expanding, and Internet of Things services basically belong to industry-specific networks or enterprise-specific networks. The external network terminal devices need to penetrate the private network to access the internal network terminal devices and modules within the private network. Therefore, private network penetration has become a key technology that needs to be broken through in the Internet of Things business.

[0057] 5G is mainly used in the consumer and industrial sectors in the IoT business. The industrial application scenario is mainly the industrial IoT industry application, and the industrial IoT industry application is mainly based on enterprise private networks. 5G realizes a single network to meet the coverage requirements of public networks and enterprise private networks, so it is particularly suitable for industrial IoT industry application scenarios. However, the current problem is that when 5G terminals (external network terminal devices) need to access private network terminal devices in the enterprise private network in the external network, complex configuration needs to be performed on the private network gateway between the external network and the enterprise private network, which increases the complexity of private network maintenance.

[0058] In view of the above problems, the embodiment of the present invention provides an innovative solution to realize the demand for flexible penetration and access between the private network and the external network, and realizes the communication between the private network and the external network in a simple way. As an optional example, the embodiment of the present invention can adopt the network penetration technology based on L2TP (Layer 2 Tunneling Protocol, the second layer tunneling protocol) combined with ICMP (Internet Control Message Protocol, network control message protocol) reverse proxy mode to realize the communication between the private network and the external network.

[0059] The communication method between a private network and an external network provided in the embodiment of the present invention can be applied to Figure 1In the application environment shown. It involves a terminal device, and the terminal device includes a private network terminal device 101 of a private network and an external network terminal device 102 of an external network. Specifically, the private network terminal device 101 constructs a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device 101; the ping message is sent to the external network terminal device 102 through the private network gateway; the ICMP message sent by the external network terminal device 102 is received, and the ICMP message is generated by the external network terminal device 102 according to the configuration information and identity authentication information of the private network gateway in the ping message, so that the ICMP message can penetrate the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device 101 according to the identity authentication information.

[0060] In actual applications, terminal devices may include but are not limited to various personal computers, laptops, smart phones, tablet computers, vehicle-mounted terminals, portable wearable devices and servers. Server 104 may be an independently operated server or a server cluster composed of multiple servers, wherein the server may be a cloud server.

[0061] Reference Figure 2 , shows a flow chart of the steps of a communication method between a private network and an external network provided in an embodiment of the present invention, which is applied to a private network terminal device of a private network and may specifically include the following steps:

[0062] Step 201, construct a ping message; wherein, the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device.

[0063] As an optional example, the private network terminal device and the external network terminal device can be a 5G Dongle wireless communication terminal device, that is, a terminal device or network device with 5G function. In an embodiment of the present invention, the private network terminal device is a terminal device accessed in the private network, and the external network terminal device is a terminal device accessed in the external network.

[0064] In an embodiment of the present invention, a software code module may be provided in a private network terminal device and an external network terminal device, and the software code module is used to establish a private network penetration tunnel with the external network terminal device, so that the private network terminal device and the external network terminal device can communicate based on the private network penetration tunnel, and then the external network terminal device can access the private network terminal device and obtain corresponding services or data in the private network, etc.

[0065] As an alternative example, see Figure 3, the network mode of the private network terminal device and the external network terminal device can be set to the Rndis (Remote Network Driver Interface Specification) network card mode, and then, a full-protocol stack full-port listening module Link_Listen and a tunnel link establishment module Link_Connect are established on the private network terminal device, and a tunnel link establishment module Link_Connect is established on the external network terminal device. Optionally, in the embodiment of the present invention, based on the tunnel link establishment module Link_Connect, a private network penetration tunnel of multiple transmission communication protocols such as L2TP, DNS (Domain Name System), HTTP (Hypertext Transfer Protocol), and SSH (Secure Shell) can be established between the private network terminal device and the external network terminal device.

[0066] In order to ensure that the message data can penetrate various private network gateways, in the embodiments of the present invention, innovative designs are made in the message structure and message interaction. Specifically, the embodiments of the present invention innovatively consider that the ping message can penetrate various private network gateways, so it can be set to first construct a ping message by the private network terminal device specified by the private network (i.e., the terminal device accessed in the private network), and place the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, wherein the identity authentication information may include the IP address and port (Port) and other address information of the private network terminal device.

[0067] Step 202: Send the ping message through the private network gateway to the external network terminal device of the external network.

[0068] Step 203, receive the ICMP message sent by the external network terminal device, the ICMP message is generated by the external network terminal device according to the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

[0069] In an embodiment of the present invention, after the private network terminal device constructs a ping message containing the configuration information of the private network gateway and the identity authentication information of the private network terminal device, the ping message is sent through the private network gateway to the external network terminal device on the external network side. When the external network terminal device receives the ping message, the configuration information of the private network gateway and the identity authentication information of the private network terminal device can be extracted from the ping message and an ICMP message can be generated through the ICMP reverse proxy mode. Subsequently, the constructed ICMP message can be passed through the private network gateway to interact with the designated private network terminal device (the private network terminal device being accessed) of the private network.

[0070] Specifically, ICMP messages can easily penetrate the private network gateway because the ICMP messages already include the configuration information of the private network gateway that is agreed upon with the private network terminal devices. Therefore, the ICMP messages of the external network terminal devices can pass the verification of the private network gateway. After the private network gateway verification is passed, the ICMP messages will enter the private network and establish a private network penetration tunnel with the private network terminal device corresponding to the identity authentication information. Among them, the terminal devices of the private network and the intranet can establish private network penetration tunnels of other communication protocols such as the L2TP protocol, forming a stable business link.

[0071] In the above-mentioned communication method between the private network and the external network, a ping message is first constructed. The ping message can penetrate the private network gateway of the private network. The ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device. Subsequently, the ping message is penetrated by the private network gateway and sent to the external network terminal device of the external network. The external network terminal device can generate an ICMP message according to the configuration information and identity authentication information of the private network gateway in the ping message and send it to the private network. Among them, the ICMP message can penetrate the private network gateway according to the configuration information of the private network gateway, and be sent to the corresponding private network terminal device according to the identity authentication information. In an embodiment of the present invention, when a private network terminal device establishes a private network tunnel link to communicate with an external network terminal device, the private network terminal device can first send the configuration information and identity authentication information of the private network gateway through a ping message, so that the external network terminal device can generate an ICMP message based on the configuration information and identity authentication information of the private network gateway. Since the ICMP message is generated based on the configuration information of the private network gateway and the identity authentication information of the private network terminal device that are agreed upon with the private network terminal device, there is no need to perform operations such as NAT address conversion and routing configuration. The private network terminal device can flexibly access the private network, and then the private network terminal device of the private network can provide various functions or services for the external network terminal devices of the external network.

[0072] In an optional embodiment of the present invention, the step 202 of transmitting the ping message through the private network gateway to the external network terminal device of the external network may include:

[0073] Polling available ports of the private network terminal device;

[0074] Based on the available port, the ping message is transmitted through the private network gateway to the external network terminal device of the external network.

[0075] In a specific implementation, the private network terminal device has at least one port, and usually has multiple ports, such as Port1, Port2, Port3, ... Portn. Before sending a ping message, the available ports of the private network terminal device, such as idle ports, can be polled. Then, if there is an available port, the ping message can be sent through the private network gateway to the external network terminal device through the available port.

[0076] In an optional embodiment of the present invention, the step 101, constructing a ping message, may include:

[0077] Get the ICMP_ECHO message of the ICMP protocol;

[0078] The configuration information of the private network gateway and the identity authentication information of the private network terminal device are written into the ICMP_ECHO message to obtain a ping message.

[0079] Then the step 203, receiving the ICMP message sent by the external network terminal device, may include:

[0080] The external network terminal device extracts the configuration information of the private network gateway and the identity authentication information of the private network terminal device based on the ping message, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHOREPLY message of the ICMP protocol to obtain the ICMP message, and then receives the ICMP message sent by the external network terminal device.

[0081] In the specific implementation, since ICMP messages are processed by the system kernel and do not occupy any port, the modified ICMP_ECHO and ICMP_ECHOREPLY are used to construct ping messages and ICMP messages, and the information to be transmitted (such as the configuration information of the private network gateway and the identity authentication information of the private network terminal device) is placed in ICMP_ECHO and ICMP_ECHOREPLY, and then the private network penetration tunnel can be established through the ping and tracert commands. Among them, since the ICMP protocol is based on the IP protocol stack, it can be carried on the IPV4 and IPV6 architectures, and it is very practical.

[0082] Specifically, the private network terminal device obtains the initial ICMP_ECHO message of the ICMP protocol, and then writes the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHO message to generate a ping message, and then sends the ping message to the external network terminal device through the ping and tracert commands. After receiving the ping message, the external network terminal device obtains the initial ICMP_ECHOREPLY of the ICMP protocol, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message into ICMP_ECHOREPLY to obtain the ICMP message, and then sends the ICMP message to the private network terminal device of the private network to establish a private network penetration tunnel.

[0083] In an embodiment of the present invention, an ICMP private network penetration tunnel is established by a private network terminal device accessed in the private network, and a ping message is simulated to be sent to an external network terminal device. Then, the external network terminal device establishes a private network penetration tunnel through an ICMP reverse proxy mode. The embodiment of the present invention can penetrate private network servers and firewalls, safely enter the private network, and interact with private network terminal devices through ICMP_ECHO and ICMP_ECHOREPLY messages.

[0084] In an optional embodiment of the present invention, the identity authentication information of the private network terminal device includes address information of the private network terminal device, and before receiving the ICMP message sent by the external network terminal device, the method further includes:

[0085] The available port is monitored to receive the ICMP message sent by the external network terminal device and containing the address information of the private network terminal device.

[0086] In an embodiment of the present invention, the ICMP message sent by the external network terminal device includes the identity authentication information of the private network terminal device, and the identity authentication information may include address information such as IP address and port. Therefore, after the ICMP message sent by the private network terminal device penetrates the private network gateway, the private network terminal device can obtain the ICMP message sent by the external network terminal device by listening to the available port, and then establish a private network penetration tunnel with the external network terminal device based on the ICMP message.

[0087] In an optional embodiment of the present invention, a software code module is provided in the private network terminal device, and the software code module is used to communicate with the external network terminal device. The software code module can be obtained in the following manner:

[0088] When the private network terminal device is in an online state, the installation package is remotely obtained through the over-the-air download technology;

[0089] The software code module is installed in the private network terminal device according to the installation package.

[0090] In an embodiment of the present invention, the software code module of the private network terminal device adopts a building block software module design scheme, which can dynamically increase or decrease functional modules locally, that is, the software code module allows the addition or reduction of its functional modules. For example, if you want to add an ICMP private network penetration tunnel, you can download the ICMP functional module, or if you do not want to continue using the DNS private network penetration tunnel, you can uninstall the DNS functional module. Specifically, it can be implemented in 5G terminal devices through OTA (Over-the-Air Technology) remote upgrade. As long as the terminal device to be implemented is in a networked state, the software code module can be downloaded manually or automatically from the network server through the OTA protocol for installation or upgrading of some functional modules to achieve flexible implementation and operation. Of course, the installation and upgrade of the software code module of the external network terminal device is similar to that of the software code module of the private network terminal device, so it will not be repeated.

[0091] The embodiment of the present invention adopts an efficient and flexible open software architecture, applies a building block software module design scheme to the software code module, can locally and dynamically increase or decrease the functional modules of the software code module, and adopts an efficient C language to implement high-performance ICMP reverse proxy mode applications. It supports communication protocols such as TCP (Transmission Control Protocol), UDP (User Data Protocol), HTTP, HTTPS protocol, etc., covers mainstream operating systems such as Windows, Linux, Raspberry Pi, Mac, Android, etc., and has strong adaptability, so that external network terminal devices can flexibly, efficiently and seamlessly penetrate into the 5G private network, and access the 5G network anytime and anywhere.

[0092] As an optional example, in the implementation code architecture, the process of implementing communication between the private network and the external network in the embodiment of the present invention is as follows:

[0093]

[0094]

[0095] Reference Figure 4, the Link_Init module in the private network terminal device initializes the ICMP message structure, the message type is 0x0, the information to be transmitted (i.e. the configuration information of the private network gateway and the identity authentication information of the private network terminal device, etc.) is filled in ICMP_ECHO and ICMP_ECHOREPLY to form a ping message, the Link_Listen module polls and listens to all available ports of the private network terminal device, and then, establishes a ping connection between ICMP_ECHO and the Link_Connect module of the external network terminal device through the Link_Connect module, and sends ICMP_ECHO to the Link_Connect module of the external network terminal device by simulating a ping message. After the Link_Connect module of the external network terminal device receives the ping message, it can fill in ICMP_ECHOREPLY according to the ping message to form an ICMP message, and establish a (private network penetration tunnel) tunnel service channel according to the ICMP reverse proxy mode, and then, the private network terminal device communicates with the external network terminal device.

[0096] It should be noted that the software code module of the embodiment of the present invention implements an ultra-small module kernel (<=100k) and an architecture compatible with multiple operating system platforms, which meets the needs of enterprise-level private network industry applications. At the same time, it is carried on highly mobile and portable wireless communication terminal devices such as 5G Dongle, and has very good large-scale commercial application.

[0097] The embodiments of the present invention are applied to focus on achieving and solving the pain points of other network applications such as the current 5G network. Taking the 5G network as an example, the embodiments of the present invention can solve the following two pain points of the 5G network:

[0098] 1) The problem that most current 5G terminal devices cannot easily penetrate the 5G private network gateway is solved. This is because if the 5G terminal device of the private network wants to penetrate the 5G private network gateway, it is necessary to perform NAT address conversion and routing configuration on the private network gateway, which brings certain limitations to 5G applications. The 5G terminal device of the external network in the embodiment of the present invention obtains the ping message of the 5G terminal device of the private network, and penetrates the 5G private network gateway based on the ping message through the ICMP reverse proxy mode. Therefore, the 5G terminal device of the private network does not need to perform NAT address conversion and routing configuration on the private network gateway, making 5G applications more comprehensive. 2) Most of the current private network penetration technical solutions adopt the ICMP reverse proxy mode or NAT conversion protocol solution, so there is a failure in the end-to-end private network penetration protocol negotiation consistency, resulting in the problem that the success rate of establishing the private network penetration tunnel is not high. In the embodiment of the present invention, the 5G terminal device of the private network sends the configuration information and identity authentication information of the private network gateway through the ping message, so that the 5G terminal device of the external network can penetrate the private network based on the configuration information and identity authentication information in the ping message.

[0099] In summary, the embodiment of the present invention provides a network penetration algorithm solution based on a 5G customized network, which adopts a two-layer private network channel establishment mode. The first layer of ping messages is initiated by the private network to the external network terminal device of the external network to transmit information, and the second layer of ping messages is initiated by the external network to the private network terminal device of the private network to carry the negotiated consistency configuration to establish a private network penetration tunnel. Specifically, based on the second layer link tunnel protocol L2TP and the network layer protocol ICMP, the ping message mode is used to penetrate from the private network terminal device of the private network to the external network terminal device of the external network, and then the external network terminal device uses the ICMP reverse proxy mode to enter the private network, obtain the IP address and access rights of the private network (SSH / SSL access mode can be used), so as to achieve private network penetration and establish a private network penetration tunnel. Among them, based on communication protocols such as HTTP, DNS and SSH and integrating tools such as netcat and netsh, the private network terminal device is used to listen to the port and resolve the domain name for the target address and send the specified information when establishing a private network penetration tunnel in the ICMP reverse proxy mode, and the virtual link penetration spans multiple operations through communication protocols such as HTTP, DNS and SSH. In the 5G private network tests of China's three major operators, the success rate of communication between the private network and the external network of the embodiment of the present invention reached more than 96.5%.

[0100] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0101] Reference Figure 5 , shows a structural block diagram of a communication device between a private network and an external network provided in an embodiment of the present invention, and is applied to a private network terminal device of a private network, which may specifically include the following modules:

[0102] Construction module 501, used to construct a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device;

[0103] A sending module 502 is used to send the ping message through the private network gateway to the external network terminal device of the external network;

[0104] The receiving module 503 is used to receive the ICMP message sent by the external network terminal device. The ICMP message is generated by the external network terminal device according to the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

[0105] In an optional embodiment of the present invention, the sending module 502 is specifically configured to:

[0106] Polling available ports of the private network terminal device;

[0107] Based on the available port, the ping message is transmitted through the private network gateway to the external network terminal device of the external network.

[0108] In an optional embodiment of the present invention, the construction module 501 is specifically used to:

[0109] Get the ICMP_ECHO message of the ICMP protocol;

[0110] The configuration information of the private network gateway and the identity authentication information of the private network terminal device are written into the ICMP_ECHO message to obtain a ping message.

[0111] In an optional embodiment of the present invention, the receiving module 503 is specifically configured to:

[0112] The external network terminal device extracts the configuration information of the private network gateway and the identity authentication information of the private network terminal device based on the ping message, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHOREPLY message of the ICMP protocol to obtain the ICMP message, and then receives the ICMP message sent by the external network terminal device.

[0113] In an optional embodiment of the present invention, the device further includes a monitoring module, which is used to:

[0114] The available port is monitored to receive the ICMP message sent by the external network terminal device and containing the address information of the private network terminal device.

[0115] In an optional embodiment of the present invention, a software code module is provided in the private network terminal device, and the software code module is used to communicate with the external network terminal device. The apparatus further includes a software code module installation module for:

[0116] When the private network terminal device is in an online state, the installation package is remotely obtained through the over-the-air download technology;

[0117] The software code module is installed in the private network terminal device according to the installation package.

[0118] In an optional embodiment of the present invention, the software code module allows the functional modules it possesses to be increased or decreased.

[0119] In an embodiment of the present invention, a ping message is constructed, and the ping message can penetrate the private network gateway of the private network. The ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device. Subsequently, the ping message is penetrated by the private network gateway and sent to the external network terminal device of the external network. The external network terminal device can generate an ICMP message according to the configuration information and identity authentication information of the private network gateway in the ping message and send it to the private network. Among them, the ICMP message can penetrate the private network gateway according to the configuration information of the private network gateway, and be sent to the corresponding private network terminal device according to the identity authentication information. In an embodiment of the present invention, when a private network terminal device establishes a private network tunnel link to communicate with an external network terminal device, the private network terminal device can first send the configuration information and identity authentication information of the private network gateway through a ping message, so that the external network terminal device can generate an ICMP message based on the configuration information and identity authentication information of the private network gateway. Since the ICMP message is generated based on the configuration information of the private network gateway and the identity authentication information of the private network terminal device that are agreed upon with the private network terminal device, there is no need to perform operations such as NAT address conversion and routing configuration. The private network terminal device can flexibly access the private network, and then the private network terminal device of the private network can provide various functions or services for the external network terminal devices of the external network.

[0120] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0121] In addition, an embodiment of the present invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned embodiment of the communication method between the private network and the external network are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0122] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned method for communicating between a private network and an external network is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0123] An embodiment of the present invention also provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned communication method embodiment between a private network and an external network, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0124] Figure 6 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0125] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610, and a power supply 611. Those skilled in the art will appreciate that Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0126] It should be understood that in the embodiment of the present invention, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0127] The electronic device provides users with wireless broadband Internet access through the network module 602, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0128] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0129] The input unit 604 is used to receive audio or video signals. The input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 606. The image frame processed by the graphics processor 6041 can be stored in the memory 609 (or other storage medium) or sent via the radio frequency unit 601 or the network module 602. The microphone 6042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 601 in the case of a telephone call mode.

[0130] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0131] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0132] The user input unit 607 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 607 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 6071 or near the touch panel 6071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 610, receives the command sent by the processor 610 and executes it. In addition, the touch panel 6071 can be implemented in various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 6071, the user input unit 607 may also include other input devices 6072. Specifically, other input devices 6072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be described in detail here.

[0133] Furthermore, the touch panel 6071 may be overlaid on the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it is transmitted to the processor 610 to determine the type of touch event. Then, the processor 610 provides corresponding visual output on the display panel 6061 according to the type of touch event. Figure 6 In the figure, the touch panel 6071 and the display panel 6061 are used as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0134] The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0135] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0136] The processor 610 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610.

[0137] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to each component. Preferably, the power supply 611 may be logically connected to the processor 610 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0138] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0141] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0142] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0143] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0144] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0145] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0148] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for communication between a private network and an external network, characterized in that: A private network terminal device applied to a private network, the method comprising: Constructing a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device; The ping message is sent through the private network gateway to the external network terminal device of the external network; Receive the ICMP message sent by the external network terminal device, where the ICMP message is generated by the external network terminal device based on the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

2. The method according to claim 1, characterized in that The step of transmitting the ping message through the private network gateway to the external network terminal device of the external network includes: Polling available ports of the private network terminal device; Based on the available port, the ping message is transmitted through the private network gateway to the external network terminal device of the external network.

3. The method according to claim 2, characterized in that The step of constructing a ping message includes: Get the ICMP_ECHO message of the ICMP protocol; The configuration information of the private network gateway and the identity authentication information of the private network terminal device are written into the ICMP_ECHO message to obtain a ping message.

4. The method according to claim 3, characterized in that The receiving of the ICMP message sent by the external network terminal device comprises: The external network terminal device extracts the configuration information of the private network gateway and the identity authentication information of the private network terminal device based on the ping message, and fills the configuration information of the private network gateway and the identity authentication information of the private network terminal device into the ICMP_ECHOREPLY message of the ICMP protocol to obtain the ICMP message, and then receives the ICMP message sent by the external network terminal device.

5. The method according to claim 4, characterized in that The identity authentication information of the private network terminal device includes the address information of the private network terminal device. Before receiving the ICMP message sent by the external network terminal device, the method further includes: The available port is monitored to receive the ICMP message sent by the external network terminal device and containing the address information of the private network terminal device.

6. The method according to claim 1, characterized in that The private network terminal device is provided with a software code module, and the software code module is used to communicate with the external network terminal device. The software code module is obtained in the following manner: When the private network terminal device is in an online state, the installation package is remotely obtained through the over-the-air download technology; The software code module is installed in the private network terminal device according to the installation package.

7. The method according to claim 6, characterized in that The software code module allows the functional modules it possesses to be increased or decreased.

8. A communication device between a private network and an external network, characterized in that: A private network terminal device applied to a private network, the device comprising: A construction module, used to construct a ping message; wherein the ping message is used to penetrate the private network gateway of the private network, and the ping message includes the configuration information of the private network gateway and the identity authentication information of the private network terminal device; A sending module, used for sending the ping message through the private network gateway to an external network terminal device of the external network; A receiving module is used to receive an ICMP message sent by the external network terminal device, wherein the ICMP message is generated by the external network terminal device according to the configuration information of the private network gateway and the identity authentication information of the private network terminal device in the ping message, so that the ICMP message penetrates the private network gateway according to the configuration information of the private network gateway, and is sent to the corresponding private network terminal device according to the identity authentication information.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images