A network connection method and apparatus

Abstract

This invention discloses a network connection method and apparatus, relating to the field of communications, and solves the problem of difficult virtual private network (VPN) connections. The network connection method includes: receiving a connection request sent by a target terminal device, the connection request containing the physical address of the target terminal device, the target terminal device accessing the network via a wireless access device; verifying whether the target terminal device has permission to connect to the target VPN based on the physical address of the target terminal device, and obtaining a verification result; if the verification result indicates that the target terminal device has permission to connect to the target VPN, retrieving a first IP address from the address pool of the target VPN, and sending the first IP address to the target terminal device; the first IP address is used by the target terminal device to connect to the target VPN.

Description

Technical Field

[0001] This invention relates to the field of communications, and more particularly to a network connection method and apparatus. Background Technology

[0002] With the development of computer technology, Virtual Private Networks have been widely used.

[0003] However, because Virtual Private Networks (VPNs) require terminal devices to connect with a fixed IP address (Internet Protocol Address), it presents a problem for these devices to access VPNs. Terminal devices accessing the network via wired connections can connect with a fixed IP address, but the deployment of wired lines is limited by construction costs and installation conditions, making widespread adoption difficult. Terminal devices accessing the network via wireless connections are often assigned IP addresses randomly and dynamically, which does not meet the access requirements of VPNs.

[0004] Therefore, how to more easily access virtual private networks has become an urgent technical problem to be solved. Summary of the Invention

[0005] This invention provides a network connection method and apparatus to solve the problem of how terminal devices can access a virtual private network.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a network connection method applied to a server, comprising: receiving a connection request sent by a target terminal device, the connection request containing the physical address of the target terminal device, the target terminal device accessing a network through a wireless access device; verifying whether the target terminal device has permission to connect to a target private network based on the physical address of the target terminal device, and obtaining a verification result; if the verification result indicates that the target terminal device has permission to connect to the target private network, retrieving a first IP address from the address pool of the target private network, and sending the first IP address to the target terminal device; the first IP address is used by the target terminal device to connect to the target private network.

[0008] Optionally, the server connects to a user database containing the physical addresses of terminal devices with permission to connect to the target private network. Based on the physical address of the target terminal device, the server verifies whether the target terminal device has permission to connect to the target private network and obtains the verification result, including: querying whether the physical address of the target terminal device exists in the user database; if the physical address of the target terminal device exists in the user database, obtaining the verification result that the target terminal device has permission to connect to the target private network.

[0009] Optionally, the user database also contains user authentication information to verify whether the target terminal device has the permission to connect to the target private network. It also includes: if the physical address of the target terminal device does not exist in the user database, pushing a user authentication information verification interface to the target terminal device; receiving the user authentication information of the target terminal device sent by the target terminal device, and verifying whether the user authentication information of the target terminal device exists in the user database.

[0010] If the user authentication information of the target terminal device exists in the user database, a verification result is obtained indicating that the target terminal device has the permission to connect to the target private network.

[0011] Optionally, the network connection method further includes: if the physical address of the target terminal device does not exist in the user database, and a verification result is obtained that the target terminal device has the permission to connect to the target private network, then the physical address of the target terminal device is saved to the user database.

[0012] Optionally, the user database also contains network identifiers corresponding to terminal devices with access to the target private network, and the network identifiers point to the target private network to which the terminal devices have access. Before retrieving the first IP address from the address pool of the target private network, the network connection method further includes: determining the target private network to which the target terminal devices have access based on the network identifiers corresponding to the target terminal devices in the user database.

[0013] Optionally, after sending the first IP address to the target terminal device, the network connection method further includes: determining the first IP address as an IP address that cannot be allocated in the address pool of the target private network; and determining the first IP address as an IP address that can be allocated in the address pool of the target private network when the target terminal device stops using the first IP address.

[0014] The network connection method provided in this application allows the server to receive connection requests sent by a target terminal device through a wireless access device and verify the connection permissions of the target terminal device. Once the target terminal device passes the permission verification, it can be assigned a first IP address from the target private network address pool. This satisfies the requirement of the target private network for trusted IP addresses under the premise of dynamic address allocation via wireless transmission. Dynamic IP address allocation also allows for better utilization of IP address resources, meeting the dynamic access needs of the target private network with fewer IP addresses.

[0015] In similar technologies, terminal devices need to use trusted IP addresses to access VPNs, and these trusted IP addresses typically do not change. However, wireless connections usually assign IP addresses to terminal devices randomly and dynamically. Therefore, wireless connections often cannot meet the requirements for accessing VPNs. The network connection method provided in this application, based on dynamically assigned addresses, assigns the target terminal device the first IP address from the target VPN address pool—that is, the trusted IP address of the target VPN—after the server verifies the target terminal device's permissions. When the target terminal device accesses the network wirelessly via a wireless access device, this resolves the contradiction between the terminal device being dynamically assigned an IP address via wireless connection and the target VPN only allowing access via trusted IP addresses.

[0016] Compared to similar technologies that require wired connections to access the target private network, the network connection method provided in this application enables terminal devices that access the network wirelessly to also access the target private network. This eliminates the need to lay physical lines at all connection sites and is not limited by the laying conditions of physical lines or existing optical cable resources. As a result, the target terminal device can access the target private network by setting up a wireless access device wherever there is a network.

[0017] If the physical address of the target terminal device does not exist in the user database, the server will perform a second authentication check on the target terminal device. Once the target terminal device passes the second authentication check, its physical address will be saved in the user database. Therefore, the target terminal device will not need to re-enter user authentication information for authentication the next time it connects to the target private network. For users, this eliminates the need for authentication, reducing operational steps and improving user experience.

[0018] In addition, this application can also determine the target private network corresponding to the target terminal device, so the network connection method provided by this application is also applicable to multiple private networks.

[0019] Secondly, the present invention provides a network connection method applied to a target terminal device, comprising: establishing a connection with a wireless access device; broadcasting a connection request through the wireless access device so that a server receives and verifies whether the target terminal device has permission to connect to a target private network, the connection request containing the physical address of the target terminal device; if the target terminal device has permission to connect to the target private network, receiving a first IP address sent by the server; the first IP address being an address retrieved from the address pool of the target private network; and connecting to the target private network using the first IP address as the IP address.

[0020] Optionally, the server connects to a user database containing the physical addresses of terminal devices with permission to connect to the target private network; if the physical address of the target terminal device exists in the user database, then the target terminal device has permission to connect to the target private network.

[0021] Optionally, the user database also contains user authentication information of terminal devices with permission to connect to the target private network; if the physical address of the target terminal device does not exist in the user database, before receiving the first IP address sent by the server, the network connection method further includes: receiving the user authentication information verification interface pushed by the server; receiving the input user authentication information of the target terminal device and sending the user authentication information of the target terminal device to the server; if the user authentication information of the target terminal device exists in the user database, the target terminal device passes the verification and has permission to connect to the target private network.

[0022] Optionally, the network connection method also includes: stopping the use of the first IP address and disconnecting from the target private network.

[0023] The network connection method provided in this application decouples the device establishing a tunnel with the network from the device establishing a connection with the dedicated network. The target terminal device can use a first IP address to access the dedicated network through the wireless access device that has established a tunnel with the network. For users, the network connection method provided in this application only requires connecting to the wireless access device to access the target dedicated network. No parameter configuration related to the target dedicated network is required. Only during the first connection may user authentication information be required. After that, users can directly connect to the target dedicated network after connecting to the wireless access device. This eliminates cumbersome parameter configuration and connection operations, making access to the target dedicated network simpler and faster, and improving the user experience.

[0024] Thirdly, the present invention provides a network connection device, comprising:

[0025] The request receiving module is used to receive connection requests sent by the target terminal device. The connection request contains the physical address of the target terminal device, and the target terminal device accesses the network through a wireless access device.

[0026] The information verification module is used to verify whether the target terminal device has the permission to connect to the target private network based on the physical address of the target terminal device, and obtain the verification result.

[0027] The address allocation module is used to retrieve a first IP address from the address pool of the target private network and send it to the target terminal device when the verification result indicates that the target terminal device has permission to connect to the target private network. The first IP address is used by the target terminal device to connect to the target private network.

[0028] Fourthly, the present invention provides a network connection device, comprising:

[0029] The signal connection module is used to establish a connection with wireless access devices.

[0030] The data transmission module is used to broadcast connection requests via wireless access devices, so that the server can receive and verify whether the target terminal device has the permission to connect to the target private network. The connection request contains the physical address of the target terminal device.

[0031] The data receiving module is used to receive a first IP address sent by the server when the target terminal device has permission to connect to the target private network; the first IP address is an address retrieved from the address pool of the target private network.

[0032] The signal connection module is also used to connect to the target private network using the first IP address as the IP address.

[0033] For a detailed description of the third to fourth aspects and their various implementations in this application, please refer to the detailed descriptions in the first to second aspects and their various implementations; and for a detailed analysis of the beneficial effects of the third to fourth aspects and their various implementations in the first to second aspects and their various implementations, please refer to the beneficial effect analysis in the first to second aspects and their various implementations, which will not be repeated here.

[0034] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a schematic diagram of the system architecture of the network connection method in the embodiments of this application;

[0037] Figure 2 This is a schematic diagram of the computing device included in the basic physical structure of the server 101 and terminal device 102 in the embodiments of this application;

[0038] Figure 3 This is a flowchart illustrating the network connection method on the server side in this application embodiment;

[0039] Figure 4This is a flowchart illustrating the process of verifying whether the target terminal device 102 has the permission to connect to the target private network and obtaining the verification result in this embodiment of the application.

[0040] Figure 5 This is a flowchart illustrating the network connection method on the target terminal device side in this application embodiment;

[0041] Figure 6 This is a schematic diagram of the structure of a network connection device according to an embodiment of this application;

[0042] Figure 7 This is a schematic diagram of another network connection device in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0045] This application provides a network connection method and apparatus, which can be applied to, for example... Figure 1 The system architecture shown includes a server 101, a target terminal device 102, and a wireless access device 103. The server 101 is connected to or included in a network. The target terminal device 102 is connected to the wireless access device 103 and accesses the network through the wireless access device 103, thereby communicating with the server 101.

[0046] Specifically, the target terminal device 102 can be connected to the wireless access device 103 via a wired or wireless connection.

[0047] It should be noted that this application does not limit the number of server 101, target terminal device 102, and wireless access device 103 in the system architecture. Figure 1 The following example illustrates a server 101, a target terminal device 102, and a wireless access device 103.

[0048] In one possible embodiment, server 101 may receive a connection request sent by target terminal device 102. Server 101 may also verify whether target terminal device 102 has permission to connect to the target private network based on the connection request, and obtain a verification result. Further, if target terminal device 102 has permission to connect to the target private network, the server will send a first IP address to target terminal device 102, the first IP address being retrieved from the address pool of the target private network.

[0049] Optionally, server 101 may determine the first IP address sent to target terminal device 102 as an unassignable IP address in the address pool of the target private network. Server 101 may also determine the first IP address as an assignable IP address in the address pool of the target private network when the target terminal device 102 stops using the first IP address.

[0050] The target terminal device 102 can broadcast a connection request to the server 101 via the wireless access device 103. This connection request includes the physical address (MediaAccessControlAddress, MAC address) of the target terminal device 102. If the target terminal device 102 has permission to connect to the target private network, the target terminal device 102 will receive the first IP address sent by the server 101 and connect to the target private network using the first IP address.

[0051] Wireless access device 103 can establish a connection with the edge router of the core network in the network according to the L2TP protocol (Layer 2 Tunneling Protocol) to transmit all data sent by the target terminal device 102.

[0052] In one possible embodiment, the system architecture of the network connection method in this application embodiment further includes a user database 104, which is connected to a server 101.

[0053] Data in user database 104 can be retrieved by server 101.

[0054] Optionally, the user database 104 contains the physical addresses of terminal devices that have permission to connect to the target private network. The physical addresses of the terminal devices in the user database 104 can be used by the server 101 to verify whether the target terminal device 102 has permission to connect to the target private network.

[0055] Optionally, the user database 104 may also contain user authentication information of terminal devices with permission to connect to the target private network. This user authentication information may be used by the server 101 to verify whether the target terminal device 102 has permission to connect to the target private network.

[0056] Optionally, there can be one or more target private networks, which are contained within a network. The user database 104 also contains network identifiers corresponding to terminal devices with access to the target private networks. These network identifiers point to the target private networks for which the terminal devices have access, and can be used by the server 101 to determine which target private networks the target terminal device 102 has access to before retrieving the first IP address from the address pool of the target private networks.

[0057] In one possible embodiment, server 101 includes user database 104.

[0058] The server 101 in this embodiment can be a rack server, blade server, tower server, or cabinet server, and the deployment method can be a single integrated type, a cluster type, or a distributed type. This embodiment does not impose any restrictions on this.

[0059] The terminal device 102 in this application embodiment can be a mobile phone, desktop computer, tablet computer, laptop computer, handheld computer, wearable electronic device, handheld computer, Ultra-mobile Personal Computer (UMPC), netbook and other electronic devices. This application embodiment does not impose any restrictions on this.

[0060] The wireless access device 103 can be a wireless router, a 4G / 5G wireless access device, or other wireless connection device. This application embodiment does not impose any restrictions on this.

[0061] Server 101 and terminal device 102 have similar basic physical structures, both including Figure 2 The components included in the computing device shown. The following are examples... Figure 2 Taking the computing device shown as an example, the physical structure of server 101 and terminal device 102 will be introduced.

[0062] like Figure 2 As shown, the computing device may include a processor 201, a memory 202, a communication interface 203, and a bus 204. The processor 201, the memory 202, and the communication interface 203 can be connected via the bus 204.

[0063] Processor 201 is the control center of the computing device. It can be a single processor or a collective term for multiple processing elements. For example, processor 201 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0064] As one embodiment, processor 201 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 are shown in the diagram.

[0065] The memory 202 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0066] In one possible implementation, the memory 202 can exist independently of the processor 201. The memory 202 can be connected to the processor 201 via a bus 204 and is used to store instructions or program code. When the processor 201 calls and executes the instructions or program code stored in the memory 202, it can implement the model deployment method provided in the embodiments of this application.

[0067] In this embodiment, the software programs stored in the memory 202 of the server 101 and the terminal device 102 are different, and they implement different functions. The functions performed by each device will be described with reference to the following flowchart.

[0068] In another possible implementation, the memory 202 can also be integrated with the processor 201.

[0069] The communication interface 203 is used for connecting the computing device to other devices via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 203 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0070] Bus 204 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0071] It should be pointed out that, Figure 2 The structure shown does not constitute a limitation on the computing device, except Figure 2 In addition to the components shown, the computing device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0072] like Figure 3 As shown, this application provides a network connection method applied to a server, for example, applied to... Figure 1 The server shown in the figure may include the following steps S301 to S303.

[0073] S301: Received a connection request from the target terminal device. The connection request contains the physical address of the target terminal device. The target terminal device accesses the network through the wireless access device.

[0074] The target terminal device can access the network through a wireless access device. When the wireless access device first accesses the network, it will be assigned a fixed IP address by the network. Therefore, the wireless access device can act as a gateway for the target terminal device, enabling it to also access the network.

[0075] In one possible implementation, the target terminal device can use an RJ45-based connector or cable to connect to the wireless access device.

[0076] In another possible implementation, the target terminal device connects to the wireless access device via a Wi-Fi signal sent by the wireless access device.

[0077] For example, the target terminal device connects to a wireless access device via a wired or wireless connection. The wireless access device then establishes a connection with the network wirelessly and sends a connection request to the server. Furthermore, the server can receive the connection request sent by the target terminal device after it connects to the network; this connection request contains the target terminal device's physical address, i.e., its MAC address.

[0078] S302: Based on the physical address of the target terminal device, verify whether the target terminal device has the permission to connect to the target private network, and obtain the verification result.

[0079] S303: If the verification result indicates that the target terminal device has permission to connect to the target private network, retrieve the first IP address from the address pool of the target private network and send the first IP address to the target terminal device. The first IP address is used to enable the target terminal device to connect to the target private network.

[0080] Generally, connecting to a VPN requires verifying the source address of the connection end; that is, the connection end usually needs to use a fixed and trusted IP address to access the VPN.

[0081] In this application, the target private network is the aforementioned virtual private network, and the source address of the connection is the IP address of the target terminal device requesting to connect to the target private network. The target terminal device does not yet have an IP address and needs it to be assigned one by the server.

[0082] When the server verifies that the target terminal device has permission to connect to the target private network, the server retrieves a first IP address from the target private network's address pool and sends it to the target terminal device. Since the first IP address is an address in the target private network's address pool, it is a trusted IP address of the target private network. Therefore, the target terminal device can use the first IP address to connect to the target private network after verifying the source address.

[0083] As can be seen from the above embodiments, in the network connection method provided in this application, the server receives a connection request sent by the target terminal device and verifies whether the target terminal device has permission to access the target private network. If the target terminal device has permission to connect to the target private network, the first IP address sent by the server enables the target terminal device to connect to the target private network.

[0084] In similar technologies, terminal devices need to use trusted IP addresses to access VPNs, and these trusted IP addresses typically do not change. However, wireless connections usually assign IP addresses to terminal devices randomly and dynamically. Therefore, wireless connections often cannot meet the requirements for accessing VPNs. The network connection method provided in this application, based on dynamically assigned addresses, assigns the target terminal device the first IP address from the target VPN address pool—that is, the trusted IP address of the target VPN—after the server verifies the target terminal device's permissions. When the target terminal device accesses the network wirelessly via a wireless access device, this resolves the contradiction between the terminal device being dynamically assigned an IP address via wireless connection and the target VPN only allowing access via trusted IP addresses.

[0085] Compared to similar technologies that require wired connections to access the target private network, the network connection method provided in this application enables terminal devices that access the network wirelessly to also access the target private network. This eliminates the need to lay physical lines at all connection sites and is not limited by the laying conditions of physical lines or existing optical cable resources. As a result, the target terminal device can access the target private network by setting up a wireless access device wherever there is a network.

[0086] In one possible embodiment, the server connects to a user database containing the physical addresses of terminal devices with permissions to connect to the target private network. For example... Figure 4 As shown, based on the physical address of the target terminal device, the system verifies whether the target terminal device has permission to connect to the target private network, and obtains the verification result, which may include S3021 to S3022:

[0087] S3021: Query whether the physical address of the target terminal device exists in the user database.

[0088] S3022: If the physical address of the target terminal device exists in the user database, obtain the verification result that the target terminal device has the permission to connect to the target private network.

[0089] Since the physical address of a terminal device is a distinctive identifier for the terminal device, it can be used to verify whether the terminal device has permission to access the target private network.

[0090] For example, if the physical address of the target terminal device is "CC-85-E2-00-6A-E2", then the system will query the user database to see if "CC-85-E2-00-6A-E2" exists. If "CC-85-E2-00-6A-E2" exists, then the target terminal device has permission to connect to the target private network.

[0091] As can be seen from the above embodiments, when the physical address of the target terminal device exists in the user database, the target terminal device only needs to send a connection request containing its own physical address to trigger the server to verify the target terminal device. For the user, when the physical address of the target terminal device exists in the user database and the target terminal device accesses the network through a wireless access device, the network connection method provided in this application can achieve "instant connection," meaning that as long as the target terminal device connects to the wireless access device, it can access the target private network. Compared with similar technologies, the network connection method provided in this application not only verifies the target terminal device but also eliminates the tedious manual verification operation for the user each time, making it convenient for users to access the target private network and improving the user experience.

[0092] In one possible embodiment, the user database also contains user authentication information for a terminal device that has access to the target private network. Verifying whether the target terminal device has permission to connect to the target private network further includes steps S3023 to S3025:

[0093] S3023: If the physical address of the target terminal device does not exist in the user database, push the user verification information verification interface to the target terminal device.

[0094] If the physical address of the target terminal device does not exist in the user database, then the target terminal device may be a terminal device without permission to connect to the target private network, or the target terminal device may be a terminal device with permission to connect to the target private network, but its physical address has not yet been stored in the user database. Therefore, further verification is needed to determine whether the target terminal device has permission to connect to the target private network.

[0095] S3024: Receive user authentication information sent by the target terminal device and verify whether the user authentication information of the target terminal device exists in the user database.

[0096] For example, if the physical address of the target terminal device does not exist in the user database, the server pushes a user authentication information interface to the target terminal device. This interface includes input boxes where the user can enter authentication information. The server receives the authentication information from the target terminal device's input boxes and compares it with the target terminal device's authentication information in the user database.

[0097] In one possible embodiment, the user authentication information is a username and password. However, the user authentication information can also be other information, such as a verification code. The use of a username and password as user authentication information in this embodiment is merely an example and does not constitute a practical limitation on this application.

[0098] S3025: If the user authentication information of the target terminal device exists in the user database, obtain the verification result that the target terminal device has the permission to connect to the target private network.

[0099] As can be seen from the above embodiments, the network connection method provided in this application can further verify whether the target terminal device has the ability to connect to the target private network through user authentication information when the physical address of the target terminal device does not exist in the user database.

[0100] In one possible embodiment, if the physical address of the target terminal device does not exist in the user database, and the verification result shows that the target terminal device has the permission to connect to the target private network, then the physical address of the target terminal device is saved to the user database.

[0101] As can be seen, when the physical address of the target terminal device does not exist in the user database, and the target terminal device has the permission to connect to the target private network after verification with user authentication information, the user database will save the physical address of the target terminal device. Thus, after the target terminal device sends a connection request again, it does not need to be verified again with user authentication information; the server can directly determine that it is a terminal device with the permission to connect to the target private network. For the user, user authentication information is only required the first time accessing the target private network; subsequent accesses do not require this operation. This achieves the effect described above, where simply connecting to a wireless device allows connection to the target private network, thus improving the user experience.

[0102] In one possible embodiment, the user database further includes network identifiers corresponding to terminal devices with access to the target private network, the network identifiers pointing to the target private network to which the terminal device has access. Before retrieving the first IP address from the address pool of the target private network, the network connection method further includes: determining the target private network to which the target terminal device has access based on the network identifiers corresponding to the target terminal device in the user database.

[0103] For example, the target terminal device has permission to connect to the target private network. In the user database, the network identifier corresponding to the target terminal device points to private network A. Therefore, the server identifies private network A as the target private network for the target terminal device. Further, the server retrieves a first IP address from the address pool of network A and sends this first IP address to the target terminal device.

[0104] As can be seen from the above embodiments, the network connection method provided in this application, after verifying that the target terminal device has the authority to connect to the target private network, further determines which specific private network corresponds to the target terminal device. Furthermore, by assigning an IP address from the address pool of the corresponding target private network to the target terminal device, the target terminal device is enabled to access the corresponding target private network. Thus, the network connection method provided in this application can be used with multiple private networks and only requires one server for verifying the terminal device's authority.

[0105] In one possible embodiment, after sending the first IP address to the target terminal device, the network connection method further includes: determining the first IP address as an IP address that cannot be allocated in the address pool of the target private network. When the target terminal device stops using the first IP address, the first IP address is determined as an IP address that can be allocated in the address pool of the target private network.

[0106] It should be understood that IP addresses are limited, and at any given time, an IP address can only be used by one network device. Terminal devices accessing the network via wireless connections are highly mobile, and generally, they obtain IP addresses dynamically, meaning they are only assigned an IP address when they need to access the network.

[0107] After the server assigns the first IP address to the target terminal device, the first IP address cannot be used by other terminal devices. Therefore, the server will designate the first IP address as an unassignable IP address in the address pool of the target private network. When the target terminal device stops using the first IP address, the first IP address can be used by other terminal devices, and the server will designate the first IP address as an assignable IP address.

[0108] As can be seen, this application dynamically allocates IP addresses using the above method, enabling target terminal devices to access the target private network while ensuring that addresses in the target private network's address pool are allocated on demand, preventing any single terminal device from occupying them for an extended period. In this way, a smaller number of IP addresses can meet the dynamically changing connection needs of the target private network.

[0109] As can be seen from the above embodiments, the network connection method provided in this application allows the server to receive a connection request sent by the target terminal device through a wireless access device and verify the connection permission of the target terminal device. Once the target terminal device passes the permission verification, it can be allocated a first IP address from the target private network address pool. Under the premise of dynamically allocating addresses via wireless transmission, this satisfies the requirement of the target private network for trusted IP addresses. Dynamically allocating IP addresses also allows for better utilization of IP address resources, satisfying the dynamic access needs of the target private network with fewer IP addresses.

[0110] If the physical address of the target terminal device does not exist in the user database, the server will perform a second authentication check on the target terminal device. Once the target terminal device passes the second authentication check, its physical address will be saved in the user database. Therefore, the target terminal device will not need to re-enter user authentication information for authentication the next time it connects to the target private network. For users, this eliminates the need for authentication, reducing operational steps and improving user experience.

[0111] In addition, this application can also determine the target private network corresponding to the target terminal device, so the network connection method provided by this application is also applicable to multiple private networks.

[0112] like Figure 5 As shown, this application provides a network connection method applied to a target terminal device, such as... Figure 1The target terminal device 102 shown in the figure may include the following steps S501 to S504.

[0113] S501: Establishes a connection with a wireless access device.

[0114] S502: A connection request is broadcast via a wireless access device so that the server can receive and verify whether the target terminal device has permission to connect to the target private network. The connection request contains the physical address of the target terminal device.

[0115] Since the target terminal device has not yet been assigned an IP address, it can only communicate using 0.0.0.0 as its IP address. However, since normal communication cannot be achieved using 0.0.0.0, and the target terminal device does not have the address of a server that can assign it an IP address, the target terminal device will broadcast a connection request to the network through a wireless access device. This connection request contains the physical address of the target terminal device.

[0116] In one possible implementation, the wireless access device and the edge router of the core network in the network establish a connection based on the L2TP protocol (Layer 2 Tunneling Protocol).

[0117] It should be understood that during data transmission, a transmission path is found based on the source and destination IP addresses. Once a path is found, the source physical address carried in the data frame points to the target terminal device, and the destination physical address points to the gateway, i.e., the wireless access device. Subsequently, the data frame changes according to the changes in the transmitting and receiving routers at each hop. Therefore, the data frame ultimately received at the destination IP address does not carry the physical address of the target terminal device pointed to by the source IP address, but rather the physical address of the previous network transmission device.

[0118] The L2TP protocol can establish point-to-point tunnel transmission, using the original data as payload data and then encapsulating it with L2TP and PPP headers. The encapsulated L2TP and PPP headers are used to indicate the data transmission, so that the source physical address carried by the payload data is not changed during transmission.

[0119] In this way, the data transmitted from the wireless access device can carry the physical address of the target terminal device, which is more secure and reliable than directly sending the physical address of the target terminal device.

[0120] S503: If the target terminal device has permission to connect to the target private network, it receives the first IP address sent by the server. The first IP address is an address retrieved from the address pool of the target private network.

[0121] S504: Connect to the target private network using the first IP address as the IP address.

[0122] For example, if the target terminal device has permission to connect to the target private network, it can receive the first IP address "116.179.33.144" retrieved by the server from the address pool of the target private network. The target terminal device responds to the server's acceptance of this address and uses the first IP address "116.179.33.144" as its IP address to connect to the target private network.

[0123] As can be seen from the above embodiments, in the network connection method provided by this application, after the target terminal device connects to the network through the wireless access device, it only needs to send a connection request carrying the hardware address, and after verification, it can obtain the first IP address and connect to the target private network.

[0124] The target terminal device uses a wireless connection, which eliminates the problem of wired line laying and allows it to access the target private network in any network-enabled environment via a wireless access device.

[0125] In addition, this application decouples the device establishing the tunnel from the device ultimately accessing the target private network. The tunnel is established using a wireless access device, while the final target terminal device obtains an IP address from the target private network's address pool and connects to the target private network. In this way, when accessing the target private network, only the wireless access device needs to configure parameters corresponding to the target private network connection, while the target terminal device only needs to connect to the wireless access device, eliminating the need for complex configuration and simplifying the user's access to the target private network.

[0126] In one possible embodiment, the server connects to a user database containing the physical addresses of terminal devices with permission to connect to the target private network. If the physical address of the target terminal device exists in the user database, then the target terminal device has permission to connect to the target private network.

[0127] In one possible embodiment, the user database further contains user authentication information for terminal devices with permission to connect to the target private network. If the physical address of the target terminal device does not exist in the user database, before receiving the first IP address sent by the server, the network connection method further includes: receiving a user authentication information verification interface pushed by the server; receiving the input user authentication information of the target terminal device and sending the user authentication information of the target terminal device to the server; if the user authentication information of the target terminal device exists in the user database, the target terminal device passes the authentication and has permission to connect to the target private network.

[0128] As can be seen from the above embodiments, this application provides two verifications of connection permissions for the target terminal device. When the physical address of the target terminal device exists in the user database, the target terminal device has access permission. When the physical address of the target terminal device does not exist in the user database, further verification of connection permissions can be performed through a verification interface pushed by the server. The first verification allows terminal devices whose physical addresses exist in the user database to quickly and conveniently connect to the target private network, while the second verification allows terminal devices whose physical addresses do not exist in the user database to connect to the target private network after verification.

[0129] In one possible embodiment, an address from the target network address pool can be used to route within the network according to a policy, connecting to the target private network.

[0130] Traditional routing table forwarding can only make decisions and provide routes based on the destination address of the data, while policy-based routing can make decisions and provide routes based on characteristics such as source address, destination address, source port, destination port, and protocol, offering greater flexibility. When the routing table of the target private network is complex, or when the target private network has multiple entry and exit points, and it is necessary to control access to different services, applications, and terminal devices, policy-based routing is more suitable.

[0131] For example, a target private network has two data entry and exit points, destination port A and destination port B, requiring the target terminal device to access the target private network through destination port A. Therefore, when the target terminal device searches for a route to access the target private network, it will obtain the corresponding route path A, and the target terminal device will connect to destination port A of the target private network through route path A.

[0132] Of course, there are other configuration methods for policy routing, such as configuring the routing path between the target terminal device and the target private network based on load balancing. The use of the destination port to make decisions and provide routing in this embodiment is only an example and does not constitute an actual limitation on this application.

[0133] In one possible embodiment, the network connection method further includes: ceasing to use the first IP address and disconnecting from the target private network.

[0134] There are several dynamic address allocation methods. For example, the allocated IP address may have a usage period, and the usage rights will be revoked if the lease is not renewed upon expiration. Alternatively, the allocated IP address may be revoked upon disconnection.

[0135] For example, when the target terminal device's use of the first IP address expires, the target terminal device will no longer have the right to use the first IP address, the connection with the target private network will be disconnected, and the first IP address will be reclaimed by the server.

[0136] As can be seen from the above embodiments, the network connection method provided in this application decouples the device establishing a tunnel with the network from the device establishing a connection with the dedicated network. The target terminal device can use a first IP address to access the dedicated network through the wireless access device that establishes a tunnel with the network. For users, the network connection method provided in this application only requires connecting to the wireless access device to access the target dedicated network. No parameter configuration related to the target dedicated network is required. Only during the first connection may user authentication information be required. After that, users can directly connect to the target dedicated network by connecting to the wireless access device, eliminating cumbersome parameter configuration and connection operations, making access to the target dedicated network simpler and faster, and improving the user experience.

[0137] like Figure 6 As shown, in some embodiments, a network connection device provided in this application may include:

[0138] The request receiving module 601 is used to receive a connection request sent by the target terminal device. The connection request contains the physical address of the target terminal device, and the target terminal device accesses the network through a wireless access device.

[0139] The information verification module 602 is used to verify whether the target terminal device has the permission to connect to the target private network based on the physical address of the target terminal device, and obtain the verification result.

[0140] The address allocation module 603 is used to retrieve a first IP address from the address pool of the target private network when the verification result indicates that the target terminal device has the permission to connect to the target private network, and send the first IP address to the target terminal device. The first IP address is used by the target terminal device to connect to the target private network.

[0141] In one possible embodiment, the server connects to a user database containing the physical addresses of terminal devices with permission to connect to the target private network. The information verification module 602 is specifically used to: query whether the physical address of the target terminal device exists in the user database; if the physical address of the target terminal device exists in the user database, obtain a verification result indicating that the target terminal device has permission to connect to the target private network.

[0142] In one possible embodiment, the user database further includes user authentication information. The information verification module 602 is further configured to: push a user authentication information verification interface to the target terminal device if the physical address of the target terminal device does not exist in the user database; receive user authentication information sent by the target terminal device and verify whether the user authentication information of the target terminal device exists in the user database; if the user authentication information of the target terminal device exists in the user database, obtain a verification result that the target terminal device has the permission to connect to the target private network.

[0143] In one possible embodiment, the information verification module 602 is further configured to: if the physical address of the target terminal device does not exist in the user database, and a verification result is obtained that the target terminal device has the permission to connect to the target private network, then save the physical address of the target terminal device to the user database.

[0144] In one possible embodiment, the user database further includes network identifiers corresponding to terminal devices with access to the target private network, the network identifiers pointing to the target private network to which the terminal device has access. The address allocation module 603 is further configured to: before retrieving the first IP address from the address pool of the target private network, determine the target private network to which the target terminal device has access, based on the network identifiers corresponding to the target terminal device in the user database.

[0145] In one possible embodiment, the address allocation module 603 is further configured to: after sending the first IP address to the target terminal device, determine the first IP address as an IP address that cannot be allocated in the address pool of the target private network; and when the target terminal device stops using the first IP address, determine the first IP address as an IP address that can be allocated in the address pool of the target private network.

[0146] like Figure 7 As shown, in some embodiments, a network connection device provided in this application may include:

[0147] The signal connection module 701 is used to establish a connection with a wireless access device.

[0148] The data transmission module 702 is used to broadcast a connection request through a wireless access device, so that the server can receive and verify whether the target terminal device has the permission to connect to the target private network. The connection request contains the physical address of the target terminal device.

[0149] The data receiving module 703 is used to receive a first IP address sent by the server when the target terminal device has the permission to connect to the target private network. The first IP address is an address taken from the address pool of the target private network.

[0150] The signal connection module 701 is also used to connect to the target private network using the first IP address as the IP address.

[0151] In one possible embodiment, the server connects to a user database containing the physical addresses of terminal devices with permission to connect to the target private network. If the physical address of the target terminal device exists in the user database, then the target terminal device has permission to connect to the target private network.

[0152] In one possible embodiment, the user database also contains user authentication information for terminal devices with permission to connect to the target private network. If the physical address of the target terminal device does not exist in the user database, before receiving the first IP address sent by the server, the data receiving module 703 is further configured to: receive the user authentication information verification interface pushed by the server; receive the input user authentication information of the target terminal device and send the user authentication information of the target terminal device to the server; if the user authentication information of the target terminal device exists in the user database, the target terminal device passes the authentication and has permission to connect to the target private network.

[0153] In one possible embodiment, the signal connection module 701 is further configured to: stop using the first IP address and disconnect from the target private network.

[0154] This application also provides a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps in the above method embodiments.

[0155] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a readable storage medium (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of readable storage medium in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0156] An embodiment of this application provides a computer program product stored in a non-volatile storage medium, which is executed by at least one processor to implement the steps shown in the above method embodiments.

[0157] In the above embodiments, implementation can be achieved entirely or partially through software, physical means, firmware, or any combination thereof. When implemented using software programs, it can be implemented entirely or partially in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a readable storage medium or transmitted from one readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0158] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0159] Since the devices, readable storage media, and computer program products in the embodiments of this application can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0160] It should be noted that the above-mentioned units can be separate processors, or they can be integrated into a processor of the controller. Alternatively, they can be stored in the controller's memory as program code, and called and executed by a processor of the controller. The processor mentioned here can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0161] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0162] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in an electronic and physical manner, or a combination of computer software and electronic and physical methods. Whether these functions are implemented physically or in software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0163] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling, direct coupling, or communication connections shown or discussed may be implemented through interfaces, and these interface connections may be electrical, mechanical, or other forms.

[0165] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0167] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network connection method characterized by, The application is applied to a server, comprising: receiving a connection request sent by a target terminal device, wherein the connection request contains a physical address of the target terminal device, and the target terminal device accesses a network through a wireless access device; inquiring whether the physical address of the target terminal device exists in a user database, wherein the user database contains physical addresses of terminal devices having a permission to connect a target private network, user authentication information and network identifiers, the server is connected with the user database, and the network identifier points to the target private network to which the terminal device has a connection permission; if the physical address of the target terminal device exists in the user database, obtaining a verification result that the target terminal device has a permission to connect the target private network; if the physical address of the target terminal device does not exist in the user database, pushing a user authentication information verification interface to the target terminal device; receiving user authentication information of the target terminal device sent by the target terminal device, and verifying whether the user authentication information of the target terminal device exists in the user database; if the user authentication information of the target terminal device exists in the user database, obtaining a verification result that the target terminal device has a permission to connect the target private network; if the verification result is that the target terminal device has a permission to connect the target private network, taking a first IP address from an address pool of the target private network, and sending the first IP address to the target terminal device, wherein the first IP address is used for the target terminal device to connect to the target private network, the target terminal device uses the first IP address to access the target private network through the wireless access device which establishes a tunnel with the network, and the wireless access device is connected with the network through an L2TP protocol.

2. The network connection method according to claim 1, wherein, The method further comprises: if the physical address of the target terminal device does not exist in the user database, and a verification result that the target terminal device has a permission to connect the target private network is obtained, saving the physical address of the target terminal device into the user database.

3. The network connection method according to claim 2, wherein The user database further contains network identifiers corresponding to the terminal devices having a permission to connect the target private network, and the network identifier points to the target private network to which the terminal device has a connection permission; Before the first IP address is taken from the address pool of the target private network, the method further comprises: determining the target private network to which the target terminal device has a connection permission according to the network identifier corresponding to the target terminal device in the user database.

4. The network connection method of claim 1, wherein, After the first IP address is sent to the target terminal device, the method further comprises: determining the first IP address as an IP address in the address pool of the target private network which cannot be allocated; when the target terminal device stops using the first IP address, determining the first IP address as an IP address in the address pool of the target private network which can be allocated.

5. A network connection method characterized by, The application is applied to a target terminal device, comprising: establishing a connection with a wireless access device; The wireless access device broadcasts a connection request, so that a server receives and verifies whether the target terminal device has a permission to connect to a target private network, wherein the connection request contains a physical address of the target terminal device; the server is connected to a user database; the user database contains physical addresses of terminal devices having the permission to connect to the target private network, user verification information and network identifiers; the network identifiers point to the target private networks to which the terminal devices have the permission to connect; If the physical address of the target terminal device exists in the user database, the target terminal device has the permission to connect to the target private network; If the physical address of the target terminal device does not exist in the user database, before receiving a first IP address sent by the server, a user verification information verification interface pushed by the server is received; After receiving inputted user verification information of the target terminal device, the user verification information of the target terminal device is sent to the server; if the user verification information of the target terminal device exists in the user database, the target terminal device is verified, and the target terminal device has the permission to connect to the target private network; If the target terminal device has the permission to connect to the target private network, a first IP address sent by the server is received; the first IP address is an address taken from an address pool of the target private network; The target terminal device is connected to the target private network by using the first IP address; the target terminal device accesses the target private network by using the first IP address and the wireless access device which establishes a tunnel with the network; the wireless access device is connected to the network by using an L2TP protocol.

6. The network connection method according to claim 5, wherein, The method further comprises: The target terminal device is disconnected from the target private network by stopping using the first IP address.

7. A network connection device, characterized by The method further comprises: A request receiving module is configured to receive a connection request sent by a target terminal device, wherein the connection request contains a physical address of the target terminal device, and the target terminal device accesses a network by using a wireless access device; An information verifying module is configured to query whether the physical address of the target terminal device exists in a user database; the user database contains physical addresses of terminal devices having a permission to connect to a target private network, user verification information and network identifiers; a server is connected to the user database; the network identifiers point to the target private networks to which the terminal devices have the permission to connect; The information verifying module is further configured to obtain a verification result that the target terminal device has the permission to connect to the target private network if the physical address of the target terminal device exists in the user database; The information verifying module is further configured to push a user verification information verification interface to the target terminal device if the physical address of the target terminal device does not exist in the user database. The information verification module is further configured to receive the user verification information of the target terminal device sent by the target terminal device, and verify whether the user verification information of the target terminal device exists in the user database. If the user verification information of the target terminal device exists in the user database, a verification result that the target terminal device has the permission to connect to the target private network is obtained. The address allocation module is configured to, when the verification result is that the target terminal device has the permission to connect to the target private network, take a first IP address from an address pool of the target private network, and send the first IP address to the target terminal device; the first IP address is used by the target terminal device to connect to the target private network through the wireless access device that establishes a tunnel with the network. The target terminal device accesses the target private network through the wireless access device that establishes a tunnel with the network by using the first IP address. The wireless access device is connected to the network through an L2TP protocol.

8. A network connection device, characterized by The signal connection module is configured to establish a connection with a wireless access device. The data sending module is configured to broadcast a connection request through the wireless access device, so that a server receives and verifies whether a target terminal device has the permission to connect to a target private network; the connection request contains a physical address of the target terminal device; the server is connected to a user database; the user database contains the physical address, user verification information, and network identifier of a terminal device that has the permission to connect to the target private network. The network identifier points to the target private network to which the terminal device has the permission to connect. If the physical address of the target terminal device exists in the user database, the target terminal device has the permission to connect to the target private network. The data sending module is further configured to, if the physical address of the target terminal device does not exist in the user database, receive a user verification information verification interface pushed by the server before receiving a first IP address sent by the server. The data sending module is further configured to receive input user verification information of the target terminal device, and send the user verification information of the target terminal device to the server; if the user verification information of the target terminal device exists in the user database, the target terminal device is verified, and the target terminal device has the permission to connect to the target private network. The data receiving module is configured to, when the target terminal device has the permission to connect to the target private network, receive the first IP address sent by the server. The first IP address is an address taken from an address pool of the target private network. The signal connection module is further configured to connect to the target private network by using the first IP address as an IP address; the target terminal device accesses the target private network through the wireless access device that establishes a tunnel with the network by using the first IP address. The wireless access device is connected to the network through an L2TP protocol. ​

Images