Data transmission method, electronic device, computer readable medium and program product

Abstract

The present disclosure provides a data transmission method, comprising: in response to an address resolution protocol (ARP) request message from a source end, checking whether an IPSEC tunnel state is normal; in the case that the IPSEC tunnel state is normal, blocking ARP broadcast; sending an ARP response message to the source end, wherein the ARP response message carries a MAC address of a VPN device; and transmitting data from the source end to a target end through the IPSEC tunnel. The present disclosure also provides an electronic device, a computer readable medium and a computer program product. The present disclosure adopts a transparent access and bypass deployment mode to realize data encryption and redundancy on a dedicated line basis without changing the original network topology of a user. This reduces the impact on the original network and reduces operation and maintenance costs and work. Data is encrypted and transmitted through an IPsec tunnel, and even when the IPsec tunnel is abnormal, data can still be forwarded through the original dedicated line, ensuring the continuous operation of services and the continuity of communication.

Description

Technical Field

[0001] This disclosure relates to the field of data security technology, and in particular to a data transmission method, an electronic device, a computer-readable medium, and a computer program product. Background Technology

[0002] As businesses grow, they face higher demands for internal data transmission, primarily involving networking between headquarters and branches. In such cases, it is typically necessary to connect headquarters and branches in different locations to a unified wide area network (WAN) to achieve data sharing and collaborative work. Businesses usually achieve this by using common technologies such as SDWAN (Software-Defined Wide Area Network) and leased lines.

[0003] Once a company's network infrastructure has stabilized, expansion due to data security needs typically requires modifications to the existing network topology and configuration. These modifications may include adding new devices, adjusting network layout, and updating configuration parameters, all of which consume time and resources. Such changes can also increase network maintenance costs, as additional human and material resources are needed to manage and maintain the new network architecture. Therefore, when expanding a network, companies need to comprehensively consider factors such as cost, efficiency, and security to ensure the stability and reliability of the new network. Summary of the Invention

[0004] This disclosure provides a data transmission method, an electronic device, a computer-readable medium, and a computer program product.

[0005] In a first aspect, embodiments of this disclosure provide a data transmission method, including:

[0006] In response to an Address Resolution Protocol (ARP) request message from the source, check whether the IPSEC tunnel status is normal;

[0007] If the IPSEC tunnel is in a normal state, execute:

[0008] Block ARP broadcasts;

[0009] Send an ARP response message to the source end, wherein the ARP response message carries the MAC address of the VPN device;

[0010] Data from the source end is transmitted to the target end through the IPSEC tunnel.

[0011] In some embodiments, the data transmission method further includes performing the following in the event of an abnormal IPSEC tunnel state:

[0012] Allow the ARP broadcast;

[0013] The data from the source end is transmitted to the target end via the existing dedicated line.

[0014] In some embodiments, the VPN device is configured at the source end and the target end of the existing leased line through transparent access and bypass deployment, respectively.

[0015] In some embodiments, the IPSEC tunnel is established between the source VPN device and the target VPN device.

[0016] In some embodiments, transmitting data from the source end to the target end via an IPSEC tunnel further includes:

[0017] The data is encrypted;

[0018] The encrypted data is transmitted to the target terminal through the IPSEC tunnel.

[0019] In some embodiments, before checking whether the IPSEC tunnel status is normal, the method further includes:

[0020] Check the VPN device status;

[0021] When the VPN device is in an abnormal state, enable bypass mode;

[0022] When the VPN device is in normal status, check whether the IPSEC tunnel status is normal.

[0023] In some embodiments, the source is a branch and the target is a headquarters, or the source is a headquarters and the target is a branch.

[0024] In a second aspect, embodiments of this disclosure provide an electronic device, including:

[0025] One or more processors;

[0026] A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to implement the data transmission method described in the first aspect of the present disclosure.

[0027] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method described in the first aspect of embodiments of this disclosure.

[0028] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the data transmission method described in the first aspect of this disclosure.

[0029] Fifthly, embodiments of this disclosure provide a VPN device, including: a tunnel status checking module, configured to respond to an Address Resolution Protocol (ARP) request message from a source end to check whether the IPSEC tunnel status is normal; a normal status management module, configured to block ARP broadcast when the IPSEC tunnel status is normal; send an ARP response message to the source end, wherein the ARP response message carries the MAC address of the VPN device; and transmit data from the source end to the target end through the IPSEC tunnel.

[0030] In some embodiments, the VPN device further includes: an abnormal state management module, used to allow the ARP broadcast in the event of an abnormal IPSEC tunnel state; and to transmit data from the source end to the target end via the existing leased line.

[0031] In some embodiments, the VPN device further includes a device deployment module, configured to control the VPN device to be configured at the source and destination ends of the existing leased line through transparent access and bypass deployment methods, respectively.

[0032] In some embodiments, the VPN device further includes a tunnel establishment module for establishing the IPSEC tunnel between the source VPN device and the target VPN device.

[0033] In some embodiments, the normal state management module further includes an encryption module for encrypting data transmitted through the IPSEC tunnel.

[0034] In some embodiments, the VPN device further includes a device status checking module, configured to check the VPN device status before checking whether the IPSEC tunnel status is normal, and to enable bypass mode when the VPN device status is abnormal.

[0035] In some embodiments, the source is a branch and the target is a headquarters, or the source is a headquarters and the target is a branch.

[0036] This disclosure demonstrates how transparent access and bypass deployment achieve data encryption and redundancy on a dedicated line without altering the user's existing network configuration and topology. Data is encrypted and transmitted via an IPsec tunnel, and even in the event of an IPsec tunnel failure, data can still be forwarded through the existing dedicated line, ensuring continuous service operation and communication continuity. Even if the primary communication path experiences an anomaly or failure, the backup path can continue to guarantee data transmission, preventing data loss or interruption. Data encryption and redundancy can be implemented simply by configuring new access devices, without requiring large-scale changes to the entire network architecture. This simplifies the deployment process and improves deployment efficiency. Based on tunnel status, ARP broadcasts can be blocked, effectively improving network security and preventing potential attacks and information leakage risks. Attached Figure Description

[0037] Figure 1 This is a flowchart of a data transmission method according to an embodiment of the present disclosure.

[0038] Figure 2 It is the network topology of the original leased line network.

[0039] Figure 3 This is the network topology for the data transmission method according to an embodiment of this disclosure.

[0040] Figure 4 This is a schematic diagram of the composition of an electronic device according to an embodiment of this disclosure.

[0041] Figure 5 This is a block diagram of a VPN device according to an embodiment of the present disclosure. Detailed Implementation

[0042] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions of this disclosure will be described in detail below with reference to the accompanying drawings.

[0043] Exemplary embodiments will be described more fully below with reference to the accompanying drawings; however, these exemplary embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will enable those skilled in the art to fully understand the scope of this disclosure.

[0044] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0045] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0046] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded.

[0047] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0048] This disclosure aims to effectively protect data without altering the existing network topology and configuration. It ensures reliable data transmission by providing backup paths. In this way, users can rely on backup paths to ensure secure data transmission while maintaining the network structure, thus improving the overall reliability and stability of the system.

[0049] This disclosure can be applied to enterprise network expansion scenarios. However, those skilled in the art should understand that this disclosure can also be applied to other scenarios involving data security and network reliability, and the embodiments of this disclosure do not impose special limitations on these scenarios.

[0050] This disclosure provides a method for data transmission without altering existing network configuration and topology. By deploying VPN (Virtual Private Network) devices through transparent access and bypass on a leased line, the original network topology remains unchanged. Data is encrypted via an IPsec tunnel after passing through the VPN device, thus protecting data security. This method ensures that data is not stolen or tampered with by unauthorized access during transmission, improving the confidentiality and integrity of enterprise data. By establishing an IPsec tunnel on the leased line and designing a mechanism to continue forwarding data through the original leased line even in the event of an IPsec (Internet Protocol Security) tunnel failure, this technical solution improves network reliability and stability. Even in the event of an IPsec tunnel failure, data can still be transmitted smoothly, ensuring the continuity and availability of the enterprise network. Furthermore, only the new access device needs to be configured, reducing maintenance costs and impact on the existing network.

[0051] Transparent access means that the deployment of new devices in the network is seamless and transparent to the existing network and network equipment. They do not change the configuration or functionality of existing network equipment, nor do they affect network routing or traffic paths. This deployment method ensures that the introduction of new devices has no negative impact on the stability of network operation. The advantage of transparent access is that data transmission can be carried out through VPN devices without excessive human intervention or special configuration.

[0052] Bypass deployment means that new devices are deployed alongside existing network paths, rather than being directly inserted into them. This deployment method avoids new devices becoming bottlenecks in network traffic, and if a new device malfunctions or requires maintenance, it can be easily bypassed without interrupting network connectivity. The benefit of bypass deployment is that it allows normal traffic to bypass VPN devices when not being processed by them, thus reducing device load and potential latency.

[0053] In summary, transparent access and bypass deployment are designed to minimize the impact on the existing network when introducing new equipment, maintaining network stability and reliability. By introducing VPN devices and establishing IPsec tunnels on top of the existing network infrastructure using transparent access and bypass deployment, the goal of data encryption and redundancy backup is achieved with minimal disruption to the existing network configuration and topology.

[0054] ARP (Address Resolution Protocol) is a network protocol used to map IP addresses at the network layer to physical addresses (MAC addresses) at the data link layer. In communication within a Local Area Network (LAN), devices need to know the MAC address of the target device to correctly send data packets. When a device knows the IP address of the target device but not its corresponding MAC address, it uses the ARP protocol to query the MAC address. Another core aspect of this disclosure is the ability to control the behavior of the ARP protocol based on tunnel state. This means that the state of the tunnel can be used to decide whether to block or allow ARP requests. This technology can be used to enhance network security and prevent security threats such as ARP spoofing attacks.

[0055] Figure 1 This is a flowchart of a data transmission method according to an embodiment of the present disclosure.

[0056] Firstly, referring to Figure 1 This disclosure provides a data transmission method, including:

[0057] S11. In response to the Address Resolution Protocol (ARP) request message from the source, check whether the IPSEC tunnel status is normal.

[0058] S12. If the IPSEC tunnel is in a normal state, execute:

[0059] Block ARP broadcasts;

[0060] Send an ARP response message to the source end, wherein the ARP response message carries the MAC address of the VPN device;

[0061] Data from the source end is transmitted to the target end through the IPSEC tunnel.

[0062] In this embodiment of the disclosure, the data transmission method further includes performing the following in the event of an abnormal IPSEC tunnel status:

[0063] Allow the ARP broadcast;

[0064] The data from the source end is transmitted to the target end via the existing dedicated line.

[0065] In this disclosure, the ARP protocol's role in the network is to map IP addresses to physical addresses (MAC addresses). In the data transmission method according to embodiments of this disclosure, the VPN device can handle ARP requests based on the IP security tunnel status. If the tunnel status is normal, the VPN device will enable ARP proxy mode, intercepting ARP requests in the branch network and preventing ARP broadcasts in the branch network. The VPN device will reply to ARP requests on behalf of devices in the headquarters network, providing its own MAC address in the reply. In this way, all data is sent to the VPN device. Upon receiving the data, the VPN device forwards it through the IPsec tunnel to complete data transmission. If the tunnel status is abnormal, the VPN device allows ARP requests, allowing devices in the branch network to communicate directly with headquarters through the existing network, instead of through the VPN device and the tunnel. This ensures that communication continues even in the event of tunnel abnormalities, thus guaranteeing communication continuity and reliability.

[0066] In this embodiment of the disclosure, the VPN device is configured at the source end and the target end of the original leased line through transparent access and bypass deployment, respectively.

[0067] In some embodiments, VPN devices are introduced on top of existing leased lines without altering the original network topology and configuration. These VPN devices are integrated into the network transparently, and their bypass deployment means they do not affect existing network traffic paths.

[0068] In this embodiment of the disclosure, the IPSEC tunnel is established between the source VPN device and the target VPN device.

[0069] In this embodiment of the disclosure, transmitting data from the source end to the target end via an IPSEC tunnel further includes:

[0070] The data is encrypted;

[0071] The encrypted data is transmitted to the target terminal through the IPSEC tunnel.

[0072] In some embodiments, when data is transmitted between branches and headquarters, it passes through these configured VPN devices. On these VPN devices, data transmitted over the IPsec tunnel is encrypted to protect its security. Different encryption algorithms (such as AES, DES, 3DES, etc.) can be used to encrypt the data, which is then securely transmitted to its destination via the IPsec tunnel. This effectively prevents data from being stolen or tampered with by unauthorized users during transmission, thus ensuring data confidentiality and integrity.

[0073] Furthermore, although existing encryption algorithms can be used to encrypt data at present, with the continuous development of computer technology and the advancement of cryptanalysis techniques, more secure and efficient new encryption algorithms may emerge in the future. Therefore, those skilled in the art should recognize that these new encryption algorithms are also included within the scope of this disclosure.

[0074] In this embodiment of the disclosure, before checking whether the IPSEC tunnel status is normal, the method further includes:

[0075] Check the VPN device status;

[0076] When the VPN device is in an abnormal state, enable bypass mode;

[0077] When the VPN device is in normal status, check whether the IPSEC tunnel status is normal.

[0078] In this embodiment of the disclosure, the source end is a branch and the target end is a headquarters, or the source end is a headquarters and the target end is a branch.

[0079] In VPN devices, when in bypass mode, the device bypasses certain processing steps or functions and directly transmits data packets to a designated path or device without encryption or other processing. This ensures that data can continue to be transmitted in a certain way even if the device malfunctions or malfunctions, thus ensuring network reliability.

[0080] Figure 2 It is the network topology of the original leased line network.

[0081] Reference Figure 2 In the original network topology, branches and headquarters communicated via dedicated leased lines.

[0082] Specifically, such as Figure 2 As shown, the network connection between the branch and headquarters via dedicated line communication is as follows:

[0083] In the branch offices, business operations are conducted via computer terminals. These computer terminals are connected to a leased line through a unified network device (such as a router or switch).

[0084] At headquarters, multiple business systems are located, including database servers and application servers. These systems are connected to branch offices via dedicated lines for data exchange and communication.

[0085] The communication method is as follows: The branch's internal network connects to the branch network equipment, representing the data flow within the branch network. Then, the branch network equipment connects to the headquarters network equipment, forming a dedicated line for data flow. Data is transmitted from the branch to headquarters via this dedicated line. Finally, the headquarters network equipment connects to the headquarters' internal network, representing the flow of local data at headquarters.

[0086] This type of connection can be used in enterprise networks, especially where secure and reliable communication between branches and headquarters is required. Leased line communication provides high-speed, reliable connections, ensuring efficient data transmission between branches and headquarters, and is one of the typical architectures in enterprise networks.

[0087] Figure 3 This is the network topology for the data transmission method according to an embodiment of this disclosure.

[0088] In this disclosure, in order to implement the data transmission method of the embodiments of this disclosure, it is necessary to... Figure 2 The existing network will be upgraded to meet the following requirements: 1. Data needs to be encrypted for communication; 2. The original topology configuration will not be changed; 3. Redundant data will ensure communication quality.

[0089] Reference Figure 3 In the existing network topology, VPN devices are introduced using transparent access and bypass deployment. The specific network connections after the modification are as follows:

[0090] In the branch network, VPN devices were added between the existing branch network equipment (such as routers or switches) and the leased lines. These VPN devices accessed the branch network in a transparent manner, encrypted the data passing through, and transmitted it to headquarters via IPsec tunnels.

[0091] At headquarters, VPN devices were also added between headquarters network equipment (such as routers or switches) and the leased lines. These VPN devices were deployed in a bypass configuration to decrypt encrypted data transmitted from branches, ensuring data security.

[0092] The communication method is as follows: the branch's internal network connects to the branch network device; the branch network device connects to the branch's VPN device; the branch's VPN device connects to the physical device on the leased line, usually a router or switch; the physical device on the leased line connects to the headquarters network device; the headquarters network device connects to the headquarters VPN device and the headquarters' internal network respectively.

[0093] After passing through the VPN device, data is encrypted and transmitted via an IPsec tunnel, thus protecting data security. If the IPsec tunnel malfunctions, data will continue to be transmitted through the existing leased line, ensuring communication continuity. This upgrade method does not change the original network topology configuration; only the newly connected VPN device needs to be configured, reducing maintenance costs and impact on the existing network.

[0094] The upgraded solution, building upon the existing dedicated line, establishes IPsec tunnels at both branches and headquarters using transparent access and bypass VPN devices respectively, achieving redundant data transmission to ensure communication quality. Even if the primary communication path experiences anomalies or failures, the backup path can continue to ensure data transmission, preventing data loss or interruption. During the upgrade, the original network topology remained unchanged; that is, branches and headquarters are still connected via dedicated lines, without any major alterations to the original network topology. VPN devices were introduced to encrypt data transmission via IPsec tunnels.

[0095] although Figure 3 The diagram illustrates a method of "transparent access to branch VPN devices and bypass deployment of headquarters VPN devices." However, those skilled in the art should understand that, depending on the specific network topology, configuration, management needs, and security requirements, other access methods that can achieve the same purpose can also be selected. This approach can also ensure the effectiveness of data encryption and redundancy protection while minimizing the impact on the existing network.

[0096] Figure 4 This is a schematic diagram of the composition of an electronic device according to an embodiment of this disclosure.

[0097] Secondly, referring to Figure 4 This disclosure provides an electronic device, which includes:

[0098] One or more processors 401;

[0099] The memory 402 stores one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the data transmission method described in the first aspect of the embodiments of this disclosure.

[0100] One or more I / O interfaces 403 are connected between the processor and the memory and configured to enable information exchange between the processor and the memory.

[0101] Among them, processor 401 is a device with data processing capabilities, including but not limited to central processing unit (CPU); memory 402 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); I / O interface (read-write interface) 403 is connected between processor 401 and memory 402, and can realize information interaction between processor 401 and memory 402, including but not limited to data bus (Bus).

[0102] In some embodiments, the processor 401, memory 402, and I / O interface 403 are interconnected via bus 404, and thus connected to other components of the computing device.

[0103] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method described in the first aspect of embodiments of this disclosure.

[0104] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the data transmission method described in the first aspect of this disclosure.

[0105] Figure 5 This is a block diagram of a VPN device according to an embodiment of the present disclosure.

[0106] Fifthly, refer to Figure 5 This disclosure provides a VPN device, including: a tunnel status checking module 501, used to respond to an Address Resolution Protocol (ARP) request message from a source end to check whether the IPSEC tunnel status is normal; a normal status management module 502, used to block ARP broadcast when the IPSEC tunnel status is normal; send an ARP response message to the source end, wherein the ARP response message carries the MAC address of the VPN device; and transmit data from the source end to the target end through the IPSEC tunnel.

[0107] In some embodiments, the VPN device further includes: an abnormal state management module, used to allow the ARP broadcast in the event of an abnormal IPSEC tunnel state; and to transmit data from the source end to the target end via the existing leased line.

[0108] In some embodiments, the VPN device further includes a device deployment module, configured to control the VPN device to be configured at the source and destination ends of the existing leased line through transparent access and bypass deployment methods, respectively.

[0109] In some embodiments, the VPN device further includes a tunnel establishment module for establishing the IPSEC tunnel between the source VPN device and the target VPN device.

[0110] In some embodiments, the normal state management module further includes an encryption module for encrypting data transmitted through the IPSEC tunnel.

[0111] In some embodiments, the VPN device further includes a device status checking module, configured to check the VPN device status before checking whether the IPSEC tunnel status is normal, and to enable bypass mode when the VPN device status is abnormal.

[0112] In some embodiments, the source is a branch and the target is a headquarters, or the source is a headquarters and the target is a branch.

[0113] To enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of this disclosure, the technical solutions provided by the embodiments of this disclosure will be described in detail below through specific embodiments:

[0114] Example 1

[0115] The data transmission method in this disclosure includes the following implementation process:

[0116] When the IPsec tunnel is in normal condition, the detailed steps for branch clients to access headquarters and headquarters to access branch clients are as follows:

[0117] Detailed steps for branch clients to access headquarters:

[0118] Step (1): The branch client sends an access request to the headquarters.

[0119] Step (2): The branch VPN device receives the ARP broadcast from the branch client and checks whether the IPSEC tunnel status is normal. If the IPSEC tunnel status is normal, the branch VPN device blocks the ARP broadcast and enables the ARP proxy function to reply to ARP requests on behalf of the headquarters VPN device.

[0120] In this scenario, branch VPN devices can directly respond to ARP requests from branch clients without forwarding the requests to the headquarters VPN device, thus saving network bandwidth and reducing network latency.

[0121] Step (3): Data sent by the branch client is encrypted in the IPSEC tunnel and then transmitted to the headquarters VPN device. The encryption algorithm used here can be any encryption algorithm supported by any VPN device.

[0122] In this scenario, the branch VPN device acts as the data exit point, and all data flowing through the VPN device is transmitted to headquarters via an IPsec tunnel.

[0123] Step (4): After receiving the encrypted data, the headquarters VPN device decapsulates it and then sends it to the headquarters business system through the core switch.

[0124] Detailed steps for headquarters to access branch clients:

[0125] Step (5): Headquarters sends an ARP broadcast request to access the branch client.

[0126] Step (6): The headquarters VPN device receives an ARP broadcast request from the business system and checks the IPSEC tunnel status. If the IPSEC tunnel status is normal, the headquarters VPN device blocks the ARP broadcast, enables the ARP proxy function, and replies.

[0127] Step (7): Data sent from headquarters is encrypted in the IPSEC tunnel and then transmitted to the branch VPN device.

[0128] Step (8): After receiving the encrypted data, the branch VPN device decrypts it and then sends the data to the branch client.

[0129] The steps above describe the complete process of branch clients accessing headquarters and headquarters accessing branch clients when the tunnel is in normal working order.

[0130] When the IPSEC tunnel status is abnormal, the detailed steps for branch clients to access headquarters and headquarters to access branch clients are as follows:

[0131] Detailed steps for branch clients to access headquarters:

[0132] Step (1): The branch client sends an access request to the headquarters.

[0133] Step (2): The branch VPN device receives the ARP broadcast request from the client and checks whether the IPSEC tunnel status is normal. If the IPSEC tunnel status is abnormal, the branch VPN device allows the ARP broadcast.

[0134] Step (3): Due to the abnormal status of the IPSEC tunnel, data communication is no longer encrypted through the IPSEC tunnel, but is directly forwarded to the headquarters business system through the dedicated line.

[0135] Detailed steps for headquarters to access branch clients:

[0136] Step (4): The headquarters sends an ARP broadcast request to the branch.

[0137] Step (5): After receiving the ARP broadcast request, the headquarters VPN device checks whether the IPSEC tunnel status is normal. If the IPSEC tunnel status is abnormal, the headquarters VPN device allows the ARP broadcast.

[0138] Step (6): Data communication is forwarded through a dedicated line to reach branch users.

[0139] The steps above describe the complete process of branch clients accessing headquarters and headquarters accessing branch clients when the tunnel status is abnormal.

[0140] Implementation process when VPN device status is abnormal:

[0141] When the IPsec tunnel becomes abnormal, the VPN device will enter bypass mode. In bypass mode, the VPN device will stop encrypting data, and the data will no longer be encrypted through the IPsec tunnel but will be forwarded directly through the dedicated line. The "bypass mode" refers to the VPN device switching to a mode that bypasses the normal encryption channel when the IPsec tunnel becomes abnormal, allowing data to be forwarded directly through the existing dedicated line.

[0142] In this scenario, the dedicated line transmits data to the target device, bypassing the path through the IPsec tunnel, thus ensuring data transmission.

[0143] Example 2

[0144] The data transmission method in this embodiment can be implemented using the following specific steps:

[0145] 1. Adopt transparent access and bypass deployment methods, and configure source VPN devices and target VPN devices at the source and target ends respectively;

[0146] 2. Establish an IP security tunnel between the source VPN device and the target VPN device for secure encrypted data transmission and communication;

[0147] 3. The source initiates a communication request to the target to request the establishment of a communication connection.

[0148] 4. The source VPN device receives ARP requests from the source and checks the status of the IP security tunnel with the target.

[0149] 5. If the IP security tunnel is in normal condition, the source VPN device enables the ARP proxy function to block ARP broadcasts at the source, and the data is transmitted from the source to the target after being encrypted through the IP security tunnel.

[0150] 6. If the IP security tunnel status is abnormal, the source VPN device allows the source ARP broadcast, and the source data is transmitted to the target through the original network.

[0151] Through the above process, encrypted data transmission and redundancy are achieved, ensuring communication continuity even in the event of tunnel anomalies, while also maintaining the stability of the original network configuration and topology.

[0152] The data encryption and redundancy methods disclosed herein can be applied to many different scenarios and fields, including but not limited to:

[0153] Enterprise network security: It can protect the security of data transmission within an enterprise's internal network and ensure that sensitive information is not obtained by unauthorized personnel.

[0154] Remote work and remote access: Encryption and redundant backup of data transmission when remote employees access the company's internal network.

[0155] Cloud computing environment: Can be deployed in the cloud, ensuring secure and reliable data transmission between the cloud server and the local network.

[0156] Internet of Things (IoT): Applicable to data communication between IoT devices, protecting information transmission between devices.

[0157] Healthcare: Secure encryption and backup for data transmission within healthcare institutions, ensuring the confidentiality and integrity of patient information.

[0158] Financial industry: Used for data transmission encryption and redundant backup within financial institutions' internal networks to ensure the security of customer assets and transaction information.

[0159] Government and military sectors: Secure and redundant backup of data transmission within the internal networks of government agencies and military organizations, protecting the security of critical national information.

[0160] In summary, the methods disclosed herein are applicable to any scenario and field where data transmission security and reliability need to be ensured.

[0161] In the embodiments disclosed herein, the specific implementation steps described above are merely illustrative examples intended to illustrate the data transmission method of this disclosure. Those skilled in the art should understand that these steps can be modified and adjusted in various ways according to specific application scenarios and requirements. For example, data encryption and redundancy methods can be adjusted based on different network topologies, security policy requirements, or performance optimization considerations. Therefore, in practical applications, the method can be flexibly adjusted according to actual conditions to meet specific needs and requirements.

[0162] In this embodiment, data encryption and redundancy are achieved on a leased line using transparent access and bypass deployment without altering the user's existing network configuration and topology. This reduces the impact on the existing network and decreases operation and maintenance costs. According to the method of this disclosure, data encryption and redundancy can be achieved simply by configuring the new access device, without requiring large-scale changes to the entire network architecture. This simplifies the deployment process and improves deployment efficiency. Encrypted data transmission via IPsec tunneling, coupled with a backup path, ensures the security and reliability of data during transmission. Even if the primary communication path experiences anomalies or failures, the backup path can continue to guarantee data transmission, preventing data loss or transmission interruption. Even if the IPsec tunnel malfunctions, data can still be forwarded through the existing leased line, ensuring continuous service operation and communication continuity. ARP broadcasts can be blocked based on the tunnel status, effectively improving network security and preventing potential attacks and information leakage risks.

[0163] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0164] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A data transmission method, applied to VPN devices deployed at the source and destination ends of a communication link, wherein the VPN devices access the communication link in a transparent access and bypass deployment manner, comprising: In response to an Address Resolution Protocol (ARP) request message from the source, the source VPN device checks the IPsec tunnel status with the target VPN device. If the IPSEC tunnel is in a normal state, execute: Block the broadcast of the ARP request message; Send an ARP response message to the source, wherein the ARP response message carries the MAC address of the source VPN device; Data enters the IPSEC tunnel through the source VPN device and is transmitted to the target VPN device; In the event of an abnormal IPSEC tunnel status, execute: The source VPN device allows the broadcast of the ARP request packet; Data from the source end is transmitted to the target end via the existing dedicated line; Both the source VPN device and the target VPN device are configured at both ends of the original leased line in a transparent access and bypass deployment manner, and the network configuration and network topology of the original leased line remain unchanged after the source VPN device and the target VPN device are connected.

2. The data transmission method according to claim 1, wherein, The IPSEC tunnel is established between the source VPN device and the target VPN device.

3. The data transmission method according to any one of claims 1-2, wherein, Data enters the IPSEC tunnel through the source VPN device and is transmitted to the target VPN device, including: The data is encrypted; The encrypted data is transmitted to the target VPN device through the IPSEC tunnel.

4. The data transmission method according to claim 3, wherein, Before the source VPN device checks the IPSEC tunnel status with the target VPN device, the process also includes: Check the device status of the source VPN device; When the source VPN device is in an abnormal state, enable bypass mode; When the source VPN device is in normal condition, perform a check on the IPSEC tunnel status.

5. The data transmission method according to any one of claims 1 to 2, wherein, The source end is a branch and the target end is the headquarters, or the source end is the headquarters and the target end is a branch.

6. An electronic device, comprising: One or more processors; A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to implement the data transfer method according to any one of claims 1 to 5.

7. A computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method according to any one of claims 1 to 5.

8. A computer program product comprising a computer program or instructions that, when executed by a processor, implement the data transmission method according to any one of claims 1 to 5.

Images