Cross-VPN tunnel remote networking method and device, electronic equipment and storage medium

Abstract

The invention belongs to the field of network encryption networking, and particularly discloses a cross-VPN tunnel remote networking method and device, electronic equipment and a storage medium, and the method comprises the steps: starting a negotiation process between first virtual private network (VPN) encryption equipment and second VPN encryption equipment, the first VPN encryption device and the second VPN encryption device exchange routing information, the first VPN encryption device comprises routing information in a first network, and the second VPN encryption device comprises routing information in a second network; the first VPN encryption device issues routing information in the second network to the first network, and the second VPN encryption device issues routing information in the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain comprises an extranet routing domain and an intranet routing domain.

Description

Technical Field

[0001] The present application belongs to the field of network encryption networking, and more specifically, to a method, device, electronic device and storage medium for remote networking across VPN tunnels. Background Art

[0002] When the VPN encryption device in the prior art is working, its internal routing information and external routing information are interconnected, which easily causes the internal routing information to be leaked to the outside. Therefore, the security of the VPN encryption device in the prior art is relatively poor. Summary of the invention

[0003] In view of the defects of the prior art, the purpose of the present application is to provide a method, device, electronic device and storage medium for remote networking across VPN tunnels, aiming to solve the problem of poor security caused by the interconnection between internal routing information and external routing information of VPN encryption devices in the prior art.

[0004] To achieve the above objectives, in a first aspect, the present application provides a method for remote networking across VPN tunnels, comprising:

[0005] A negotiation process is initiated between a first virtual private network VPN encryption device and a second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0006] The first VPN encryption device publishes the routing information inside the second network to the first network, and the second VPN encryption device publishes the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

[0007] This application allows different VPN encryption devices to exchange their respective network routing information through a negotiation process, so that a routing domain is formed inside the interconnected VPN encryption devices and isolated from the external routing domain. The internal and external routing of the VPN encryption device can be separated without affecting the operation of the VPN encryption device, avoiding the leakage of the internal routing of the VPN encryption device to the outside, and significantly improving the security of the VPN encryption device.

[0008] According to a cross-VPN tunnel remote networking method provided by the present invention, the first VPN encryption device is deployed at the exit of the first network, and the second VPN encryption device is deployed at the exit of the second network.

[0009] This application deploys VPN encryption equipment at the network exit, encrypts data leaving the network according to security policies, and decrypts data entering the network according to security policies, thereby improving the security of VPN encryption equipment.

[0010] According to a cross-VPN tunnel remote networking method provided by the present invention, before starting a negotiation process between the first VPN encryption device and the second VPN encryption device, the method further includes:

[0011] The first VPN encryption device obtains routing information inside the first network through a routing protocol, and the second VPN encryption device obtains routing information inside the second network through a routing protocol.

[0012] The VPN encryption device of this application obtains the routing information inside the network through the routing protocol to prepare for the subsequent exchange of routing information.

[0013] According to a cross-VPN tunnel remote networking method provided by the present invention, a negotiation process is initiated between the first VPN encryption device and the second VPN encryption device, including:

[0014] An Internet Key Exchange (IKE) process is initiated between the first VPN encryption device and the second VPN encryption device. In the IKE process, the first VPN encryption device and the second VPN encryption device exchange routing information.

[0015] The first VPN encryption device and the second VPN encryption device respectively combine the routing information inside the first network and the routing information inside the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy.

[0016] The encryption devices in this application exchange routing information through the IKE process, and then combine the routing information of each network to form a security policy, so that the key established by the subsequent negotiation process uses the policy to complete the VPN tunnel establishment.

[0017] According to a cross-VPN tunnel remote networking method provided by the present invention, the first VPN encryption device publishes routing information inside the second network to the first network, including:

[0018] The first VPN encryption device publishes routing information inside the second network to the first network through a routing protocol;

[0019] The second VPN encryption device publishes routing information inside the first network to the second network, including:

[0020] The second VPN encryption device publishes routing information inside the first network to the second network through a routing protocol.

[0021] According to a method for remote networking across VPN tunnels provided by the present invention, the method further includes:

[0022] The first VPN encryption device and the second VPN encryption device isolate the routes of the intranet and the extranet respectively to obtain the extranet routing domain and the intranet routing domain.

[0023] The present application uses VPN encryption devices to isolate the routes of the intranet and the extranet respectively, so that a routing domain is formed inside the interconnected VPN encryption devices and isolated from the external routing domain. The internal and external routes of the VPN encryption devices are separated without affecting the operation of the VPN encryption devices, thereby avoiding the leakage of the internal routes of the VPN encryption devices to the outside, and significantly improving the security of the VPN encryption devices.

[0024] In a second aspect, the present application provides a cross-VPN tunnel remote networking device, comprising:

[0025] A negotiation module, configured to start a negotiation process between a first virtual private network VPN encryption device and a second VPN encryption device, wherein the first VPN encryption device and the second VPN encryption device exchange routing information, wherein the first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network;

[0026] The networking module is used to enable the first VPN encryption device to publish the routing information inside the second network to the first network, and the second VPN encryption device to publish the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

[0027] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the programs stored in the memory are executed, the processor is used to execute the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation of the first aspect.

[0028] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation of the first aspect.

[0029] In a fifth aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation of the first aspect.

[0030] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0031] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art:

[0032] By having different VPN encryption devices exchange their respective network routing information through a negotiation process, a routing domain is formed inside the interconnected VPN encryption devices and isolated from the external routing domain. This allows the internal and external routing of VPN encryption devices to be separated without affecting the operation of the VPN encryption devices, thereby avoiding external leakage of the internal routing of VPN encryption devices and significantly improving the security of VPN encryption devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 It is a flow chart of a remote networking method across VPN tunnels provided in an embodiment of the present application;

[0035] Figure 2 This is a schematic diagram of the principle of remote networking across VPN tunnels provided by an embodiment of the present application;

[0036] Figure 3 It is a working topology diagram of a VPN encryption device provided in an embodiment of the present application;

[0037] Figure 4 It is a flow chart of VPN encryption device interaction provided by an embodiment of the present application;

[0038] Figure 5 It is a structural diagram of a remote networking device across VPN tunnels provided in an embodiment of the present application;

[0039] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0042] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0043] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0044] Next, combine Figure 1-Figure 4 The cross-VPN tunnel remote networking method provided in the embodiment of the present application is introduced.

[0045] Figure 1 : is a flow chart of a remote networking method across VPN tunnels provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0046] Step 100, a negotiation process is initiated between a first virtual private network VPN encryption device and a second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information, the first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network;

[0047] The cross-VPN tunnel remote networking method provided in this application is intended to separate the internal and external routes of a VPN encryption device without affecting the operation of the VPN encryption device, thereby avoiding the external leakage of the internal routes of the VPN encryption device and significantly improving the security of the VPN encryption device. This method is applicable between two or more VPN encryption devices.

[0048] Taking two networks and their corresponding VPN encryption devices as an example, the first network deploys a first VPN encryption device, and the second network deploys a second VPN encryption device. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0049] The first VPN encryption device and the second VPN encryption device are mutually configured with information of devices that communicate with each other. According to the configuration, the first VPN encryption device starts a negotiation process with the second VPN encryption device to exchange routing information within each other's networks.

[0050] Step 110, the first VPN encryption device publishes the routing information inside the second network to the first network, and the second VPN encryption device publishes the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

[0051] After the negotiation process is completed, the first VPN encryption device and the second VPN encryption device respectively publish the routing information inside the other network to their respective networks, so that a routing domain is formed between the two networks. The routing domain includes an external network routing domain and an internal network routing domain, thereby isolating the internal network from the external network, avoiding the leakage of the internal routing of the VPN encryption device to the outside, and significantly improving the security of the VPN encryption device.

[0052] The present application provides a cross-VPN tunnel remote networking method, which enables different VPN encryption devices to exchange their respective network routing information through a negotiation process, so that a routing domain is formed inside the interconnected VPN encryption devices and isolated from the external routing domain. The internal and external routing of the VPN encryption device can be separated without affecting the operation of the VPN encryption device, thereby avoiding the leakage of the internal routing of the VPN encryption device to the outside, and significantly improving the security of the VPN encryption device.

[0053] In some embodiments, the first VPN encryption device in step 100 is deployed at an egress of the first network, and the second VPN encryption device is deployed at an egress of the second network.

[0054] This application deploys VPN encryption equipment at the network exit, encrypts data leaving the network according to security policies, and decrypts data entering the network according to security policies.

[0055] Figure 2 Schematic diagram of remote networking principle across VPN tunnels provided by the embodiment of the present application, such as Figure 2 As shown, in one embodiment of the present application, taking three VPN encryption devices as an example, VPN encryption device 1 is deployed at the exit of network A, VPN encryption device 2 is deployed at the exit of network B, and VPN encryption device 3 is deployed at the exit of network C.

[0056] In some embodiments, before step 100, the method further includes:

[0057] The first VPN encryption device obtains routing information inside the first network through a routing protocol, and the second VPN encryption device obtains routing information inside the second network through a routing protocol.

[0058] Optionally, the present application does not limit the specific routing protocol used, which may be a static routing protocol or a dynamic routing protocol.

[0059] In some embodiments, step 100 specifically includes:

[0060] Step 1001, an Internet key exchange IKE process is initiated between a first VPN encryption device and a second VPN encryption device. In the IKE process, the first VPN encryption device and the second VPN encryption device exchange routing information;

[0061] Step 1002: The first VPN encryption device and the second VPN encryption device respectively combine routing information within the first network and routing information within the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy.

[0062] IKE is a protocol for exchanging and managing encryption keys used in VPNs. The first VPN encryption device or the second VPN encryption device can actively initiate an IKE process with the other party. In the IKE process, the VPN encryption device sends the routing information it obtains to the other party. The recipient combines the received routing information with its own routing information to form a security policy. The key established in the subsequent negotiation process will use this policy, so the VPN tunnel is established between the two VPN encryption devices based on the routing information.

[0063] Figure 3 This is a working topology diagram of the VPN encryption device provided in the embodiment of the present application, such as Figure 3As shown, in one embodiment of the present application, the intercommunication strategy synthesized by VPN encryption device 1 is 1.0.0.1 / 24<->2.0.0.1 / 24, 1.0.0.1 / 24<->2.0.1.1 / 24, 1.0.1.1 / 24<->2.0.0.1 / 24, 1.0.1.1 / 24<->2.0.1.1 / 24, and the intercommunication strategy synthesized by VPN encryption device 2 is 2.0.0.1 / 24<->1.0.0.1 / 24, 2.0.0.1 / 24<->1.0.1.1 / 24, 2.0.1.1 / 24<->1.0.0.1 / 24, 2.0.1.1 / 24<->1.0.1.1 / 24, and the key established in the subsequent negotiation process will use this strategy, so the VPN tunnel is established between the two VPN encryption devices based on the routing information.

[0064] In some embodiments, the first VPN encryption device in step 110 publishes routing information inside the second network to the first network, including:

[0065] The first VPN encryption device publishes routing information inside the second network to the first network through a routing protocol;

[0066] The second VPN encryption device in step 110 publishes routing information inside the first network to the second network, including:

[0067] The second VPN encryption device publishes the routing information inside the first network to the second network through the routing protocol.

[0068] Optionally, the present application does not limit the specific routing protocol used, which may be a static routing protocol or a dynamic routing protocol.

[0069] The VPN encryption device publishes the received routing information to the internal network through the routing protocol, so that network A and network B complete the routing information exchange across the VPN tunnel, and network A and network B form a routing domain.

[0070] Figure 4 is a flow chart of VPN encryption device interaction provided by an embodiment of the present application, such as Figure 4 As shown, VPN encryption device 1 publishes the received routing information 2.0.0.1 / 24 and 2.0.1.1 / 24 to internal network A through the routing protocol, and VPN encryption device 2 publishes the received routing information 1.0.0.1 / 24 and 1.0.1.1 / 24 to internal network B through the routing protocol. As a result, network A and network B complete the routing information exchange across the VPN tunnel, and network A and network B form a routing domain.

[0071] In some embodiments, the method further comprises:

[0072] The first VPN encryption device and the second VPN encryption device isolate the routes of the intranet and the extranet respectively to obtain the extranet routing domain and the intranet routing domain.

[0073] like Figure 2 As shown, the VPN encryption device isolates the routes of the intranet and the extranet, and finally the extranet routes become a routing domain, and the intranets of all VPN encryption devices form a routing domain.

[0074] like Figure 3 As shown, in one embodiment of the present application, after the networking is successful, when the terminal 1 IP address 1.0.0.10 in the intranet of the VPN encryption device 1 wants to access the terminal 2 IP address 2.0.0.10 in the intranet of the VPN encryption device 2, the IP message sent by the terminal 1 enters the VPN encryption device 1 through the intranet routing domain routing, is encrypted by the VPN encryption device 1 in tunnel mode, and the IP address is transformed into an external network IP address, enters the VPN encryption device 2 through the external network routing domain routing, is decrypted by the VPN encryption device 2 and restored to the original IP header, and then is routed to the terminal 2 through the intranet routing domain, and the terminal 1 and the terminal 2 complete the interconnection.

[0075] Figure 5 is a schematic diagram of the structure of a remote networking device across VPN tunnels provided in an embodiment of the present application, such as Figure 5 As shown, the device includes a negotiation module 510 and a networking module 520, wherein:

[0076] The negotiation module 510 is used to start a negotiation process between the first virtual private network VPN encryption device and the second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0077] The networking module 520 is used to enable the first VPN encryption device to publish the routing information inside the second network to the first network, and the second VPN encryption device to publish the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

[0078] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0079] Based on the method in the above embodiment, Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, an embodiment of the present application provides an electronic device, which may include: a processor (processor) 610, a communication interface (CommunicationsInterface) 620, a memory (memory) 630 and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logic instructions in the memory 630 to execute the cross-VPN tunnel remote networking method in the above embodiment.

[0080] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the remote networking method across VPN tunnels described in each embodiment of the present application.

[0081] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the cross-VPN tunnel remote networking method in the above embodiment.

[0082] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the cross-VPN tunnel remote networking method in the above embodiment.

[0083] It is understandable that the processor in the embodiment of the present application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0084] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0085] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0086] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0087] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A remote networking method across VPN tunnels, characterized in that: include: A negotiation process is initiated between a first virtual private network VPN encryption device and a second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network. The first VPN encryption device publishes the routing information inside the second network to the first network, and the second VPN encryption device publishes the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

2. The method for remote networking across VPN tunnels according to claim 1, characterized in that: The first VPN encryption device is deployed at the exit of the first network, and the second VPN encryption device is deployed at the exit of the second network.

3. The method for remote networking across VPN tunnels according to claim 1, characterized in that: Before initiating a negotiation process between the first VPN encryption device and the second VPN encryption device, the method further includes: The first VPN encryption device obtains routing information inside the first network through a routing protocol, and the second VPN encryption device obtains routing information inside the second network through a routing protocol.

4. The method for remote networking across VPN tunnels according to claim 1, characterized in that: The first VPN encryption device and the second VPN encryption device initiate a negotiation process, including: An Internet Key Exchange (IKE) process is initiated between the first VPN encryption device and the second VPN encryption device. In the IKE process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device and the second VPN encryption device respectively combine the routing information inside the first network and the routing information inside the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy.

5. The method for remote networking across VPN tunnels according to claim 1, characterized in that: The first VPN encryption device publishes routing information inside the second network to the first network, including: The first VPN encryption device publishes routing information inside the second network to the first network through a routing protocol; The second VPN encryption device publishes routing information inside the first network to the second network, including: The second VPN encryption device publishes routing information inside the first network to the second network through a routing protocol.

6. The method for remote networking across VPN tunnels according to claim 1, characterized in that: The method further comprises: The first VPN encryption device and the second VPN encryption device isolate the routes of the intranet and the extranet respectively to obtain the extranet routing domain and the intranet routing domain.

7. A remote networking device across VPN tunnels, characterized in that: include: A negotiation module, configured to start a negotiation process between a first virtual private network VPN encryption device and a second VPN encryption device, wherein the first VPN encryption device and the second VPN encryption device exchange routing information, wherein the first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network; The networking module is used to enable the first VPN encryption device to publish the routing information inside the second network to the first network, and the second VPN encryption device to publish the routing information inside the first network to the second network, so that the first network and the second network form a routing domain, and the routing domain includes an external network routing domain and an internal network routing domain.

8. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the cross-VPN tunnel remote networking method as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program runs on a processor, the processor is enabled to execute the cross-VPN tunnel remote networking method according to any one of claims 1 to 6.

10. A computer program product, characterized in that When the computer program product runs on a processor, the processor is enabled to execute the cross-VPN tunnel remote networking method according to any one of claims 1 to 6.

Images