VPN tunnel establishment method and device based on flow triggering

Abstract

The invention belongs to the technical field of network encryption, and particularly discloses a VPN tunnel establishment method and device based on flow triggering. According to the method and the device, the existing negotiation IKE process is slightly transformed, and the first negotiation detection packet is sent to the first terminal, so that the second VPN encryption equipment intercepts the first negotiation detection packet and initiates the Internet key exchange process to the first VPN encryption equipment. And the first VPN encryption device configures an intercommunication strategy between the first VPN encryption device and the second VPN encryption device or expands the intercommunication strategy by responding to the Internet key exchange process to obtain a third negotiation detection packet. And sending the third negotiation detection packet to the second VPN encryption device, so that the second VPN encryption device obtains a session key between the second VPN encryption device and the first VPN encryption device based on the third negotiation detection packet, and the establishment of the VPN tunnel is completed, thereby realizing configuration-free intercommunication strategy between the VPN encryption devices, reducing the complexity of manual configuration, and improving the configuration efficiency.

Description

Technical Field

[0001] The present application belongs to the field of network encryption technology, and more specifically, to a method and device for establishing a VPN tunnel based on traffic triggering. Background Art

[0002] Virtual Private Network (VPN) technology uses the Internet Key Exchange (IKE) process to exchange negotiated keys. According to security policies, it uses the established VPN tunnel to encrypt and transmit network layer data. It can safely and reliably transmit messages on insecure open networks, effectively reducing the cost of secure transmission of private information on the network.

[0003] Normally, both parties in communication have unique public network addresses through dial-up or broadband Internet access. Through VPN encryption devices and other devices, a VPN tunnel can be established between the two parties in communication. To implement VPN functions between VPN encryption devices, a large number of manual configurations of intercommunication strategies are often required, especially in a multi-communication terminal or multi-network environment, which is complex and prone to errors. Summary of the invention

[0004] In view of the defects of the prior art, the purpose of this application is to provide a method and device for establishing a VPN tunnel based on traffic triggering, aiming to solve the problem that in the prior art, in order to realize the function of VPN between VPN encryption devices, a large amount of manual configuration of intercommunication strategies is often required, especially in a multi-communication terminal or multi-network environment, and the configuration is complex and error-prone.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a method for establishing a VPN tunnel based on traffic triggering, which is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0006] Sending a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device;

[0007] Responding to an Internet Key Exchange process;

[0008] receiving a second negotiation detection packet sent by the second VPN encryption device, and configuring an intercommunication policy or extending a configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet;

[0009] The third negotiation detection packet is sent to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

[0010] In some embodiments, configuring an intercommunication strategy according to the second negotiation detection packet includes:

[0011] When it is determined that no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, an intercommunication policy is established according to the IP address of the network IP message.

[0012] In some embodiments, the intercommunication strategy configured according to the second negotiation detection packet extension includes:

[0013] When it is determined that an intercommunication policy has been configured between the first VPN encryption device and the second VPN encryption device, the intercommunication policy is extended.

[0014] In some embodiments, before sending the first negotiation detection packet to the first terminal communicating with the second VPN encryption device, the method further includes:

[0015] The negotiation detection function of the first VPN encryption device is triggered according to the received network IP message sent by the third terminal accessing the network where the first VPN encryption device is located to the first terminal accessing the network where the second VPN encryption device is located.

[0016] In a second aspect, an embodiment of the present application provides a method for establishing a VPN tunnel based on traffic triggering, which is applied to a second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0017] Receiving a first negotiation detection packet sent by a first VPN encryption device;

[0018] Initiate an Internet key exchange process to the first VPN encryption device;

[0019] Sending a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures an intercommunication policy or extends a configured intercommunication policy according to the received second negotiation detection packet, and obtains a third negotiation detection packet;

[0020] A third negotiation detection packet sent by the first VPN encryption device is received, and a session key between the first VPN encryption device and the second VPN encryption device is obtained according to the third negotiation detection packet.

[0021] In a third aspect, the present application provides a VPN tunnel establishment device based on traffic triggering, which is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0022] A first sending module is used to send a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device;

[0023] A negotiation response module, used for responding to the Internet key exchange process;

[0024] A first receiving module is used to receive a second negotiation detection packet sent by a second VPN encryption device, and configure an intercommunication policy or extend the configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet;

[0025] The second sending module is used to send the third negotiation detection packet to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

[0026] In a fourth aspect, an embodiment of the present application provides a VPN tunnel establishment device based on traffic triggering, which is applied to a second VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, including:

[0027] A first receiving module, used to receive a first negotiation detection packet sent by a first VPN encryption device;

[0028] A negotiation initiation module, used to initiate an Internet key exchange process to the first VPN encryption device;

[0029] The second sending module is used to send a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures an intercommunication strategy or extends the configured intercommunication strategy according to the received second negotiation detection packet to obtain a third negotiation detection packet;

[0030] The second receiving module is used to receive the third negotiation detection packet sent by the first VPN encryption device, and obtain the session key between the first VPN encryption device and the second VPN encryption device according to the third negotiation detection packet.

[0031] In a fifth aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the programs stored in the memory are executed, the processor is used to execute the traffic-triggered VPN tunnel establishment method described in any embodiments of the first aspect or the second aspect.

[0032] In a sixth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the traffic-triggered VPN tunnel establishment method described in any one of the embodiments of the first aspect or the second aspect.

[0033] In a seventh aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the traffic-triggered VPN tunnel establishment method described in any embodiments of the first aspect or the second aspect.

[0034] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art:

[0035] The method and device for establishing a VPN tunnel based on traffic triggering provided in the embodiment of the present application, by slightly modifying the existing negotiation IKE process, sends a first negotiation detection packet to the first terminal, so that the second VPN encryption device intercepts the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device. The first VPN encryption device configures the intercommunication strategy between it and the second VPN encryption device or expands the intercommunication strategy by responding to the Internet key exchange process, and obtains a third negotiation detection packet. The second VPN encryption device obtains the session key between it and the first VPN encryption device based on the third negotiation detection packet, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the changes to the negotiation protocol of the existing negotiation IKE process are small, the versatility is strong, and it has certain practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is one of the flow charts of the VPN tunnel establishment method based on traffic triggering provided in the embodiment of the present application;

[0037] Figure 2 This is a schematic diagram of the working topology of the VPN encryption device provided in the embodiment of the present application;

[0038] Figure 3 This is a schematic diagram of the negotiation detection process provided by the embodiment of the present application;

[0039] Figure 4 This is the second flow chart of the VPN tunnel establishment method based on traffic triggering provided in the embodiment of the present application;

[0040] Figure 5 This is the third flow chart of the VPN tunnel establishment method based on traffic triggering provided in the embodiment of the present application;

[0041] Figure 6It is one of the structural schematic diagrams of the VPN tunnel establishment device based on traffic triggering provided in the embodiment of the present application;

[0042] Figure 7 This is the second structural diagram of the VPN tunnel establishment device based on traffic triggering provided in the embodiment of the present application;

[0043] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0046] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of objects. For example, a first terminal and a second terminal are used to distinguish different terminals rather than to describe a specific order of terminals.

[0047] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0048] In the description of the embodiments of the present application, unless otherwise specified, “plurality” means two or more than two.

[0049] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0050] See also Figure 1 , an embodiment of the present application provides a method for establishing a VPN tunnel based on traffic triggering, which may include: steps 110 to 140.

[0051] Step 110 sends a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device;

[0052] Step 120 is responsive to the Internet Key Exchange process;

[0053] Step 130: receiving a second negotiation detection packet sent by the second VPN encryption device, and configuring an intercommunication policy or extending the configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet;

[0054] Step 140 sends the third negotiation detection packet to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

[0055] The traffic-triggered VPN tunnel establishment method provided in the embodiment of the present application can be applied to a first VPN encryption device. By appropriately modifying the negotiation IKE process, it is suitable for automatically negotiating and establishing a VPN tunnel by traffic triggering when no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device that is interconnected with it, so as to facilitate the encrypted transmission of subsequent network data. The specific implementation is as follows.

[0056] In the embodiment of the present application, the first VPN encryption device and the second VPN encryption device are generally deployed at the network exit, and the data going out of the network is encrypted according to the intercommunication policy, and the data entering the network is decrypted according to the intercommunication policy.

[0057] like Figure 2 As shown, VPN encryption devices are deployed at the network exits of network A and network B, respectively. For example, a first VPN encryption device is deployed at the network exit of network A, and a second VPN encryption device is configured at the network exit of network B. In addition, no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device. The two VPN encryption devices transparently transmit the routing protocol, establish an intercommunication strategy for network IP data based on traffic triggering, and process it according to the intercommunication strategy.

[0058] Furthermore, in some embodiments, before sending the first negotiation detection packet to the first terminal communicating with the second VPN encryption device in step 110, the method may further include:

[0059] The negotiation detection function of the first VPN encryption device is triggered according to the received network IP message sent by the third terminal accessing the network where the first VPN encryption device is located to the first terminal accessing the network where the second VPN encryption device is located.

[0060] In the embodiment of the present application, when the intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, when a third terminal in the A network where the first VPN encryption device is located wants to communicate network data with a first terminal in the B network where the second VPN encryption device is located, the network IP message sent by the third terminal should be transmitted from the A network to the B network on the network under the control of the route, and finally transmitted to the first terminal.

[0061] When the intercommunication policy is not configured between the first VPN encryption device and the second VPN encryption device, the network IP message sent by the third terminal will not find the intercommunication policy and will be discarded when it is transmitted to the first VPN encryption device at the exit of network A. At this time, the negotiation detection function of the first VPN encryption device is triggered, and the first VPN encryption device will initiate a negotiation detection to the destination address of the triggered network IP message (i.e., the IP address of the first terminal), and send a negotiation detection packet to the first terminal, i.e., the first negotiation detection packet. Among them, the negotiation detection packet includes some device information configured by the first VPN encryption device for establishing a VPN tunnel based on the IKE process. For example, its own source IP address, the IP address of the second VPN encryption device, identity authentication information, encryption algorithm, security parameters for key exchange, etc.

[0062] The first negotiation detection packet will be transmitted to the B network under the control of the router. At this time, the second VPN encryption device of the B network will intercept the first negotiation detection packet and terminate the continued transmission of the network IP message. The second VPN encryption device responds to the first negotiation detection packet, sends a negotiation detection packet (i.e., the second negotiation detection packet) to the first VPN encryption device, and negotiates the IKE process with the first VPN encryption device. The second negotiation detection packet also includes the above-mentioned device information required for establishing a VPN tunnel based on the IKE process configured by the second VPN encryption device. For example, its own source IP address, the IP address of the first VPN encryption device, identity authentication information, encryption algorithm, security parameters for key exchange, etc.

[0063] Further, in some embodiments, in the above steps, configuring the intercommunication strategy according to the second negotiation detection packet may include:

[0064] When it is determined that no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, an intercommunication policy is established according to the IP address of the network IP message.

[0065] In the embodiment of the present application, the first VPN encryption device responds to the Internet key exchange process initiated by the second VPN encryption device, receives the second negotiation detection packet sent by the second VPN encryption device, and confirms the IP address of the second VPN encryption device according to the second negotiation detection packet. Since no intercommunication policy has been established between the two VPN encryption devices at this time, an intercommunication policy is established according to the IP address triggered by the traffic, and the intercommunication policy is sent to the second VPN encryption device as a negotiation detection packet (i.e., the third negotiation detection packet), and the subsequent negotiation IKE process continues.

[0066] After the second VPN encryption device receives the intercommunication policy sent by the first VPN encryption device, the intercommunication policy exchange is completed between the VPN encryption devices, and the session key established by the subsequent negotiation IKE process will use the intercommunication policy.

[0067] Further, in some embodiments, in the above steps, extending the configured intercommunication strategy according to the second negotiation detection packet includes:

[0068] When it is determined that an intercommunication policy has been configured between the first VPN encryption device and the second VPN encryption device, the intercommunication policy is extended.

[0069] In the above steps, after the first VPN encryption device receives the second negotiation detection packet sent by the second VPN encryption device, if it is confirmed that an intercommunication policy has been established between it and the second VPN encryption device, the configured intercommunication policy is extended and the extended intercommunication policy is sent to the second VPN encryption device as a negotiation detection packet (i.e., the third negotiation detection packet). At the same time, a notification is sent to the second VPN encryption device to inform it that the negotiation process is terminated.

[0070] After the second VPN encryption device receives the extended intercommunication policy sent by the first VPN encryption device, the intercommunication policy exchange is completed between the VPN encryption devices, and the session key established by the subsequent negotiation IKE process will use the extended intercommunication policy.

[0071] For example, Figure 2As shown, VPN encryption devices are generally deployed at the network exit, and encrypt the data going out of the network according to the security policy, and decrypt the data going into the network according to the security policy. When the third terminal in network A (assuming the IP address is 1.0.0.10) wants to communicate network data with the first terminal in network B (assuming the IP address is 2.0.0.10), the network IP message sent by the third terminal is transmitted from network A to network B on the network under the control of the route, and finally transmitted to the first terminal; when the network IP message sent by the third terminal is transmitted to the first VPN encryption device at the exit of network A, it will not find the intercommunication policy (1.0.0.10<->2.0.0.10) and will be discarded, at which time the negotiation detection function of the first VPN encryption device is triggered, and the first VPN encryption device will initiate a negotiation detection to the destination IP address (2.0.0.10) of the triggered network IP message, and send the first negotiation detection packet to the destination IP address (2.0.0.10) of the triggered network IP message, as shown in FIG. Figure 3 shown.

[0072] like Figure 3 As shown, the first negotiation detection packet will be transmitted to the B network under the control of the router. At this time, the second VPN encryption device of the B network will intercept the above-mentioned first negotiation detection packet and terminate the continued transmission of the network IP message. The second VPN encryption device responds to the first negotiation detection packet, sends the second negotiation detection packet to the first VPN encryption device, and initiates the negotiation IKE process to the first VPN encryption device.

[0073] like Figure 3 As shown, the first VPN encryption device receives the second negotiation detection packet from the second VPN encryption device and confirms the IP address of the second VPN encryption device. If the first VPN encryption device finds that no intercommunication policy has been established between it and the second VPN encryption device, it establishes an intercommunication policy according to the IP address triggered by the traffic (1.0.0.10<->2.0.0.10), and sends the intercommunication policy to the second VPN encryption device to continue the subsequent negotiation process.

[0074] like Figure 3 As shown, the second VPN encryption device receives the intercommunication policy sent by the second VPN encryption device. At this time, the intercommunication policy exchange is completed between the VPN encryption devices, and the session key established by the subsequent negotiation IKE process will use the intercommunication policy.

[0075] like Figure 3As shown, in the above steps, if the first VPN encryption device finds that an intercommunication policy has been established between it and the second VPN encryption device, the intercommunication policy is extended so that the extended intercommunication policy includes the IP address (1.0.0.10<->3.0.0.10) of the second terminal (assuming the IP address is 3.0.0.10) accessing the B network that triggers the negotiation detection, and at the same time sends a notification to the second VPN encryption device to inform it that the negotiation process has ended.

[0076] like Figure 3 As shown, if the intercommunication policy negotiation has been automatically established between the first VPN encryption device and the second VPN encryption device, and there is policy-outside traffic to the A network in the B network, it will trigger the negotiation detection function of the second VPN encryption device. The same method as above is used to configure the intercommunication policy between it and the first VPN encryption device or expand the configured intercommunication policy to complete the establishment of the VPN tunnel.

[0077] The traffic-triggered VPN tunnel establishment method provided in the embodiment of the present application, through a minor modification of the existing negotiation IKE process, sends a first negotiation detection packet to the first terminal, so that the second VPN encryption device intercepts the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device. The first VPN encryption device configures the intercommunication strategy between it and the second VPN encryption device or expands the intercommunication strategy by responding to the Internet key exchange process, and obtains a third negotiation detection packet. The second VPN encryption device obtains the session key between it and the first VPN encryption device based on the third negotiation detection packet, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the changes to the negotiation protocol of the existing negotiation IKE process are small, the versatility is strong, and it has certain practical value.

[0078] See also Figure 4 , an embodiment of the present application provides a method for establishing a VPN tunnel based on traffic triggering, which may include: steps 210 to 240.

[0079] Step 210: receiving a first negotiation detection packet sent by a first VPN encryption device;

[0080] Step 220 initiates an Internet key exchange process to the first VPN encryption device;

[0081] Step 230: sending a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures an intercommunication policy or extends a configured intercommunication policy according to the received second negotiation detection packet, and obtains a third negotiation detection packet;

[0082] Step 240 receives the third negotiation detection packet sent by the first VPN encryption device, and obtains the session key between the first VPN encryption device and the second VPN encryption device according to the third negotiation detection packet.

[0083] The traffic-triggered VPN tunnel establishment method provided in the embodiment of the present application can be applied to a second VPN encryption device. By appropriately modifying the negotiation IKE process, it is suitable for automatically negotiating and establishing a VPN tunnel by traffic triggering when no intercommunication policy is configured between a first VPN encryption device and a second VPN encryption device that is interconnected with it, so as to facilitate the encrypted transmission of subsequent network data. The specific implementation is as follows.

[0084] In the embodiment of the present application, the first VPN encryption device and the second VPN encryption device are generally deployed at the network exit, and the data going out of the network is encrypted according to the intercommunication policy, and the data entering the network is decrypted according to the intercommunication policy.

[0085] like Figure 2 As shown, VPN encryption devices are deployed at the network exits of network A and network B, respectively. For example, a first VPN encryption device is deployed at the network exit of network A, and a second VPN encryption device is configured at the network exit of network B. In addition, no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device. The two VPN encryption devices transparently transmit the routing protocol, establish an intercommunication strategy for network IP data based on traffic triggering, and process it according to the intercommunication strategy.

[0086] When configuring an intercommunication policy between the first VPN encryption device and the second VPN encryption device, when a third terminal in network A where the first VPN encryption device is located wants to perform network data communication with a first terminal in network B where the second VPN encryption device is located, the network IP message sent by the third terminal should be transmitted from network A to network B on the network under the control of routing, and finally transmitted to the first terminal.

[0087] When the intercommunication policy is not configured between the first VPN encryption device and the second VPN encryption device, the network IP message sent by the third terminal will not find the intercommunication policy and will be discarded when it is transmitted to the first VPN encryption device at the exit of network A. At this time, the negotiation detection function of the first VPN encryption device is triggered, and the first VPN encryption device will initiate a negotiation detection to the destination address of the trigger message (i.e., the IP address of the first terminal) and send a negotiation detection packet to the first terminal, i.e., the first negotiation detection packet. Among them, the negotiation detection packet includes some device information required for establishing a VPN tunnel based on the IKE process configured by the first VPN encryption device. For example, its own source IP address, the IP address of the second VPN encryption device, identity authentication information, encryption algorithm, security parameters for key exchange, etc.

[0088] The first negotiation detection packet will be transmitted to the B network under the control of the router. At this time, the second VPN encryption device of the B network will intercept the first negotiation detection packet and terminate the continued transmission of the network IP message. The second VPN encryption device responds to the first negotiation detection packet, sends a negotiation detection packet (i.e., the second negotiation detection packet) to the first VPN encryption device, and negotiates the IKE process with the first VPN encryption device.

[0089] The second negotiation detection packet also includes the above device information required for establishing a VPN tunnel based on the IKE process configured by the second VPN encryption device, such as its own source IP address, the IP address of the first VPN encryption device, identity authentication information, encryption algorithm, and security parameters for key exchange.

[0090] The first VPN encryption device responds to the Internet Key Exchange process initiated by the second VPN encryption device, receives the second negotiation detection packet sent by the second VPN encryption device, and confirms the IP address of the second VPN encryption device according to the second negotiation detection packet. Since no intercommunication policy has been established between the two VPN encryption devices at this time, an intercommunication policy is established according to the IP address triggered by the traffic, and the intercommunication policy is sent to the second VPN encryption device as a negotiation detection packet (i.e., the third negotiation detection packet), and the subsequent negotiation IKE process continues.

[0091] After the second VPN encryption device receives the intercommunication policy sent by the first VPN encryption device, the intercommunication policy exchange is completed between the VPN encryption devices, and the session key established by the subsequent negotiation IKE process will use the intercommunication policy.

[0092] In the above steps, after the first VPN encryption device receives the second negotiation detection packet sent by the second VPN encryption device, if it is confirmed that an intercommunication policy has been established between it and the second VPN encryption device, the configured intercommunication policy is extended and the extended intercommunication policy is used as the negotiation detection packet (i.e., the third negotiation detection packet).

[0093] The second VPN encryption device receives the third negotiation detection packet (i.e., the extended intercommunication policy) sent by the first VPN encryption device. At this time, the intercommunication policy exchange is completed between the VPN encryption devices, and the session key established by the subsequent negotiation IKE process will use the extended intercommunication policy.

[0094] See also Figure 5 The method for establishing a VPN tunnel based on traffic triggering provided in the embodiment of the present application may include:

[0095] The terminal in the network (assuming the first network) where the access initiator (which may be the first VPN encryption device or the second VPN encryption device) is located sends a network IP message to the terminal in the network (assuming the second network) where the responder (which may be the first VPN encryption device or the second VPN encryption device) is located;

[0096] When the network IP message sent by the terminal of the initiator's network is transmitted to the VPN encryption device at the first network exit, the intercommunication policy cannot be found and the message is discarded. At this time, the negotiation detection function of the VPN encryption device is triggered, and the first negotiation detection packet is sent to the VPN encryption device corresponding to the responder.

[0097] The VPN encryption device corresponding to the responder intercepts the first negotiation detection packet and terminates the further transmission of the network IP message, sends a second negotiation detection packet to the VPN encryption device corresponding to the initiator, and initiates a negotiation IKE process to it;

[0098] The VPN encryption device corresponding to the initiator receives the second negotiation detection packet, and when confirming that no intercommunication policy is configured between it and the VPN encryption device corresponding to the responder, establishes an intercommunication policy according to the IP address triggered by the traffic, and sends it to the responder as a third negotiation detection packet;

[0099] The responder receives the third negotiation detection packet. At this time, the VPN encryption devices have completed the exchange of intercommunication policies. The session key established by the subsequent negotiation IKE process will use the intercommunication policy.

[0100] When the VPN encryption device corresponding to the initiator confirms that an intercommunication policy is configured between it and the VPN encryption device corresponding to the responder, the VPN encryption device corresponding to the initiator extends the intercommunication policy and sends the extended intercommunication policy to the VPN encryption device corresponding to the responder. At the same time, a notification is sent to the VPN encryption device corresponding to the responder to inform it that the negotiation process is over.

[0101] The method for establishing a VPN tunnel based on traffic triggering provided in the embodiment of the present application, by making a minor modification to the existing negotiation IKE process, receives a first negotiation detection packet sent by a first VPN encryption device, and initiates an Internet key exchange process to the first VPN encryption device, so that the first VPN encryption device configures an intercommunication policy or extends the intercommunication policy by responding to the Internet key exchange process, and obtains a third negotiation detection packet. The second VPN encryption device obtains the session key between it and the first VPN encryption device based on the third negotiation detection packet sent by the first VPN encryption device, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication policy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the changes to the negotiation protocol of the existing negotiation IKE process are small, the versatility is strong, and it has certain practical value.

[0102] The following is a description of the VPN tunnel establishment device based on traffic triggering provided by the present application. The VPN tunnel establishment device based on traffic triggering described below and the VPN tunnel establishment method based on traffic triggering described above can refer to each other.

[0103] See also Figure 6 The embodiment of the present application provides a VPN tunnel establishment device based on traffic triggering, which is applied to a first VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, and may include:

[0104] The first sending module 610 is used to send a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device;

[0105] A negotiation response module 620, configured to respond to an Internet key exchange process;

[0106] The first receiving module 630 is used to receive the second negotiation detection packet sent by the second VPN encryption device, and configure the intercommunication policy or extend the configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet;

[0107] The second sending module 640 is configured to send the third negotiation detection packet to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

[0108] The VPN tunnel establishment device based on traffic triggering provided in the embodiment of the present application, through a minor modification of the existing negotiation IKE process, sends a first negotiation detection packet to the first terminal, so that the second VPN encryption device intercepts the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device. The first VPN encryption device configures the intercommunication strategy between it and the second VPN encryption device or expands the intercommunication strategy by responding to the Internet key exchange process, and obtains a third negotiation detection packet. The second VPN encryption device obtains the session key between it and the first VPN encryption device based on the third negotiation detection packet, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication strategy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the changes to the negotiation protocol of the existing negotiation IKE process are small, the versatility is strong, and it has certain practical value.

[0109] See also Figure 7The embodiment of the present application provides a VPN tunnel establishment device based on traffic triggering, which is applied to a second VPN encryption device, and no intercommunication strategy is configured between the first VPN encryption device and the second VPN encryption device, and may include:

[0110] The first receiving module 710 is used to receive a first negotiation detection packet sent by a first VPN encryption device;

[0111] A negotiation initiating module 720, configured to initiate an Internet key exchange process to the first VPN encryption device;

[0112] The second sending module 730 is used to send a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures an intercommunication policy or extends the configured intercommunication policy according to the received second negotiation detection packet to obtain a third negotiation detection packet;

[0113] The second receiving module 740 is configured to receive a third negotiation detection packet sent by the first VPN encryption device, and obtain a session key between the first VPN encryption device and the second VPN encryption device according to the third negotiation detection packet.

[0114] The VPN tunnel establishment device based on traffic triggering provided in the embodiment of the present application, through a minor modification of the existing negotiation IKE process, receives the first negotiation detection packet sent by the first VPN encryption device, and initiates the Internet key exchange process to the first VPN encryption device, so that the first VPN encryption device configures the intercommunication policy or extends the intercommunication policy by responding to the Internet key exchange process, and obtains the third negotiation detection packet. The second VPN encryption device obtains the session key between it and the first VPN encryption device based on the third negotiation detection packet sent by the first VPN encryption device, completes the establishment of the VPN tunnel, realizes the configuration-free intercommunication policy between VPN encryption devices, reduces the complexity of manual configuration, and improves configuration efficiency. At the same time, the changes to the negotiation protocol of the existing negotiation IKE process are small, the versatility is strong, and it has certain practical value.

[0115] It can be understood that the detailed functional implementation of each of the above-mentioned units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0116] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0117] Based on the method in the above embodiment, the present application embodiment provides an electronic device, see Figure 8The electronic device may include: a processor (Processor) 810, a communication interface (CommunicationsInterface) 820, a memory (Memory) 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the method in the above embodiment.

[0118] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0119] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0120] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0121] It is understandable that the processor in the embodiment of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0122] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0123] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0124] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0125] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for establishing a VPN tunnel based on traffic triggering, characterized in that: Applied to a first VPN encryption device, where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: Sending a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device; Responding to the Internet key exchange process; receiving a second negotiation detection packet sent by the second VPN encryption device, and configuring the intercommunication policy or extending the configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet; The third negotiation detection packet is sent to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

2. The method for establishing a VPN tunnel based on traffic triggering according to claim 1, characterized in that: The configuring the intercommunication strategy according to the second negotiation detection packet includes: When it is determined that the intercommunication policy is not configured between the first VPN encryption device and the second VPN encryption device, the intercommunication policy is established according to the IP address of the network IP message.

3. The method for establishing a VPN tunnel based on traffic triggering according to claim 1, characterized in that: The intercommunication strategy configured according to the second negotiation detection packet extension includes: When it is determined that the intercommunication policy has been configured between the first VPN encryption device and the second VPN encryption device, the intercommunication policy is extended.

4. The method for establishing a VPN tunnel based on traffic triggering according to any one of claims 1 to 3, characterized in that: Before sending the first negotiation detection packet to the first terminal communicating with the second VPN encryption device, the method further includes: A negotiation detection function of the first VPN encryption device is triggered according to a received network IP message sent by a third terminal accessing the network where the first VPN encryption device is located to a first terminal accessing the network where the second VPN encryption device is located.

5. A method for establishing a VPN tunnel based on traffic triggering, characterized in that: Applied to the second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: Receiving a first negotiation detection packet sent by the first VPN encryption device; Initiating the Internet key exchange process to the first VPN encryption device; Sending a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures the intercommunication policy or extends the configured intercommunication policy according to the received second negotiation detection packet, and obtains a third negotiation detection packet; The third negotiation detection packet sent by the first VPN encryption device is received, and a session key between the first VPN encryption device and the second VPN encryption device is obtained according to the third negotiation detection packet.

6. A VPN tunnel establishment device based on traffic triggering, characterized in that: Applied to a first VPN encryption device, where no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: A first sending module is used to send a first negotiation detection packet to a first terminal connected to the network where the second VPN encryption device is located, so that the second VPN encryption device receives the first negotiation detection packet and initiates an Internet key exchange process to the first VPN encryption device; A negotiation response module, used to respond to the Internet key exchange process; A first receiving module is used to receive a second negotiation detection packet sent by the second VPN encryption device, and configure the intercommunication policy or extend the configured intercommunication policy according to the second negotiation detection packet to obtain a third negotiation detection packet; The second sending module is configured to send the third negotiation detection packet to the second VPN encryption device, so that the second VPN encryption device obtains the session key between the first VPN encryption device and the second VPN encryption device based on the third negotiation detection packet.

7. A VPN tunnel establishment device based on traffic triggering, characterized in that: Applied to the second VPN encryption device, and no intercommunication policy is configured between the first VPN encryption device and the second VPN encryption device, including: A first receiving module, configured to receive a first negotiation detection packet sent by the first VPN encryption device; A negotiation initiating module, configured to initiate the Internet key exchange process to the first VPN encryption device; A second sending module is used to send a second negotiation detection packet to the first VPN encryption device, so that the first VPN encryption device configures the intercommunication policy or extends the configured intercommunication policy according to the received second negotiation detection packet to obtain a third negotiation detection packet; The second receiving module is configured to receive the third negotiation detection packet sent by the first VPN encryption device, and obtain a session key between the first VPN encryption device and the second VPN encryption device according to the third negotiation detection packet.

8. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the traffic-triggered VPN tunnel establishment method as described in any one of claims 1 to 4 or the traffic-triggered VPN tunnel establishment method as described in claim 5.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program runs on a processor, the processor executes the VPN tunnel establishment method based on traffic triggering as described in any one of claims 1 to 4 or the VPN tunnel establishment method based on traffic triggering as described in claim 5.

10. A computer program product, characterized in that When the computer program product runs on a processor, the processor executes the VPN tunnel establishment method based on traffic triggering according to any one of claims 1 to 4 or the VPN tunnel establishment method based on traffic triggering according to claim 5.

Images