VPN tunnel establishment method and device based on routing information

Abstract

The invention belongs to the technical field of network encryption, and particularly discloses a VPN tunnel establishment method and device based on routing information. According to the application, the first routing information of the first network accessed by the first VPN encryption equipment is sent to the second VPN encryption equipment by slightly transforming the existing negotiation IKE process; and enabling the second VPN encryption equipment to configure an intercommunication strategy between the second VPN encryption equipment and the first VPN encryption equipment based on second routing information of a second network accessed by the second VPN encryption equipment and the received first routing information, obtaining a session key between the second VPN encryption equipment and the first VPN encryption equipment based on the intercommunication strategy, and completing establishment of the VPN tunnel. The configuration-free intercommunication strategy between the VPN encryption devices is realized, the complexity of manual configuration is reduced, and the configuration efficiency is improved. Meanwhile, according to the method, the change of the existing IKE process negotiation protocol is small, the universality is high, and a certain practical value is achieved.

Description

Technical Field

[0001] The present application belongs to the field of network encryption technology, and more specifically, to a method and device for establishing a VPN tunnel based on routing information. Background Art

[0002] Virtual Private Network (VPN) technology uses the Internet Key Exchange (IKE) process to exchange negotiated keys. According to security policies, it uses the established VPN tunnel to encrypt and transmit network layer data. It can safely and reliably transmit messages on insecure open networks, effectively reducing the cost of secure transmission of private information on the network.

[0003] Normally, both parties in communication have unique public network addresses through dial-up or broadband Internet access. Through VPN encryption devices and other devices, a VPN tunnel can be established between the two parties in communication. To implement VPN functions between VPN encryption devices, a large number of manual configurations of intercommunication strategies are often required, especially in a multi-communication terminal or multi-network environment, which is complex and prone to errors. Summary of the invention

[0004] In view of the defects of the prior art, the purpose of this application is to provide a method and device for establishing a VPN tunnel based on routing information, aiming to solve the problem that existing VPN encryption devices often require a lot of manual configuration, especially in a multi-communication terminal or multi-network environment, and the configuration is complex and error-prone.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a method for establishing a VPN tunnel based on routing information, which is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0006] Initiating a first Internet key exchange process to a second VPN encryption device;

[0007] The first routing information of the first network accessed by the first VPN encryption device is sent to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures an intercommunication policy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains a session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

[0008] In some embodiments, the method further comprises:

[0009] In response to a second Internet key exchange process initiated by the second VPN encryption device, receiving second routing information sent by the second VPN encryption device;

[0010] An intercommunication strategy is configured based on the first routing information and the second routing information, and a session key is obtained based on the intercommunication strategy.

[0011] In some embodiments, configuring an intercommunication strategy based on the first routing information and the second routing information includes:

[0012] An IP address corresponding to the first routing information and an IP address corresponding to the second routing information are used as a routing start point and a routing end point, respectively, to configure an intercommunication strategy.

[0013] In a second aspect, an embodiment of the present application provides a method for establishing a VPN tunnel based on routing information, which is applied to a second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0014] Responding to a first Internet key exchange process initiated by a first VPN encryption device;

[0015] Receive first routing information of a first network accessed by the first VPN encryption device, configure an intercommunication strategy based on the first routing information and second routing information of a second network accessed by the second VPN encryption device, and obtain a session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy. In some embodiments, the method further includes:

[0016] Initiating a second Internet key exchange process to the first VPN encryption device;

[0017] The second routing information is sent to the first VPN encryption device, so that the first VPN encryption device responds to the second Internet key exchange process, configures an intercommunication strategy based on the first routing information and the second routing information, and obtains a session key based on the intercommunication strategy.

[0018] In a third aspect, the present application provides a VPN tunnel establishment device based on routing information, which is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0019] A first sending module, used to initiate a first Internet key exchange process to a second VPN encryption device;

[0020] The second sending module is used to send the first routing information of the first network intercommunication with the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures the intercommunication strategy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy.

[0021] In a fourth aspect, an embodiment of the present application provides a VPN tunnel establishment device based on routing information, which is applied to a second VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0022] A first receiving module, configured to respond to a first Internet key exchange process initiated by a first VPN encryption device;

[0023] The second receiving module is used to receive first routing information of a first network accessed by the first VPN encryption device, configure an intercommunication strategy based on the first routing information and second routing information of a second network accessed by the second VPN encryption device, and obtain a session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy.

[0024] In a fifth aspect, the present application provides an electronic device, comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the programs stored in the memory are executed, the processor is used to execute the VPN tunnel establishment method based on routing information described in any embodiments of the first aspect or the second aspect.

[0025] In a sixth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the VPN tunnel establishment method based on routing information described in any embodiment of the first aspect or the second aspect.

[0026] In a seventh aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method for establishing a VPN tunnel based on routing information described in any embodiments of the first aspect or the second aspect.

[0027] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art:

[0028] The VPN tunnel establishment method and device based on routing information provided in the embodiment of the present application, by slightly modifying the existing negotiation IKE process, sends the first routing information of the first network accessed by the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device configures the intercommunication strategy between it and the first VPN encryption device based on the second routing information of the second network accessed by itself and the received first routing information, and obtains the session key between it and the first VPN encryption device based on the intercommunication strategy, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the present application makes little change to the negotiation protocol of the existing negotiation IKE process, has strong versatility, and has certain practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is one of the flow diagrams of the method for establishing a VPN tunnel based on routing information provided in an embodiment of the present application;

[0030] Figure 2 This is a schematic diagram of the working topology of the VPN encryption device provided in the embodiment of the present application;

[0031] Figure 3 It is a schematic diagram of the negotiation establishment process provided by the embodiment of the present application;

[0032] Figure 4 This is the second flow chart of the VPN tunnel establishment method based on routing information provided in the embodiment of the present application;

[0033] Figure 5 This is a flowchart of a method for establishing a VPN tunnel based on routing information provided in an embodiment of the present application;

[0034] Figure 6 This is one of the structural schematic diagrams of a method and device for establishing a VPN tunnel based on routing information provided in an embodiment of the present application;

[0035] Figure 7 This is the second structural diagram of the VPN tunnel establishment method and device based on routing information provided in the embodiment of the present application;

[0036] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0038] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0039] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first VPN encryption device and a second VPN encryption device are used to distinguish different response messages rather than to describe a specific order of the response messages.

[0040] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0041] In the description of the embodiments of the present application, unless otherwise specified, “plurality” means two or more than two.

[0042] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0043] See also Figure 1 An embodiment of the present application provides a method for establishing a VPN tunnel based on routing information, which may include: step 110 and step 120.

[0044] Step 110 initiates a first Internet key exchange process to a second VPN encryption device;

[0045] Step 120 sends the first routing information of the first network accessed by the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures an intercommunication policy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

[0046] The method for establishing a VPN tunnel based on routing information provided in the embodiment of the present application can be applied to a first VPN encryption device. By appropriately modifying the IKE process, it is suitable for a situation where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device. The VPN tunnel is established through negotiation based on routing information and the information of the peer intercommunication device of the VPN encryption device that initiates the IKE process.

[0047] The first VPN encryption device initiates an IKE process to the second VPN encryption device at the opposite end, namely the first IKE process. At the same time, the first VPN encryption device is configured with some device information required to establish a VPN tunnel based on the first IKE process, such as its own source IP address, the IP address of the second VPN encryption device, identity authentication information, encryption algorithm, and security parameters for key exchange.

[0048] In the embodiment of the present application, the VPN encryption device is generally deployed at the network exit, and the data leaving the network is encrypted according to the security policy, and the data entering the network is decrypted according to the security policy.

[0049] Please see further Figure 2 VPN encryption devices are deployed at the network exits of the first network (network A) and the second network (network B), respectively, and no intercommunication strategy is configured between the VPN encryption devices. The VPN encryption devices establish an intercommunication strategy based on internal routing information and process network IP data according to the intercommunication strategy.

[0050] The first VPN encryption device obtains the routing information (ie, first routing information) inside the first network (ie, network A) to which it accesses through a routing protocol, and initiates a first IKE process to the second VPN encryption device according to the above device information configured by itself.

[0051] In the first IKE process, the first VPN encryption device sends the acquired routing information of the first network (network A) to which it accesses to the second VPN encryption device.

[0052] Please continue to see Figure 2 The routing information inside network A obtained by the first VPN encryption device through the routing protocol is 1.0.0.1 / 24 and 1.0.1.1 / 24.

[0053] The second VPN encryption device responds to the first IKE process initiated by the first VPN encryption device, and configures the intercommunication strategy between it and the first VPN encryption device according to the received first routing information and the routing information of the second network (network B) to which it is connected (i.e., the second routing information). The session key established by the subsequent negotiation process will be obtained based on the intercommunication strategy. At this point, the VPN tunnel is established between the two VPN encryption devices based on the routing information.

[0054] Based on the same method, a VPN tunnel between the first VPN encryption device and the third VPN encryption device can be established.

[0055] Please continue to see Figure 2 The routing information inside the B network obtained by the second VPN encryption device through the routing protocol is 2.0.0.1 / 24 and 2.0.1.1 / 24.

[0056] The VPN tunnel establishment method based on routing information provided in the embodiment of the present application, by slightly modifying the existing negotiation IKE process, sends the first routing information of the first network accessed by the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device configures the intercommunication strategy between it and the first VPN encryption device based on the second routing information of the second network accessed by itself and the received first routing information, and obtains the session key between it and the first VPN encryption device based on the intercommunication strategy, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the present application makes little change to the negotiation protocol of the existing negotiation IKE process, has strong versatility, and has certain practical value.

[0057] Furthermore, in some embodiments, the above method may further include:

[0058] In response to a second Internet key exchange process initiated by the second VPN encryption device, receiving second routing information sent by the second VPN encryption device;

[0059] An intercommunication strategy is configured based on the first routing information and the second routing information, and a session key is obtained based on the intercommunication strategy.

[0060] In the embodiment of the present application, the first VPN encryption device as the initiator of the first IKE process can also serve as the responder of the IKE process initiated by the second VPN encryption device (ie, the second IKE process).

[0061] The first VPN encryption device responds to the IKE process initiated by the second VPN encryption device, and receives routing information of the second network accessed by the second VPN device obtained through the routing protocol.

[0062] In the embodiment of the present application, when the second VPN encryption device initiates an IKE encryption process to the first VPN encryption device, the above device information also needs to be configured.

[0063] The first VPN encryption device configures an intercommunication strategy between itself and the second VPN device according to the received routing information of the second network and the routing information of the first network to which it accesses. The session key established in the subsequent negotiation process can be obtained based on the intercommunication strategy.

[0064] The method for establishing a VPN tunnel based on routing information provided in the embodiment of the present application is that the first VPN encryption device can serve as both the initiator of the IKE process and the responder of the IEK process initiated by the second VPN encryption device, thereby completing the establishment of a VPN tunnel based on routing information and realizing the establishment of a bidirectional VPN tunnel, which has strong applicability.

[0065] Furthermore, in some embodiments, in the above steps, configuring the intercommunication strategy based on the first routing information and the second routing information may include:

[0066] An IP address corresponding to the first routing information and an IP address corresponding to the second routing information are used as a routing start point and a routing end point, respectively, to configure an intercommunication strategy.

[0067] Please see further Figure 3 The first VPN encryption device and the second VPN encryption device start the IKE process. The VPN encryption devices exchange routing information in the IKE process and use the exchanged routing information and the routing information of the network they access to form an intercommunication strategy. The intercommunication strategy is formed by using the IP address corresponding to the first routing information and the IP address corresponding to the second routing information as the routing start point and the routing end point, respectively.

[0068] Exemplarily, the intercommunication strategy synthesized by the first VPN encryption device is 1.0.0.1 / 24<->2.0.0.1 / 24, 1.0.0.1 / 24<->2.0.1.1 / 24, 1.0.1.1 / 24<->2.0.0.1 / 24, 1.0.1.1 / 24<->2.0.1.1 / 24, and the intercommunication strategy synthesized by the second VPN encryption device is 2.0.0.1 / 24<->1.0.0.1 / 24, 2.0.0.1 / 24<->1.0.1.1 / 24, 2.0.1.1 / 24<->1.0.0.1 / 24, 2.0.1.1 / 24<->1.0.1.1 / 24, and the session key established by the subsequent IKE process will use the above intercommunication strategy, so the VPN tunnel is established between the two VPN encryption devices based on the routing information.

[0069] Please continue to see Figure 2 If a first terminal (1.0.0.10) accessing a first network (network A) communicates with a second terminal (2.0.0.10) accessing a second network (network B), when the IP message is routed to the first VPN encryption device in network A, it will hit the intercommunication policy of the second VPN encryption device. The IP message is encrypted and transmitted to the second VPN encryption device, then decrypted, and then transmitted to the second terminal through the route in network B. In this way, all terminals in network A can intercommunication with all terminals in network B.

[0070] See also Figure 4 , an embodiment of the present application provides a method for establishing a VPN tunnel based on routing information, which may include: step 210 and step 220.

[0071] Step 210 is in response to a first Internet key exchange process initiated by the first VPN encryption device;

[0072] Step 220 receives first routing information of a first network accessed by the first VPN encryption device, configures an intercommunication strategy based on the first routing information and second routing information of a second network accessed by the second VPN encryption device, and obtains a session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy.

[0073] The method for establishing a VPN tunnel based on routing information provided in the embodiment of the present application can be applied to a second VPN encryption device. By appropriately modifying the IKE process, it is suitable for a situation where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device. The VPN tunnel is established through negotiation based on routing information and information about the intercommunication device of the other end of the VPN encryption device that initiates the IKE process.

[0074] The second VPN encryption device responds to the IKE process initiated by the first VPN encryption device, that is, the first IKE process.

[0075] In the embodiment of the present application, the VPN encryption device is generally deployed at the network exit, and the data leaving the network is encrypted according to the security policy, and the data entering the network is decrypted according to the security policy.

[0076] Please continue to see Figure 2 VPN encryption devices are deployed at the network exits of the first network (network A) and the second network (network B), respectively, and no intercommunication strategy is configured between the VPN encryption devices. The VPN encryption devices establish an intercommunication strategy based on internal routing information and process network IP data according to the intercommunication strategy.

[0077] The first VPN encryption device obtains the routing information (ie, first routing information) inside the first network (ie, network A) to which it accesses through a routing protocol, and initiates a first IKE process to the second VPN encryption device according to the above device information configured by itself.

[0078] The second VPN encryption device responds to the first IKE process initiated by the first VPN encryption device, and receives routing information of the first network (network A) to which it accesses, which is sent by the first VPN encryption device.

[0079] Please continue to see Figure 2 The routing information inside the A network sent by the first VPN encryption device and obtained by the second VPN encryption device is 1.0.0.1 / 24 and 1.0.1.1 / 24.

[0080] The second VPN encryption device configures the intercommunication strategy between itself and the first VPN encryption device according to the received first routing information and the routing information of the second network (network B) to which it is connected (i.e., the second routing information). The session key established in the subsequent negotiation process will be obtained based on the intercommunication strategy. At this point, the VPN tunnel is established between the two VPN encryption devices based on the routing information.

[0081] Please continue to see Figure 2 The routing information inside the B network obtained by the second VPN encryption device through the routing protocol is 2.0.0.1 / 24 and 2.0.1.1 / 24.

[0082] The VPN tunnel establishment method based on routing information provided in the embodiment of the present application, through a minor modification of the existing negotiation IKE process, responds to the IKE process initiated by the first VPN encryption device, and according to the received first routing information sent by the first VPN encryption device and the second routing information of the second network accessed by itself, the intercommunication strategy between it and the first VPN encryption device is obtained, and the session key between it and the first VPN encryption device is obtained based on the intercommunication strategy, and the establishment of the VPN tunnel is completed, so that the intercommunication strategy between VPN encryption devices is free of configuration, the complexity of manual configuration is reduced, and the configuration efficiency is improved. At the same time, the present application has little modification to the negotiation protocol of the existing negotiation IKE process, strong versatility, and certain practical value.

[0083] Furthermore, in some embodiments, the above method may further include:

[0084] Initiating a second Internet key exchange process to the first VPN encryption device;

[0085] The second routing information is sent to the first VPN encryption device, so that the first VPN encryption device responds to the second Internet key exchange process, configures an intercommunication strategy based on the first routing information and the second routing information, and obtains a session key based on the intercommunication strategy.

[0086] In the embodiment of the present application, the second VPN encryption device as the responder of the first IKE process may also be the initiator of the IKE process (ie, the second IKE process).

[0087] The second VPN encryption device initiates an IKE process to the first VPN encryption device, and sends routing information of the second network to which it is connected to the first VPN encryption device.

[0088] In the embodiment of the present application, when the second VPN encryption device initiates an IKE encryption process to the first VPN encryption device, the above device information also needs to be configured.

[0089] The first VPN encryption device configures an intercommunication strategy between itself and the second VPN device according to the received routing information of the second network and the routing information of the first network to which it accesses. The session key established in the subsequent negotiation process can be obtained based on the intercommunication strategy.

[0090] Please see further Figure 5 The method for establishing a VPN tunnel based on routing information provided in the embodiment of the present application may include:

[0091] Step 1: Get the route.

[0092] Step 2: Exchange route generation policies.

[0093] In step 1, the initiator (the first VPN encryption device or the second VPN encryption device) obtains the routing information of its access network based on the routing protocol, and the receiver (the first VPN encryption device or the second VPN encryption device) obtains the routing information of its access network based on the routing protocol.

[0094] The initiator starts the negotiation by initiating the IKE process, and the receiver responds to the negotiation.

[0095] In step 2, the initiator sends the acquired routing information of its access to the receiver, and the receiver receives the routing information and generates a combination strategy (i.e., an intercommunication strategy) based on the received routing information and the routing information of the network it accesses. At the same time, the receiver sends the routing information of the network it accesses to the initiator, so that the initiator generates a composition strategy based on the received routing information of the network accessed by the receiver and the routing information of the network it accesses.

[0096] Finally, the VPN tunnel is established through the IKE follow-up process.

[0097] The method for establishing a VPN tunnel based on routing information provided in the embodiment of the present application is that the second VPN encryption device can serve as both the initiator of the IKE process and the responder of the IEK process initiated by the first VPN encryption device, thereby completing the establishment of a VPN tunnel based on routing information and realizing the establishment of a bidirectional VPN tunnel, which has strong applicability.

[0098] The following is a description of the VPN tunnel establishment device based on routing information provided by the present application. The VPN tunnel establishment device based on routing information described below and the VPN tunnel establishment method based on routing information described above can refer to each other.

[0099] See also Figure 6The VPN tunnel establishment device based on routing information provided in an embodiment of the present application is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, and can include: a first sending module 610 and a second sending module 620.

[0100] A first sending module 610 is used to initiate a first Internet key exchange process to a second VPN encryption device;

[0101] The second sending module 620 is used to send the first routing information of the first network intercommunication with the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures the intercommunication policy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

[0102] The VPN tunnel establishment device based on routing information provided in the embodiment of the present application, by slightly modifying the existing negotiation IKE process, sends the first routing information of the first network accessed by the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device configures the intercommunication strategy between it and the first VPN encryption device based on the second routing information of the second network accessed by itself and the received first routing information, and obtains the session key between it and the first VPN encryption device based on the intercommunication strategy, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the present application makes little change to the negotiation protocol of the existing negotiation IKE process, has strong versatility, and has certain practical value.

[0103] See also Figure 7 An embodiment of the present application provides a VPN tunnel establishment device based on routing information, characterized in that it is applied to a second VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, and can include: a first receiving module 710 and a second receiving module 720.

[0104] A first receiving module 710, configured to respond to a first Internet key exchange process initiated by the first VPN encryption device;

[0105] The second receiving module 720 is used to receive the first routing information of the first network accessed by the first VPN encryption device, configure the intercommunication strategy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtain the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy.

[0106] The VPN tunnel establishment device based on routing information provided in the embodiment of the present application, through a minor modification of the existing negotiation IKE process, responds to the IKE process initiated by the first VPN encryption device, and according to the first routing information sent by the first VPN encryption device and the second routing information of the second network accessed by itself, the intercommunication strategy between it and the first VPN encryption device is obtained, and the session key between it and the first VPN encryption device is obtained based on the intercommunication strategy, and the establishment of the VPN tunnel is completed, so that the intercommunication strategy between VPN encryption devices is free of configuration, the complexity of manual configuration is reduced, and the configuration efficiency is improved. At the same time, the present application has little modification to the negotiation protocol of the existing negotiation IKE process, strong versatility, and certain practical value.

[0107] It can be understood that the detailed functional implementation of each of the above-mentioned units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0108] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0109] Based on the method in the above embodiment, the embodiment of the present application provides an electronic device / image signal generator / network device / transmitter / terminal / base station / industrial computer, see Figure 8 The electronic device may include: a processor (Processor) 810, a communication interface (CommunicationsInterface) 820, a memory (Memory) 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the method in the above embodiment.

[0110] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0111] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0112] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0113] It is understandable that the processor in the embodiment of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0114] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0115] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0116] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0117] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for establishing a VPN tunnel based on routing information, characterized in that: Applied to a first VPN encryption device, where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: Initiating a first Internet key exchange process to the second VPN encryption device; The first routing information of the first network accessed by the first VPN encryption device is sent to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures the intercommunication policy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

2. The method for establishing a VPN tunnel based on routing information according to claim 1, characterized in that: The method further comprises: In response to a second Internet key exchange process initiated by the second VPN encryption device, receiving the second routing information sent by the second VPN encryption device; The intercommunication policy is configured based on the first routing information and the second routing information, and the session key is obtained based on the intercommunication policy.

3. The method for establishing a VPN tunnel based on routing information according to claim 2, wherein configuring the intercommunication strategy based on the first routing information and the second routing information comprises: The intercommunication strategy is configured by using the IP address corresponding to the first routing information and the IP address corresponding to the second routing information as a routing start point and a routing end point, respectively.

4. A method for establishing a VPN tunnel based on routing information, characterized in that: Applied to the second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: Responding to a first Internet key exchange process initiated by the first VPN encryption device; Receive first routing information of a first network accessed by the first VPN encryption device, configure the intercommunication policy based on the first routing information and second routing information of a second network accessed by the second VPN encryption device, and obtain a session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

5. The method for establishing a VPN tunnel based on routing information as claimed in claim 4, characterized in that: The method further comprises: Initiating a second Internet key exchange process to the first VPN encryption device; The second routing information is sent to the first VPN encryption device, so that the first VPN encryption device responds to the second Internet key exchange process, configures the intercommunication policy based on the first routing information and the second routing information, and obtains the session key based on the intercommunication policy.

6. A VPN tunnel establishment device based on routing information, characterized in that: Applied to a first VPN encryption device, where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: A first sending module, configured to initiate a first Internet key exchange process to the second VPN encryption device; The second sending module is used to send the first routing information of the first network intercommunication with the first VPN encryption device to the second VPN encryption device, so that the second VPN encryption device responds to the first Internet key exchange process, configures the intercommunication policy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication policy.

7. A VPN tunnel establishment device based on routing information, characterized in that: Applied to the second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: A first receiving module, configured to respond to a first Internet key exchange process initiated by the first VPN encryption device; The second receiving module is used to receive the first routing information of the first network accessed by the first VPN encryption device, configure the intercommunication strategy based on the first routing information and the second routing information of the second network accessed by the second VPN encryption device, and obtain the session key between the first VPN encryption device and the second VPN encryption device based on the intercommunication strategy.

8. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the VPN tunnel establishment method based on routing information as described in any one of claims 1-3 or the VPN tunnel establishment method based on routing information as described in any one of claims 4-5.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program runs on a processor, the processor executes the method for establishing a VPN tunnel based on routing information as described in any one of claims 1 to 3 or the method for establishing a VPN tunnel based on routing information as described in any one of claims 4 to 5.

10. A computer program product, characterized in that When the computer program product runs on a processor, the processor executes the method for establishing a VPN tunnel based on routing information as described in any one of claims 1 to 3 or the method for establishing a VPN tunnel based on routing information as described in any one of claims 4 to 5.

Images