VPN device communication method, device, equipment and storage medium

Abstract

The disclosed embodiments disclose a VPN device communication method, apparatus, device and storage medium. The method includes: receiving an encrypted request message sent by a first client, the first request message carrying the first physical IP address and the first virtual IP address of the first client; decrypting the request message when the first client is verified; determining the second virtual IP address and the corresponding second client based on the decrypted first virtual IP address; when the second client and the first client belong to the same group and the second client is online, encrypting the request message and sending it to the second client; receiving the encrypted response message returned by the second client in response to the request message, and sending the response message to the first client. This method improves the communication security and reliability between mobile office personnel in mobile office scenarios, and greatly improves office efficiency.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a VPN device communication method, apparatus, device, and storage medium. Background Art

[0002] With the widespread adoption of internet technology, local communications are no longer sufficient, and mobile office work has become a widespread requirement. A virtual private network (VPN) is a technology that establishes a private network on a public network. It offers a highly effective and secure mobile office solution without the high cost of deployment. VPN services address not only end-to-end communication scenarios but also end-to-end communication requirements. Using VPN gateway devices to establish communication tunnels for mobile workers can significantly improve the protection of sensitive data.

[0003] The Internet Protocol Security (IPSec) is an open standard framework that ensures confidential and secure communications over IPSec networks by establishing a cryptographically secure tunnel between communicating parties. IPSec utilizes packet encapsulation technology to encapsulate internal network IP addresses using Internet-routable addresses, enabling interoperability between remote networks and enabling end-to-end communication. Users can also choose to establish an SSL VPN tunnel using either the nationally recognized SSL protocol or the standard SSL protocol, achieving end-to-end communication through SSL VPN technology.

[0004] The end-to-end communication technology in related technologies lacks security, and the SSL VPN technology does not fully manage user permissions when implementing end-to-end communication, making it difficult to meet the security of communication between mobile office workers in mobile office scenarios. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a VPN device communication method, apparatus, device and storage medium, which can expand the application scenarios of SSL VPN technology, meet the end-to-end communication needs based on SSL VPN technology, coordinate complete user authority management, and improve the communication security and reliability between mobile office personnel in mobile office scenarios, thereby greatly improving office efficiency.

[0006] In a first aspect, an embodiment of the present disclosure provides a VPN device communication method, which adopts the following technical solution:

[0007] receiving an encrypted request message sent by a first client, wherein the first request message carries a first physical IP address and a first virtual IP address of the first client, the first virtual IP address representing a communication address of the first client in an SSL tunnel used for data communication between the first client and a VPN device;

[0008] When the first client is authenticated according to the first physical IP address, decrypting the request message;

[0009] Determining a second virtual IP address according to the first virtual IP address obtained by decryption, and determining a second client corresponding to the second virtual IP address;

[0010] When the second client and the first client belong to the same group and the second client is online, encrypting the request message and sending the message to the second client;

[0011] Receive the encrypted response message returned by the second client in response to the request message, and send the response message to the first client.

[0012] In some embodiments, verifying the first client according to the first physical IP address includes:

[0013] Searching, based on the first physical IP address, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device;

[0014] When an SSL tunnel based on the SSL protocol is established between the first client and the VPN device, it is confirmed that the first client has passed verification.

[0015] In some embodiments, the method further comprises:

[0016] receiving a connection request from the first client, and recording the first physical IP address of the first client carried in the connection request;

[0017] An SSL tunnel is established between the first client and the VPN device based on the SSL protocol according to the first physical IP address.

[0018] In some embodiments, the method further comprises:

[0019] Allocating a first virtual IP address for the first client from a preset address pool, which does not conflict with the first physical IP address;

[0020] Searching the group to which the first client belongs and at least one other client in the group through a hash table;

[0021] The first virtual IP address is sent to at least one other client in the group, and the second physical IP address of at least one other client in the group is sent to the first client.

[0022] In some embodiments, the method further comprises:

[0023] When device offline information of at least one of the first client or the second client is detected, the device offline information is sent to at least one other client in the group;

[0024] The hash table is updated according to the device offline information.

[0025] In some embodiments, when the second client and the first client belong to the same group and the second client is online, encrypting the request message and sending it to the second client includes:

[0026] When the second client is online, obtaining a connection handle between the VPN device and the second client;

[0027] Encrypting the request message by using an encryption function;

[0028] The encrypted request message is sent to the second client through the connection handle.

[0029] In a second aspect, the embodiments of the present disclosure further provide a VPN device communication apparatus, which adopts the following technical solution:

[0030] a message receiving unit configured to receive an encrypted request message sent by a first client, wherein the first request message carries a first physical IP address and a first virtual IP address of the first client, the first virtual IP address representing a communication address of the first client in an SSL tunnel used for data communication between the first client and the VPN device;

[0031] a verification unit, configured to decrypt the request message when the first client is verified successfully according to the first physical IP address;

[0032] a determining unit configured to determine a second virtual IP address based on the first virtual IP address obtained by decryption, and to determine a second client corresponding to the second virtual IP address;

[0033] a first sending unit configured to, when the second client and the first client belong to the same group and the second client is online, encrypt the request message and send the encrypted message to the second client;

[0034] The second sending unit is configured to receive the encrypted response message returned by the target client in response to the request message, and send the response message to the first client.

[0035] In some embodiments, the verification unit includes:

[0036] a search module configured to search, based on the first physical IP address, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device;

[0037] The confirmation module is configured to confirm that the first client has passed verification when an SSL tunnel based on the SSL protocol is established between the first client and the VPN device.

[0038] In a third aspect, the present disclosure also provides an electronic device that employs the following technical solution:

[0039] The electronic device comprises:

[0040] at least one processor; and,

[0041] a memory communicatively connected to the at least one processor; wherein,

[0042] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform any of the above VPN device communication methods.

[0043] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above VPN device communication methods.

[0044] The embodiments of the present disclosure provide a VPN device communication method, apparatus, device, and storage medium. The method receives an encrypted request message sent by a first client, verifies the first client according to a first physical IP address, decrypts the request message if the verification is successful, determines a second virtual IP address based on the decrypted first virtual IP address, and determines a second client corresponding to the second virtual IP address. When the second client belongs to the same group as the first client and the second client is online, the method encrypts the request message and sends it to the second client. The method receives an encrypted response message returned by the target client in response to the request message, and sends the response message to the first client. This expands the use scenarios of SSL VPN technology, meets the end-to-end communication requirements based on SSL VPN technology, coordinates complete user authority management, improves the communication security and reliability between mobile office personnel in mobile office scenarios, and greatly improves office efficiency.

[0045] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A flow chart of a VPN device communication method provided in an embodiment of the present disclosure;

[0048] Figure 2 A schematic diagram of the structure of a VPN device communication device provided in an embodiment of the present disclosure;

[0049] Figure 3 A schematic diagram of the structure of another VPN device communication device provided in an embodiment of the present disclosure;

[0050] Figure 4 A block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0051] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0052] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0053] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0054] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0055] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0056] like Figure 1 As shown, the embodiment of the present disclosure provides a VPN device communication method, which is executed on the VPN device side and includes the following steps:

[0057] S101. A VPN device receives an encrypted request message sent by a first client, wherein the first request message carries a first physical IP address and a first virtual IP address of the first client. The first virtual IP address represents a communication address of the first client in an SSL tunnel. The SSL tunnel is used for data communication between the first client and the VPN device.

[0058] S102: When the VPN device successfully verifies the first client according to the first physical IP address, the VPN device decrypts the request message.

[0059] Optionally, the VPN device decrypts the request message through a decryption function. The user can select the decryption function according to actual needs, and the embodiment of the present disclosure does not limit this.

[0060] S103: The VPN device determines a second virtual IP address according to the first virtual IP address obtained by decryption, and determines a second client corresponding to the second virtual IP address according to the first virtual IP address obtained by decryption.

[0061] S104: When the VPN device determines that the second client and the first client belong to the same group and the second client is online, the VPN device encrypts the request message and sends it to the second client.

[0062] Optionally, when the VPN device determines that the first client and the second client belong to different groups, the request message may be discarded without processing; or when the VPN device determines that the second client is offline, the request message may be discarded without processing.

[0063] S105. The VPN device receives the encrypted response message returned by the second client in response to the request message, and sends the response message to the first client.

[0064] Optionally, after receiving the request message, the second client decrypts the request message through a decryption function, confirms based on the decrypted request message that the request message is the message sent by the first client, then encrypts the reply message through an encryption function, and sends the encrypted reply message to the VPN device, which sends the reply message to the first client.

[0065] In some embodiments, the above step S102, verifying the first client according to the first physical IP address, includes:

[0066] The VPN device searches, based on the first physical IP address, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device;

[0067] When an SSL tunnel based on the SSL protocol is established between the first client and the VPN device, the VPN device confirms that the first client has passed authentication.

[0068] In the embodiment of the present disclosure, in order to ensure that data communication between the first client and the second client is carried out in the SSL tunnel, when an access request is received from the first client or the second client, it is necessary to verify whether an SSL tunnel is established between the first client or the second client and the VPN device to ensure the security of data communication.

[0069] In some embodiments, the VPN device communication further includes:

[0070] The VPN device receives a connection request from the first client and records the first physical IP address of the first client carried in the connection request;

[0071] The VPN device establishes an SSL tunnel between the first client and the VPN device based on the SSL protocol according to the first physical IP address.

[0072] In the embodiment of the present disclosure, when the VPN device detects a connection request from the first client, it establishes an SSL tunnel based on the SSL protocol through the first physical IP address sent by the first client to ensure that data communication between the VPN device and the first client is completed in the SSL tunnel, thereby ensuring the security of data transmission between the VPN device and the first client.

[0073] In some embodiments, the VPN device communication method further includes:

[0074] The VPN device allocates a first virtual IP address for the first client from a preset address pool, which does not conflict with the first physical IP address;

[0075] The VPN device searches the group to which the first client belongs and at least one other client in the group through a hash table;

[0076] The VPN device sends the first virtual IP address to at least one other client in the group, and sends the second physical IP address of at least one other client in the group to the first client.

[0077] In the disclosed embodiment, when a first client goes online, it initiates a connection request to the VPN device. After the VPN device successfully establishes an SSL tunnel with the first client, the VPN device assigns a first virtual IP address to the first client, which the first client uses as its intranet communication address. Furthermore, the VPN device pushes the first virtual IP address of the first client to other clients in the group, and pushes the IP addresses of other clients in the group to the first client.

[0078] Optionally, the VPN device updates the device online information of the first client in the hash table, and updates the first virtual IP address of the first client in the hash table, so as to ensure the timeliness of information update of all clients in the group.

[0079] In some embodiments, the VPN device communication method further includes:

[0080] When the VPN device detects that at least one of the first client or the second client has logged off, the VPN device sends the offline information to at least one other client in the group;

[0081] The VPN device updates the hash table based on the device offline information.

[0082] In the embodiment of the present disclosure, when a user goes offline, all users in the group are traversed, and the offline information of the offline user's device is pushed to other users in the group to ensure that the information of all users in the group is correct.

[0083] In some embodiments, when the second client and the first client belong to the same group and the second client is online, the VPN device encrypts the request message and sends it to the second client, including:

[0084] When the second client is online, obtaining a connection handle between the VPN device and the second client;

[0085] The VPN device encrypts the request message through an encryption function;

[0086] The VPN device sends the encrypted request message to the second client through the connection handle.

[0087] Optionally, the user may select an encryption function to encrypt and encapsulate the request message according to actual needs, which is not limited in the embodiments of the present disclosure.

[0088] In some embodiments, the first virtual IP address of the first client for communication in the intranet can be set to 1.1.1.1, and the second virtual IP address of the second client for communication in the intranet can be set to 1.1.1.2. The first client sends a request message from the first virtual IP address 1.1.1.1 to the second virtual IP address 1.1.1.2 of the second client. The first client first encapsulates the request message through an encryption function. The source address of the encrypted request message is the first physical IP address 2.2.2.1 of the first client, and the destination IP address is the gateway address 3.3.3.2 of the VPN device in the SSL tunnel.

[0089] When the VPN device receives the encrypted request message from the first client, it obtains the first physical IP address 2.2.2.1 of the first client in the request message. When it is determined that an SSL tunnel has been established between the first client and the VPN device, it sends the request message to the decryption function for decryption processing.

[0090] The VPN device obtains the decrypted request message, obtains the first virtual IP address 1.1.1.1 of the first client, searches the hash table for the group to which the first virtual IP address 1.1.1.1 belongs, and obtains the second virtual IP address 1.1.1.2 in the group, and determines the destination user to which the first client wants to send the request message, that is, the second client.

[0091] The VPN device confirms whether the second client is online. If the second client is not online, the VPN device discards the request message without processing. If the second client is online, the VPN device obtains the connection handle between the second client and the VPN device.

[0092] The VPN device sends the request message to the encryption function for encryption. The source IP address of the encrypted request message is changed to the gateway address 3.3.3.2 of the VPN device, and the destination IP address is changed to the second physical IP address 4.4.4.2 of the second client.

[0093] Since the VPN device has obtained the connection handle of the second client, the VPN device sends the encrypted request message to the second client corresponding to the second physical IP address 4.4.4.2 through the connection handle.

[0094] The second client receives the request message and first decrypts it using a decryption function. If it confirms that it is the message sent by the first client, it will send a response message to the VPN device to complete the interaction. The response message also needs to be encrypted by the second client before being sent to the VPN device.

[0095] During the interaction between the first client and the second client, all data is encrypted.

[0096] like Figure 2 As shown, the embodiment of the present disclosure further provides a VPN device communication apparatus, executed on the VPN device side, comprising:

[0097] The message receiving unit 21 is configured to receive, as the VPN device, an encrypted request message sent by the first client, wherein the first request message carries a first physical IP address and a first virtual IP address of the first client, the first virtual IP address representing a communication address of the first client in an SSL tunnel used for data communication between the first client and the VPN device;

[0098] The verification unit 22 is configured to decrypt the request message when the VPN device verifies the first client according to the first physical IP address;

[0099] The determining unit 23 is configured to determine, by the VPN device, a second virtual IP address based on the first virtual IP address obtained by decryption, and determine a second client corresponding to the second virtual IP address;

[0100] The first sending unit 24 is configured to encrypt the request message and send it to the second client when the VPN device confirms that the second client and the first client belong to the same group and the second client is online;

[0101] The second sending unit 25 is configured as a VPN device to receive the encrypted response message returned by the target client in response to the request message, and send the response message to the first client.

[0102] like Figure 3 As shown, in some embodiments, the verification unit 22 includes:

[0103] The search module 231 is configured to search, by the VPN device, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device according to the first physical IP address;

[0104] The confirmation module 232 is configured to, when an SSL tunnel based on the SSL protocol is established between the first client and the VPN device, confirm that the VPN device has passed the verification of the first client.

[0105] The disclosed embodiments expand the use scenarios of SSL VPN technology, meet the end-to-end communication needs based on SSL VPN technology, coordinate and complete user authority management, improve the communication security and reliability between mobile office workers in mobile office scenarios, and significantly improve office efficiency.

[0106] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc.

[0107] The processor can be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and can control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the VPN device communication method described in the various embodiments of the present disclosure.

[0108] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0109] like Figure 4 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 4 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0110] like Figure 4 As shown, an electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0111] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device allows the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 4 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0112] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the VPN device communication method of the embodiment of the present disclosure are performed.

[0113] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0114] According to an embodiment of the present disclosure, a computer-readable storage medium stores non-transitory computer-readable instructions, which, when executed by a processor, execute all or part of the steps of the VPN device communication method of each embodiment of the present disclosure.

[0115] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0116] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0117] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0118] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0119] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0120] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0121] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0122] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0123] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A VPN device communication method, characterized in that: include: receiving an encrypted request message sent by a first client, wherein the request message carries a first physical IP address and a first virtual IP address of the first client, wherein the first physical IP address represents a communication address of the first client in an SSL tunnel used for data communication between the first client and a VPN device; When the first client is authenticated according to the first physical IP address, decrypting the request message; Determining a second client corresponding to the second virtual IP address based on the first virtual IP address and the second virtual IP address obtained by decryption; When the second client and the first client belong to the same group and the second client is online, encrypting the request message and sending the message to the second client; receiving an encrypted response message returned by the second client in response to the request message, and sending the response message to the first client; The method further comprises: Allocating a first virtual IP address for the first client from a preset address pool, which does not conflict with the first physical IP address; Searching the group to which the first client belongs and at least one other client in the group through a hash table; The first virtual IP address is sent to at least one other client in the group, and the second virtual IP address of at least one other client in the group is sent to the first client.

2. The VPN device communication method according to claim 1, wherein: Verifying the first client according to the first physical IP address includes: Searching, based on the first physical IP address, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device; When an SSL tunnel based on the SSL protocol is established between the first client and the VPN device, it is confirmed that the first client has passed verification.

3. The VPN device communication method according to claim 1, wherein: The method further comprises: receiving a connection request from the first client, and recording the first physical IP address of the first client carried in the connection request; An SSL tunnel is established between the first client and the VPN device based on the SSL protocol according to the first physical IP address.

4. The VPN device communication method according to claim 1, wherein: The method further comprises: When device offline information of at least one of the first client or the second client is detected, the device offline information is sent to at least one other client in the group; The hash table is updated according to the device offline information.

5. The VPN device communication method according to claim 1, wherein: When the second client and the first client belong to the same group and the second client is online, encrypting the request message and sending the message to the second client includes: When the second client is online, obtaining a connection handle between the VPN device and the second client; Encrypting the request message by using an encryption function; The encrypted request message is sent to the second client through the connection handle.

6. A VPN device communication device, characterized in that: include: a message receiving unit configured to receive an encrypted request message sent by a first client, wherein the request message carries a first physical IP address and a first virtual IP address of the first client, the first physical IP address representing a communication address of the first client in an SSL tunnel used for data communication between the first client and the VPN device; a verification unit, configured to decrypt the request message when the first client is verified successfully according to the first physical IP address; a determining unit configured to determine a second client corresponding to the second virtual IP address based on the first virtual IP address and the second virtual IP address obtained by decryption; a first sending unit configured to, when the second client and the first client belong to the same group and the second client is online, encrypt the request message and send the encrypted message to the second client; A second sending unit is configured to receive an encrypted response message returned by the second client in response to the request message, and send the response message to the first client; The VPN device communication device is further used for: Allocating a first virtual IP address for the first client from a preset address pool, which does not conflict with the first physical IP address; Searching the group to which the first client belongs and at least one other client in the group through a hash table; The first virtual IP address is sent to at least one other client in the group, and the second virtual IP address of at least one other client in the group is sent to the first client.

7. The VPN device communication apparatus according to claim 6, wherein: The verification unit includes: a search module configured to search, based on the first physical IP address, whether an SSL tunnel based on the SSL protocol is established between the first client and the VPN device; The confirmation module is configured to confirm that the first client has passed verification when an SSL tunnel based on the SSL protocol is established between the first client and the VPN device.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the VPN device communication method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the VPN device communication method according to any one of claims 1 to 5.

Images