VPN implementation method and device based on IPv6 address source verification, terminal equipment and storage medium

Abstract

The invention relates to a VPN implementation method and device based on IPv6 address source verification, terminal equipment and a storage medium, and the VPN implementation method comprises the steps: obtaining a fixed prefix of IPv6 as a basic address, obtaining a preset VPN identifier used for distinguishing different VPN instances, obtaining a random number identifier, designing and generating an address verification identifier according to the basic address, the preset VPN identifier and the random number identifier, and verifying the address verification identifier according to the address verification identifier. According to the method and the device, fields corresponding to a basic address, a preset VPN identifier, a random number identifier and an address verification identifier are spliced to generate a complete IPv6 address, the complete IPv6 address is used as a source address to package corresponding service data into a VPN data packet, and the VPN data packet is sent to a server through a network for communication, so that the implementation complexity and resource consumption are reduced, and the implementation efficiency is improved. The performance and the expandability of the network are improved, and the overall network burden of the VPN is greatly reduced on the whole.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a VPN implementation method, device, terminal equipment and storage medium based on IPv6 address source verification. Background Art

[0002] Traditional VPN technology mainly relies on complex encapsulation protocols and encryption methods to ensure the security and privacy of data transmission. However, this method leads to higher network resource processing overhead and higher configuration complexity, and the overall network management burden brought by traditional VPN technology is relatively large. Summary of the invention

[0003] The main purpose of the present application is to provide a VPN implementation method, apparatus, terminal device and storage medium based on IPv6 address source verification, aiming to solve the technical problem of heavy network management burden of traditional VPN communication technology.

[0004] The present application provides a VPN implementation method based on IPv6 address source verification, the VPN implementation method comprising: Get the fixed prefix of IPv6 as the base address; Obtaining a preset VPN identifier for distinguishing different VPN instances; Get the random number identifier; Design and generate an address verification identifier based on the basic address, the preset VPN identifier and the random number identifier; The fields corresponding to the basic address, the preset VPN identifier, the random number identifier, and the address verification identifier are concatenated to generate a complete IPv6 address; Use the complete IPv6 address as the source address to encapsulate the corresponding service data into a VPN data packet; Send VPN packets over the network to the server for communication.

[0005] In one embodiment, the step of designing and generating an address verification identifier according to a basic address, a preset VPN identifier, and a random number identifier includes: A specific field consisting of a basic address, a preset VPN identifier, and a random number identifier is operated according to a hash algorithm to generate a check value of a fixed length; Get the preset field of the verification value as the address verification identifier.

[0006] In one embodiment, the preset field is The first 48 bits of the field corresponding to the check value.

[0007] In one embodiment, the IPv6 address is 128 bits, and bits 65 to 72 of the IPv6 address are set with a preset VPN identifier.

[0008] In one embodiment, bits 73 to 80 in the IPv6 address are used to set a random number identifier.

[0009] In addition, a VPN implementation method based on IPv6 address source verification is provided, and the VPN implementation method includes: Receive VPN data packets sent by VPN clients; Extracting a corresponding IPv6 address according to the VPN data packet, where the IPv6 address includes a preset VPN identifier, a random number identifier, and a verification identifier; Verify the IPv6 address to determine the validity of the preset VPN identifier, the legitimacy of the random number identifier, and the correctness of the verification identifier; When the validity of the preset VPN identifier, the legality of the random number identifier, and the correctness of the verification identifier all meet the preset requirements, the VPN data packet is parsed to obtain the corresponding service data and routing information; Forward business data to the target network or host based on routing information.

[0010] In one embodiment, the VPN implementation method further includes: When any one of the validity of the preset VPN identifier, the legality of the random number identifier, and the correctness of the verification identifier does not meet the preset requirements, the verification is determined to be unsuccessful, and the VPN data packet is discarded.

[0011] In addition, a VPN implementation device based on IPv6 address source verification is also provided, and the VPN implementation device includes: A first acquisition unit, used to acquire a fixed prefix of IPv6 as a basic address; A second acquisition unit, used to acquire a preset VPN identifier for distinguishing different VPN instances; A third acquisition unit, used to acquire a random number identifier; A verification identifier generation unit, used to generate an address verification identifier according to a basic address, a preset VPN identifier and a random number identifier; An IPv6 address generation unit is used to concatenate the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address; A data packet generating unit, used to encapsulate the corresponding service data into a VPN data packet by using the complete IPv6 address as the source address; The data packet sending unit is used to send the VPN data packet to the server through the network for communication.

[0012] In addition, a terminal device is also provided, the terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the steps of the VPN implementation method are implemented when the computer program is executed by the processor.

[0013] In addition, a readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above VPN implementation method are implemented.

[0014] The above-mentioned VPN implementation method based on IPv6 address source verification includes obtaining a fixed prefix of IPv6 as a basic address; obtaining a preset VPN identifier for distinguishing different VPN instances; obtaining a random number identifier, designing and generating an address verification identifier according to the basic address, the preset VPN identifier and the random number identifier, splicing the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address, using the IPv6 address as the source address to encapsulate the corresponding business data into a VPN data packet, and sending the VPN data packet to the server through the network for communication. The VPN implementation method aims to utilize the characteristics of the IPv6 address structure, through a specific address allocation and verification mechanism, through a preset VPN identifier and a random number identifier, so as to allow flexible configuration according to the security requirements and address planning strategies of different enterprises, improve the security of data transmission, realize the simplification and efficiency of VPN functions, and do not use complex encapsulation protocols and encryption methods, reduce the implementation complexity and resource consumption, improve the performance and scalability of the network, and greatly reduce the overall network burden of VPN as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of a VPN implementation method based on IPv6 address source verification provided in an embodiment of the present application; Figure 2 A schematic diagram of a method flow for obtaining an address verification identifier provided in an embodiment of the present application; Figure 3 A flowchart of another VPN implementation method based on IPv6 address source verification provided in an embodiment of the present application; Figure 4 A schematic block diagram of a VPN implementation device based on IPv6 address source verification provided by an embodiment of the present application; Figure 5 This is a schematic block diagram of the internal structure of a terminal device according to an embodiment of the present application.

[0016] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0017] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0018] In addition, if the descriptions of "first", "second", etc. are involved in this application, they are only used for descriptive purposes (such as for distinguishing the same or similar elements), and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0019] The present application provides a VPN implementation method based on IPv6 address source verification, the VPN implementation method comprising: Step S110, obtaining the fixed prefix of IPv6 as the basic address.

[0020] Among them, a fixed IPv6 / 64 prefix is ​​used as the basis to ensure the uniqueness and manageability of the address.

[0021] Step S120: Obtain a preset VPN identifier for distinguishing different VPN instances.

[0022] The preset VPN identifier is used to distinguish different VPN instances and realize the coexistence and management of multiple VPNs.

[0023] Step S130, obtaining a random number identifier.

[0024] The random number identifier can increase the diversity and security of the address, and the width of the random number can be customized according to the actual needs of the enterprise.

[0025] The customizability of the random number width enables this method to be flexibly adjusted according to the security requirements and address planning strategies of different enterprises to meet diverse network application scenarios.

[0026] Step S140: Design and generate an address verification identifier according to the basic address, the preset VPN identifier and the random number identifier.

[0027] The checksum can be used to verify the source and integrity of VPN packets.

[0028] Step S150, concatenate the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address.

[0029] Step S160: Use the complete IPv6 address as the source address to encapsulate the corresponding service data into a VPN data packet.

[0030] The VPN client generates an IPv6 address in a specific format according to preset rules and parameters, which includes a preset VPN identifier, a random number identifier, and an address verification identifier.

[0031] Step S170, sending the VPN data packet to the server through the network for communication.

[0032] The VPN client uses the generated IPv6 address as the source address, encapsulates the service data into a VPN data packet, and sends it to the VPN server through the network.

[0033] The above-mentioned VPN implementation method based on IPv6 address source verification includes obtaining a fixed prefix of IPv6 as a basic address; obtaining a preset VPN identifier for distinguishing different VPN instances; obtaining a random number identifier, designing and generating an address verification identifier according to the basic address, the preset VPN identifier and the random number identifier, splicing the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address, using the IPv6 address as the source address to encapsulate the corresponding business data into a VPN data packet, and sending the VPN data packet to the server through the network for communication. The VPN implementation method aims to utilize the characteristics of the IPv6 address structure, through a specific address allocation and verification mechanism, through a preset VPN identifier and a random number identifier, so as to allow flexible configuration according to the security requirements and address planning strategies of different enterprises, improve the security of data transmission, realize the simplification and efficiency of VPN functions, and do not use complex encapsulation protocols and encryption methods, reduce the complexity and resource consumption of VPN implementation, improve the performance and scalability of the network, and greatly reduce the overall network burden of VPN as a whole.

[0034] The above-mentioned VPN implementation method based on IPv6 address source verification is applicable to various application scenarios that require rapid construction of secure communication channels, such as remote office, cloud computing, Internet of Things, etc. Through the implementation of the present invention, enterprises can deploy VPN more conveniently and ensure the security and privacy of data transmission, thereby meeting the growing network security needs.

[0035] In one embodiment, Figure 2As shown, step S140 includes: Step S141, performing operation on a specific field consisting of a basic address, a preset VPN identifier and a random number identifier according to a hash algorithm to generate a check value of a fixed length.

[0036] Step S142, obtaining a preset field of the verification value as an address verification identifier.

[0037] In this example, the introduction of random numbers and hash verification mechanisms improves the uniqueness of addresses and the security of data transmission, effectively preventing security risks such as address spoofing and data tampering.

[0038] In one embodiment, the preset field is the first 48 bits of the field corresponding to the check value.

[0039] In one embodiment, the IPv6 address is 128 bits, and bits 65 to 72 of the IPv6 address are set with a preset VPN identifier. In one embodiment, bits 73 to 80 of the IPv6 address are used to set a random number identifier.

[0040] Among them, the settings of the preset VPN identifier and the random number identifier can be set according to the enterprise itself, and multiple identifiers can also be set. For example, the random number identifier can be set to 2 8-bit bit widths.

[0041] In addition, if Figure 3 As shown, a VPN implementation method based on IPv6 address source verification is also provided, and the VPN implementation method includes: Step S210, receiving a VPN data packet sent by a VPN client.

[0042] Step S220: extract the corresponding IPv6 address according to the VPN data packet, where the IPv6 address includes a preset VPN identifier, a random number identifier and a verification identifier.

[0043] Step S230, verifying the IPv6 address to determine the validity of the preset VPN identifier, the legitimacy of the random number identifier, and the correctness of the verification identifier.

[0044] Step S240: When the validity of the preset VPN identifier, the legality of the random number identifier and the correctness of the verification identifier all meet the preset requirements, the VPN data packet is parsed to obtain corresponding service data and routing information.

[0045] In this example, the IPv6 address contains both the identification information of the VPN and a verification mechanism based on random numbers, which effectively verifies the source of the VPN data packet and simplifies the complex encapsulation process of the traditional VPN.

[0046] Step S250: forwarding the service data to the target network or host according to the routing information.

[0047] In one embodiment, Figure 3 As shown, the VPN implementation method further includes: Step S260: When any one of the validity of the preset VPN identifier, the legality of the random number identifier, and the correctness of the verification identifier does not meet the preset requirements, it is determined that the verification fails, and the VPN data packet is discarded.

[0048] In addition, if Figure 4 As shown, a VPN implementation device 200 based on IPv6 address source verification is also provided, and the VPN implementation device 300 includes: A first acquisition unit 310 is used to acquire a fixed prefix of IPv6 as a basic address; The second acquisition unit 320 is used to acquire a preset VPN identifier for distinguishing different VPN instances; The third acquisition unit 330 is used to acquire a random number identifier; A verification identifier generating unit 340 is used to generate an address verification identifier according to a basic address, a preset VPN identifier and a random number identifier; The IPv6 address generation unit 350 is used to concatenate the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address; The data packet generating unit 360 is used to encapsulate the corresponding service data into a VPN data packet by using the complete IPv6 address as the source address; The data packet sending unit 370 is used to send the VPN data packet to the server through the network for communication.

[0049] In addition, a terminal device is also provided in an embodiment of the present application. The internal structure of the terminal device can be as follows: Figure 5 As shown. The terminal device includes a processor, a memory, a communication interface and a database connected via a system bus. The processor is used to provide computing and control capabilities. The memory of the terminal device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the terminal device is used to store data called by the computer program. The communication interface of the terminal device is used to communicate data with an external terminal. The input device of the terminal device is used to receive a signal input by an external device. When the computer program is executed by the processor, a VPN implementation method as described in the above embodiment is implemented.

[0050] Those skilled in the art will understand that Figure 5The structure shown in is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the terminal device to which the solution of the present application is applied.

[0051] In addition, the present application also proposes a readable storage medium, the readable storage medium includes a computer program, and the computer program, when executed by a processor, implements the steps of the VPN implementation method as described in the above embodiment. It can be understood that the readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0052] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0053] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0054] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A VPN implementation method based on IPv6 address source verification, characterized in that: include: Get the fixed prefix of IPv6 as the base address; Obtaining a preset VPN identifier for distinguishing different VPN instances; Get the random number identifier; Design and generate an address verification identifier based on the basic address, the preset VPN identifier and the random number identifier; Concatenate the fields corresponding to the basic address, the preset VPN identifier, the random number identifier, and the address verification identifier to generate a complete IPv6 address; Using the complete IPv6 address as the source address to encapsulate the corresponding service data into a VPN data packet; The VPN data packet is sent to the server through the network for communication.

2. The VPN implementation method according to claim 1, characterized in that: The step of designing and generating an address verification identifier according to the basic address, the preset VPN identifier and the random number identifier comprises: Performing operations on a specific field consisting of the basic address, the preset VPN identifier, and the random number identifier according to a hash algorithm to generate a check value of a fixed length; A preset field of the verification value is obtained as an address verification identifier.

3. The VPN implementation method according to claim 2, characterized in that: The preset fields are The first 48 bits of the field corresponding to the check value.

4. The VPN implementation method according to claim 1, characterized in that: The IPv6 address The IPv6 address is 128 bits, and bits 65 to 72 of the IPv6 address are provided with the preset VPN identifier.

5. The VPN implementation method according to claim 4, characterized in that: Bits 73 to 80 in the IPv6 address are used to set the random number identifier.

6. A VPN implementation method based on IPv6 address source verification, characterized in that: include: Receiving a VPN data packet sent by the VPN client; Extracting a corresponding IPv6 address according to the VPN data packet, wherein the IPv6 address includes a preset VPN identifier, a random number identifier, and a verification identifier; Verifying the IPv6 address to determine the validity of the preset VPN identifier, the legitimacy of the random number identifier, and the correctness of the verification identifier; When the validity of the preset VPN identifier, the legality of the random number identifier, and the correctness of the verification identifier all meet the preset requirements, performing data parsing processing on the VPN data packet to obtain corresponding service data and routing information; The service data is forwarded to the target network or host according to the routing information.

7. The VPN implementation method according to claim 6, characterized in that: Also includes: When any one of the validity of the preset VPN identifier, the legality of the random number identifier and the correctness of the verification identifier does not meet the preset requirements, it is determined that the verification fails and the VPN data packet is discarded.

8. A VPN implementation device based on IPv6 address source verification, characterized in that: include: A first acquisition unit, used to acquire a fixed prefix of IPv6 as a basic address; A second acquisition unit, used to acquire a preset VPN identifier for distinguishing different VPN instances; A third acquisition unit, used to acquire a random number identifier; A verification identifier generating unit, used to generate an address verification identifier according to the basic address, a preset VPN identifier and a random number identifier; An IPv6 address generation unit is used to concatenate the fields corresponding to the basic address, the preset VPN identifier, the random number identifier and the address verification identifier to generate a complete IPv6 address; A data packet generating unit, configured to use the complete IPv6 address as a source address to encapsulate the corresponding service data into a VPN data packet; The data packet sending unit is used to send the VPN data packet to the server through the network for communication.

9. A terminal device, characterized in that: The terminal device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the VPN implementation method according to any one of claims 1 to 7 when executed by the processor.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the VPN implementation method according to any one of claims 1 to 7 are implemented.

Images