Methods, apparatus, electronic devices and storage media for remote networking across VPN tunnels

Abstract

This application belongs to the field of network encryption networking, and specifically discloses a method, apparatus, electronic device, and storage medium for remote networking across VPN tunnels. The method includes: initiating a negotiation process between a first VPN encryption device and a second VPN encryption device; in the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information; the first VPN encryption device contains routing information within a first network, and the second VPN encryption device contains routing information within a second network; the first VPN encryption device publishes the routing information within the second network to the first network, and the second VPN encryption device publishes the routing information within the first network to the second network, so that the first network and the second network form a routing domain, the routing domain including an external network routing domain and an internal network routing domain.

Description

Technical Field

[0001] This application belongs to the field of network encryption networking, and more specifically, relates to a method, apparatus, electronic device and storage medium for remote networking across VPN tunnels. Background Technology

[0002] In existing VPN encryption devices, the internal and external routing information are interconnected during operation, which can easily lead to the leakage of internal routing information to the outside world. Therefore, the security of existing VPN encryption devices is relatively poor. Summary of the Invention

[0003] In view of the shortcomings of the prior art, the purpose of this application is to provide a method, apparatus, electronic device and storage medium for remote networking across VPN tunnels, which aims to solve the problem of poor security caused by the interconnection of internal and external routing information of VPN encrypted devices.

[0004] To achieve the above objectives, in a first aspect, this application provides a method for remote networking across VPN tunnels, comprising:

[0005] A negotiation process is initiated between the first VPN encryption device and the second VPN encryption device. During the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0006] The first VPN encryption device publishes routing information within the second network to the first network, and the second VPN encryption device publishes routing information within the first network to the second network, so that the first network and the second network form a routing domain, which includes an external network routing domain and an internal network routing domain.

[0007] This application achieves this by having different VPN encryption devices exchange their respective network routing information through a negotiation process. This allows the interconnected VPN encryption devices to form a routing domain that is isolated from the external routing domain. This separation of the internal and external routes of the VPN encryption devices can be achieved without affecting their operation, preventing the leakage of internal routes from the VPN encryption devices and significantly improving the security of the VPN encryption devices.

[0008] According to a cross-VPN tunnel remote networking method provided by the present invention, the first VPN encryption device is deployed at the exit of the first network, and the second VPN encryption device is deployed at the exit of the second network.

[0009] This application deploys a VPN encryption device at the network egress point, encrypting data on the outgoing network according to a security policy and decrypting data entering the network according to a security policy, thereby improving the security of the VPN encryption device.

[0010] According to a cross-VPN tunnel remote networking method provided by the present invention, before initiating a negotiation process between the first VPN encryption device and the second VPN encryption device, the method further includes:

[0011] The first VPN encryption device obtains routing information within the first network through a routing protocol, and the second VPN encryption device obtains routing information within the second network through a routing protocol.

[0012] The VPN encryption device in this application obtains routing information within the network through routing protocols to prepare for subsequent exchange of routing information.

[0013] According to a cross-VPN tunnel remote networking method provided by the present invention, the first VPN encryption device and the second VPN encryption device initiate a negotiation process, including:

[0014] The first VPN encryption device and the second VPN encryption device initiate an Internet Key Exchange (IKE) process, in which the first VPN encryption device and the second VPN encryption device exchange routing information.

[0015] The first VPN encryption device and the second VPN encryption device combine the routing information inside the first network and the routing information inside the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy.

[0016] The encryption devices in this application exchange routing information through the IKE process, and then combine the routing information of their respective networks to form a security policy, so that the key established in the subsequent negotiation process can use the policy to complete the VPN tunnel establishment.

[0017] According to a cross-VPN tunnel remote networking method provided by the present invention, the first VPN encryption device publishes routing information within the second network to the first network, including:

[0018] The first VPN encryption device publishes routing information within the second network to the first network through a routing protocol;

[0019] The second VPN encryption device publishes routing information within the first network to the second network, including:

[0020] The second VPN encryption device publishes routing information from within the first network to the second network via a routing protocol.

[0021] According to a method for remote networking across VPN tunnels provided by the present invention, the method further includes:

[0022] The first VPN encryption device and the second VPN encryption device isolate the routing of the internal network and the external network respectively, thereby obtaining the external network routing domain and the internal network routing domain.

[0023] This application isolates the internal and external routes of the VPN encryption device, forming a routing domain within the interconnected VPN encryption device and isolating it from the external routing domain. This separates the internal and external routes of the VPN encryption device without affecting its operation, preventing the leakage of the internal routes of the VPN encryption device to the outside and significantly improving the security of the VPN encryption device.

[0024] Secondly, this application provides a remote networking device for cross-VPN tunnels, comprising:

[0025] The negotiation module is used to initiate a negotiation process between the first VPN encryption device and the second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0026] The networking module is used to enable the first VPN encryption device to publish routing information within the second network to the first network, and the second VPN encryption device to publish routing information within the first network to the second network, so that the first network and the second network form a routing domain, the routing domain including an external network routing domain and an internal network routing domain.

[0027] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation thereof.

[0028] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed on a processor, causes the processor to perform the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation thereof.

[0029] Fifthly, this application provides a computer program product that, when run on a processor, causes the processor to execute the cross-VPN tunnel remote networking method described in the first aspect or any possible implementation of the first aspect.

[0030] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0031] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art:

[0032] By exchanging routing information between different VPN encryption devices through a negotiation process, a routing domain is formed within the interconnected VPN encryption devices and isolated from the external routing domain. This allows the internal and external routes of VPN encryption devices to be separated without affecting their operation, preventing the leakage of internal routes from the VPN encryption devices to the outside world and significantly improving the security of VPN encryption devices. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating the cross-VPN tunnel remote networking method provided in the embodiments of this application;

[0035] Figure 2 This is a schematic diagram illustrating the principle of remote networking across VPN tunnels provided in this application embodiment;

[0036] Figure 3 This is a working topology diagram of the VPN encryption device provided in the embodiments of this application;

[0037] Figure 4 This is a flowchart illustrating the interaction process of a VPN encryption device provided in an embodiment of this application.

[0038] Figure 5 This is a schematic diagram of the cross-VPN tunnel remote networking device provided in the embodiments of this application;

[0039] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0041] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0042] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0043] In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more, for example, multiple processing units means two or more processing units, multiple elements means two or more elements, etc.

[0044] Next, combined Figures 1-4 The method for remote networking across VPN tunnels provided in the embodiments of this application is described.

[0045] Figure 1 This is a flowchart illustrating the cross-VPN tunnel remote networking method provided in this application embodiment, as shown below. Figure 1 As shown, the method includes the following steps:

[0046] Step 100: The first VPN encryption device and the second VPN encryption device initiate a negotiation process. During the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0047] The cross-VPN tunnel remote networking method provided in this application aims to separate the internal and external routes of a VPN encryption device without affecting its operation, thereby preventing the leakage of the internal routes of the VPN encryption device to the outside and significantly improving the security of the VPN encryption device. This method is applicable to two or more VPN encryption devices.

[0048] Taking two networks and their corresponding VPN encryption devices as an example, the first network deploys the first VPN encryption device, and the second network deploys the second VPN encryption device. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0049] The first VPN encryption device and the second VPN encryption device are configured with information about the devices they communicate with. The first VPN encryption device initiates a negotiation process with the second VPN encryption device according to the configuration to exchange routing information within their respective networks.

[0050] Step 110: The first VPN encryption device publishes routing information within the second network to the first network, and the second VPN encryption device publishes routing information within the first network to the second network, so that the first network and the second network form a routing domain, which includes an external network routing domain and an internal network routing domain.

[0051] After the negotiation process is completed, the first VPN encryption device and the second VPN encryption device publish the routing information of each other's networks to their respective networks, so that the two networks form a routing domain. This routing domain includes an external network routing domain and an internal network routing domain, thereby isolating the internal network and the external network, preventing the leakage of the internal routing of the VPN encryption device to the outside, and significantly improving the security of the VPN encryption device.

[0052] This application provides a method for remote networking across VPN tunnels. By exchanging routing information of their respective networks through a negotiation process, different VPN encryption devices form a routing domain within each other and are isolated from the external routing domain. This method can separate the internal and external routes of VPN encryption devices without affecting their operation, preventing the leakage of internal routes of VPN encryption devices to the outside world and significantly improving the security of VPN encryption devices.

[0053] In some embodiments, the first VPN encryption device in step 100 is deployed at the exit of the first network, and the second VPN encryption device is deployed at the exit of the second network.

[0054] This application deploys a VPN encryption device at the network egress point, encrypting data going out of the network according to a security policy, and decrypting data entering the network according to a security policy.

[0055] Figure 2 This is a schematic diagram of the cross-VPN tunnel remote networking principle provided in the embodiments of this application, such as... Figure 2 As shown, in one embodiment of this application, taking three VPN encryption devices as an example, VPN encryption device 1 is deployed at the exit of network A, VPN encryption device 2 is deployed at the exit of network B, and VPN encryption device 3 is deployed at the exit of network C.

[0056] In some embodiments, prior to step 100, the method further includes:

[0057] The first VPN encryption device obtains routing information within the first network through a routing protocol, and the second VPN encryption device obtains routing information within the second network through a routing protocol.

[0058] Optionally, this application does not limit the specific routing protocol used; it can be a static routing protocol or a dynamic routing protocol.

[0059] In some embodiments, step 100 specifically includes:

[0060] Step 1001: The first VPN encryption device and the second VPN encryption device initiate an Internet Key Exchange (IKE) process. In the IKE process, the first VPN encryption device and the second VPN encryption device exchange routing information.

[0061] Step 1002: The first VPN encryption device and the second VPN encryption device combine the routing information inside the first network and the routing information inside the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy.

[0062] IKE is a protocol for exchanging and managing encryption keys used in VPNs. The first or second VPN encryption device can initiate an IKE process with the other party. In the IKE process, the VPN encryption device sends the routing information it has obtained to the other party. The receiving party combines the received routing information with its own routing information to form a security policy. The key established in the subsequent negotiation process will use this policy. Thus, the VPN tunnel between the two VPN encryption devices is established based on the routing information.

[0063] Figure 3 This is a working topology diagram of the VPN encryption device provided in the embodiments of this application, such as... Figure 3As shown, in one embodiment of this application, the interoperability policy synthesized by VPN encryption device 1 is 1.0.0.1 / 24<->2.0.0.1 / 24, 1.0.0.1 / 24<->2.0.1.1 / 24, 1.0.1.1 / 24<->2.0.0.1 / 24, 1.0.1.1 / 24<->2.0.1.1 / 24, and the interoperability policy synthesized by VPN encryption device 2 is 2.0.0.1 / 24<->1.0.0.1 / 24, 2.0.0.1 / 24<->1.0.1.1 / 24, 2.0.1.1 / 24<->1.0.0.1 / 24, 2.0.1.1 / 24<->1.0.1.1 / 24. The key established in the subsequent negotiation process will use this policy, and thus the VPN tunnel between the two VPN encryption devices is established based on routing information.

[0064] In some embodiments, the first VPN encryption device in step 110 publishes routing information within the second network to the first network, including:

[0065] The first VPN encryption device publishes routing information within the second network to the first network through a routing protocol;

[0066] In step 110, the second VPN encryption device publishes routing information from within the first network to the second network, including:

[0067] The second VPN encryption device publishes routing information from within the first network to the second network via a routing protocol.

[0068] Optionally, this application does not limit the specific routing protocol used; it can be a static routing protocol or a dynamic routing protocol.

[0069] The VPN encryption device publishes the received routing information to the internal network through the routing protocol. Thus, network A and network B complete the exchange of routing information across the VPN tunnel, and network A and network B form a routing domain.

[0070] Figure 4 This is a flowchart of the VPN encryption device interaction provided in the embodiments of this application, such as... Figure 4 As shown, VPN encryption device 1 publishes the received routing information 2.0.0.1 / 24 and 2.0.1.1 / 24 to internal network A through the routing protocol, and VPN encryption device 2 publishes the received routing information 1.0.0.1 / 24 and 1.0.1.1 / 24 to internal network B through the routing protocol. Thus, network A and network B complete the exchange of routing information across the VPN tunnel, and network A and network B form a routing domain.

[0071] In some embodiments, the method further includes:

[0072] The first VPN encryption device and the second VPN encryption device isolate the routing of the internal network and the external network respectively, and obtain the external network routing domain and the internal network routing domain.

[0073] like Figure 2 As shown, VPN encryption devices isolate the routing between the internal network and the external network. Ultimately, the external network routing becomes a routing domain, and the internal networks of all VPN encryption devices form a routing domain.

[0074] like Figure 3 As shown, in one embodiment of this application, after successful network formation, when terminal 1 (IP address 1.0.0.10) on the intranet of VPN encryption device 1 wants to access terminal 2 (IP address 2.0.0.10) on the intranet of VPN encryption device 2, the IP packet sent by terminal 1 is routed into VPN encryption device 1 through the intranet routing domain. After being encrypted by VPN encryption device 1 in tunnel mode, the IP address is transformed into an external IP address. After being routed into VPN encryption device 2 through the external routing domain, the packet is decrypted by VPN encryption device 2 and restored to its original IP header. Then, it is routed to terminal 2 through the intranet routing domain, and terminal 1 and terminal 2 complete the communication.

[0075] Figure 5 This is a schematic diagram of the cross-VPN tunnel remote networking device provided in the embodiments of this application, as shown below. Figure 5 As shown, the device includes a negotiation module 510 and a networking module 520, wherein:

[0076] The negotiation module 510 is used to initiate a negotiation process between the first VPN encryption device and the second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network.

[0077] The networking module 520 is used to enable the first VPN encryption device to publish routing information within the second network to the first network, and the second VPN encryption device to publish routing information within the first network to the second network, so that the first network and the second network form a routing domain, which includes an external network routing domain and an internal network routing domain.

[0078] It should be understood that the above-described device is used to execute the methods in the above embodiments. The implementation principle and technical effect of the corresponding program modules in the device are similar to those described in the above methods. The working process of the device can be referred to the corresponding process in the above methods, and will not be repeated here.

[0079] Based on the methods in the above embodiments, Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6As shown in the illustration, this application provides an electronic device that may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640. The processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions stored in the memory 630 to execute the cross-VPN tunnel remote networking method described in the above embodiment.

[0080] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the cross-VPN tunnel remote networking method described in the various embodiments of this application.

[0081] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the cross-VPN tunnel remote networking method in the above embodiments.

[0082] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the cross-VPN tunnel remote networking method in the above embodiments.

[0083] It is understood that the processor in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0084] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0085] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0086] It is understood that the various numerical designations used in the embodiments of this application are merely for the convenience of description and are not intended to limit the scope of the embodiments of this application.

[0087] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for remote networking across VPN tunnels, characterized in that, include: A negotiation process is initiated between the first VPN encryption device and the second VPN encryption device. During the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network. The first VPN encryption device publishes routing information within the second network to the first network, and the second VPN encryption device publishes routing information within the first network to the second network, so that the first network and the second network form a routing domain, which includes an external network routing domain and an internal network routing domain. The first VPN encryption device and the second VPN encryption device initiate a negotiation process, including: The first VPN encryption device and the second VPN encryption device initiate an Internet Key Exchange (IKE) process, in which the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device and the second VPN encryption device combine the routing information inside the first network and the routing information inside the second network to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy. The method further includes: The first VPN encryption device and the second VPN encryption device isolate the routing of the internal network and the external network respectively, thereby obtaining the external network routing domain and the internal network routing domain.

2. The cross-VPN tunnel remote networking method according to claim 1, characterized in that, The first VPN encryption device is deployed at the exit of the first network, and the second VPN encryption device is deployed at the exit of the second network.

3. The cross-VPN tunnel remote networking method according to claim 1, characterized in that, Before initiating a negotiation process between the first VPN encryption device and the second VPN encryption device, the method further includes: The first VPN encryption device obtains routing information within the first network through a routing protocol, and the second VPN encryption device obtains routing information within the second network through a routing protocol.

4. The cross-VPN tunnel remote networking method according to claim 1, characterized in that, The first VPN encryption device publishes routing information within the second network to the first network, including: The first VPN encryption device publishes routing information within the second network to the first network through a routing protocol; The second VPN encryption device publishes routing information within the first network to the second network, including: The second VPN encryption device publishes routing information from within the first network to the second network via a routing protocol.

5. A remote networking device for cross-VPN tunnels, characterized in that, include: The negotiation module is used to initiate a negotiation process between the first VPN encryption device and the second VPN encryption device. In the negotiation process, the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device contains routing information within the first network, and the second VPN encryption device contains routing information within the second network. The networking module is used to enable the first VPN encryption device to publish routing information within the second network to the first network, and the second VPN encryption device to publish routing information within the first network to the second network, so that the first network and the second network form a routing domain, the routing domain including an external network routing domain and an internal network routing domain; The negotiation module is specifically used for: Initiate an Internet Key Exchange (IKE) process between the first VPN encryption device and the second VPN encryption device, in which the first VPN encryption device and the second VPN encryption device exchange routing information. The first VPN encryption device and the second VPN encryption device combine the routing information inside the first network and the routing information inside the second network respectively to form a security policy, and establish a VPN tunnel between the first VPN encryption device and the second VPN encryption device based on the security policy. The device further includes: An isolation module is used to isolate the routing of the internal network and the external network by the first VPN encryption device and the second VPN encryption device respectively, thereby obtaining the external network routing domain and the internal network routing domain.

6. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to perform the cross-VPN tunnel remote networking method as described in any one of claims 1-4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on the processor, it causes the processor to perform the cross-VPN tunnel remote networking method as described in any one of claims 1-4.

8. A computer program product, characterized in that, When the computer program product is run on the processor, the processor performs the cross-VPN tunnel remote networking method as described in any one of claims 1-4.

Images