Embedded emergency communication method and system based on adaptive IPSEC technology

Abstract

The invention relates to the field of network communication security, in particular to an embedded emergency communication method and system based on a self-adaptive IPSEC (Internet Protocol Security) technology. The communication method comprises the following steps of: configuring a network range capable of adapting to IP address change at an embedded device end; a fixed public network IP address and a corresponding network range are configured at the server; an IPSEC tunnel is established between the embedded device end and the server end, data transmission is carried out through the IPSEC tunnel, and meanwhile the embedded device end and the server end are configured to use the same encryption, decryption and authentication protocol; and compressing and decompressing the data transmitted through the IPSEC tunnel by adopting a differential data compression technology. Through the self-adaptive IPSEC technology, an embedded device end is allowed to configure a network range capable of adapting to IP address changes, so that the complexity of configuring a VPN in an environment with frequent IP address changes is simplified.

Description

Technical Field

[0001] The invention relates to the field of network communication security, in particular to an embedded emergency communication method and system based on adaptive IPSEC technology. Background Art

[0002] With the continuous development and popularization of the Internet, modern society pays more and more attention to information security. Due to the particularity of the industry, the special field of emergency communication has higher requirements for the secure transmission of information. In order to ensure the security of information transmission, the emergency communication field often uses dedicated network cards through embedded devices for communication. However, since dedicated network cards do not have public network functions, the popularity of their use is not high. Therefore, the use of virtual private network (VPN) technology (that is, through data encryption technology, data is transmitted on a dedicated data link) in the field of emergency communication came into being.

[0003] Currently, the commonly used virtual private network technologies are IPSEC VPN and SSL VPN. These two virtual private network technologies have their own advantages and disadvantages. The biggest advantage of SSL VPN is that it is easy to configure. Users only need a browser to access the target server. However, in the emergency communication industry, it is easy to access the target server in various environments with browsers, which means low security. This has become its biggest disadvantage in the field of emergency communication with extremely high information security requirements. IPSEC VPN requires professional software to configure the network parameters and network policies of both devices, as well as the IP status. This naturally forms a layer of protection, and with the dual protection of username and password, it has higher security. Therefore, the more secure IPSEC VPN has become a better choice in the field of emergency communication.

[0004] IPSEC is a standard network data security transmission protocol. The current usage of IPSEC VPN mainly includes AH header, ESP encapsulation and IKMP key management. Due to its requirements for security and integrity, traditional IPSEC VPN needs to set both network parameters and network policies, which inevitably leads to complex setup process and high modification cost. Especially in the use of emergency communication embedded devices, since 4G / 5G public network cards are often used, the IP address of the public network card will change due to the change of location when it is connected to different base stations, which will also cause the configuration cost of traditional IPSEC VPN to be extremely high. However, due to the particularity of its use, traditional IPSEC VPN often finds it difficult to solve this problem. Summary of the invention

[0005] The purpose of the present invention is to provide an embedded emergency communication method and system based on adaptive IPSEC technology, which can improve the configuration convenience, security and network transmission efficiency of embedded devices in the field of emergency communication when using IPSEC VPN, especially when the IP address of the device changes frequently.

[0006] To achieve the above object, on the one hand, the present invention provides an embedded emergency communication method based on adaptive IPSEC technology, the communication method comprising the following steps:

[0007] Configure a network range on the embedded device that can adapt to changes in IP addresses;

[0008] Configure a fixed public IP address and the corresponding network range on the server;

[0009] Establishing an IPSEC tunnel between the embedded device and the server, and transmitting data through the IPSEC tunnel, while configuring the embedded device and the server to use the same encryption, decryption and authentication protocol;

[0010] The differential data compression technology is used to compress and decompress the data transmitted through the IPSEC tunnel.

[0011] Furthermore, the establishment of the IPSEC tunnel includes the processes of authentication, encryption and decryption, and both the embedded device and the server at both ends need to be configured when the IPSEC tunnel is first established, and the configuration can be automatically completed later.

[0012] Furthermore, the compression process includes the following steps:

[0013] Determining whether the original message can be sent as a reference message;

[0014] If it cannot be used as a reference message, the original message and the reference message are differentiated and then compressed according to a compression algorithm;

[0015] Encapsulates the compressed information header content, including the reference message identifier, compression algorithm identifier and current message identifier.

[0016] Furthermore, the decompression process includes the following steps:

[0017] Receiving an encapsulated IP message from the IPSEC tunnel;

[0018] Removing header information of each layer in the IPSEC tunnel;

[0019] Determine whether it is a reference message. If so, update the reference message and compressed header information. If not, remove the compressed header information, perform corresponding decompression processing, and restore the original message.

[0020] In another aspect of the present invention, the present invention also provides an embedded emergency communication system based on adaptive IPSEC technology, the system comprising:

[0021] Embedded device-side module, used to configure a network range that can adapt to IP address changes and establish IPSEC tunnels for data transmission;

[0022] The server module is used to configure a fixed public IP address and the corresponding network range, and establish an IPSEC tunnel with the embedded device for data transmission.

[0023] Furthermore, the system also includes an encryption and decryption module for configuring the same encryption, decryption and authentication protocol between the embedded device and the server.

[0024] Furthermore, the system also includes a differential data compression module for compressing and decompressing data transmitted through the IPSEC tunnel.

[0025] Furthermore, the differential data compression module also includes:

[0026] A judging unit, used to judge whether the original message can be sent as a reference message;

[0027] A differential processing unit, used for performing differential processing on an original message that cannot be used as a reference message and a reference message;

[0028] A compression algorithm unit, used for executing a compression algorithm to perform compression processing according to the difference result;

[0029] The encapsulation unit is used to encapsulate the compressed information header content, including the reference message identifier, the compression algorithm identifier and the current message identifier.

[0030] Furthermore, the system further includes a decompression module, and the decompression module includes:

[0031] A receiving unit, used for receiving encapsulated IP packets from the IPSEC tunnel;

[0032] Header information removal unit, used to remove the header information of each layer in the IPSEC tunnel;

[0033] A reference message judging unit, used to judge whether a received message is a reference message;

[0034] An updating unit, used for updating the reference message and the compressed header information when it is determined to be a reference message;

[0035] The decompression processing unit is used to perform corresponding decompression processing to restore the original message.

[0036] Compared with the prior art, the present invention has at least the following technical effects:

[0037] The present invention uses adaptive IPSEC technology to allow embedded devices to configure a network range that can adapt to changes in IP addresses, thereby simplifying the complexity of configuring VPNs in environments where IP addresses change frequently. Users only need to complete configuration once on the server, and all subsequent devices can complete configuration adaptively according to network conditions, greatly reducing configuration difficulty and maintenance costs.

[0038] In addition, the present invention can reduce redundancy in data transmission and improve network transmission efficiency through differential data compression technology, especially in environments with limited bandwidth or poor network conditions, effectively solving the problem of mutual restriction between security and performance in traditional IPSEC VPN. At the same time, this compression technology not only improves the utilization rate of network bandwidth, but also reduces the negative correlation between security and performance, so that while ensuring data transmission security, higher transmission performance can also be obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flow chart of an embedded emergency communication method based on adaptive IPSEC technology in one embodiment of the present invention;

[0040] Figure 2 This is a schematic diagram of the operation principle of IPSEC VPN in one embodiment of the present invention;

[0041] Figure 3 A schematic diagram of a message differential compression technology process in one embodiment of the present invention;

[0042] Figure 4 A schematic diagram of a compression process in one embodiment of the present invention;

[0043] Figure 5 A schematic diagram of a decompression process in one embodiment of the present invention;

[0044] Figure 6 This is a comparison diagram of the effects before and after compression in one embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be described in more detail in conjunction with the schematic diagram of an embedded emergency communication method and system based on adaptive IPSEC technology of the present invention, wherein a preferred embodiment of the present invention is shown, and it should be understood that those skilled in the art can modify the present invention described herein, and still achieve the beneficial effects of the present invention. Therefore, the following description should be understood as being widely known to those skilled in the art, and not as a limitation of the present invention.

[0046] For the sake of clarity, not all features of the actual embodiments are described. In the following description, well-known functions and structures are not described in detail because they would clutter the invention with unnecessary detail. It should be recognized that in the development of any actual embodiment, a large number of implementation details must be made to achieve the developer's specific goals, such as changing from one embodiment to another according to the limitations of the relevant system or the relevant business. In addition, it should be recognized that such development work may be complex and time-consuming, but it is just a routine task for those skilled in the art.

[0047] The present invention is described in more detail in the following paragraphs by way of example with reference to the accompanying drawings. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are in very simplified form and are not in exact proportions, and are only used to facilitate and clearly assist in illustrating the purpose of the embodiments of the present invention.

[0048] As mentioned in the background technology, traditional IPSEC VPN technology has problems with complex setup process and high modification cost when used in the field of emergency communications. Especially when embedded devices use 4G / 5G public network cards, the IP address may change due to location changes, resulting in extremely high configuration costs, which makes it difficult to adapt to the high requirements for secure information transmission in emergency communications.

[0049] In view of this, if Figure 1 As shown, on the one hand, this embodiment proposes an embedded emergency communication method based on adaptive IPSEC technology, and the communication method includes the following steps:

[0050] Configure a network range on the embedded device that can adapt to changes in IP addresses;

[0051] Configure a fixed public IP address and the corresponding network range on the server;

[0052] Establishing an IPSEC tunnel between the embedded device and the server, and transmitting data through the IPSEC tunnel, while configuring the embedded device and the server to use the same encryption, decryption and authentication protocol;

[0053] The differential data compression technology is used to compress and decompress the data transmitted through the IPSEC tunnel.

[0054] Specifically, Figure 2As shown, the embedded device transmits data through the public network, and the embedded device forms an IPSEC tunnel through the IPSEC VPN software. When the actual physical link remains unchanged, the IPSEC VPN software at both ends is used for authentication, encryption and decryption to exchange data. The embedded device adopts adaptive technology. Due to the use environment, the IP address of the embedded device often changes to different values. The adaptive technology only needs to configure a local network range in the embedded device, and the IP address of the local end will be adaptively configured in the code of the IPSEC VPN software, and only the local IP address range needs to conform to the local network range. Therefore, it is only necessary to write a larger network range when configuring the local network range of the embedded device, for example: 10.0.0.0 / 8, so that the embedded devices with IP addresses within this range can be used normally. As the network topology of the opposite end is fixed, the public network address is fixed when configuring the opposite end (server) network, and the opposite end range is also fixed. Both parties only need to configure the encryption and decryption method and the authentication method to the same method for normal use.

[0055] In addition, adaptive technology has another advantage. After the embedded device and the server successfully form an IPSEC VPN tunnel, the remaining devices can be configured according to the configuration. If the server network topology remains unchanged, all embedded devices can adaptively complete the IPSEC VPN tunnel without manual operation and debugging. This can greatly reduce the cost of emergency communication process and truly realize the function of being ready to use after power-on.

[0056] Furthermore, the adaptive IPSEC VPN technology can also solve the negative correlation problem between security and performance. The main reason for this problem is that there are a lot of encapsulations in the current network transmission technology, and VPN, a technology with high security requirements, needs to go through a lot of encryption and decryption processes to improve its security. This process will undoubtedly lead to poor data transmission performance in some scenarios with poor network conditions and limited bandwidth. Therefore, to solve this problem, the adaptive IPSEC VPN technology adopts the message differential compression technology based on messages.

[0057] In this embodiment, if Figure 3 As shown, the message differential compression technology analyzes the original message in depth, selects the reference message, performs differential analysis and compression, and flexibly and efficiently compresses the grouped messages. This greatly reduces the redundant and repeated information in the original message, effectively improves the transmission efficiency, and greatly reduces the problem of negative correlation between security and performance.

[0058] In this embodiment, if Figure 4As shown, the compression process is performed according to the original message in step S101 to determine whether it can be sent as a reference message in step S102. If it cannot be used as a reference message, it goes to step S103 to make a difference between the original message and the reference message. After completion, it is compressed according to the compression algorithm in step S104. After compression is completed, step S105 is performed to encapsulate the compressed information header content (including the reference message identifier, the compression algorithm identifier, and the current message identifier) ​​to facilitate subsequent decompression to restore the original message, and then step S106 is performed to encapsulate the header information of each layer of the tunnel, and finally step S110 is performed to send the data to the tunnel opposite end (i.e., the VPN server end). If it can be sent as a reference message, step S107 is executed to update the stored reference message, and then step S108 is executed to superimpose 1 on the reference message identifier. After completion, step S109 is executed to encapsulate the compressed information header content, i.e., the reference message identifier, the compression algorithm identifier, and the current message identifier. Finally, step S110 is executed to send the data to the tunnel opposite end.

[0059] In this embodiment, if Figure 5 As shown, the decompression process is the reverse process of the compression process. First, step S201 is executed to receive the encapsulated IP message from the IPSEC tunnel, and then step S202 is executed to remove the header information of each layer in the tunnel, and then step S203 is executed to determine whether it is a reference message. If it is a reference message, step S207 is executed to update the reference message and the compression header information (the compression header information is used to indicate the reverse differential operation), and then step S208 is executed to remove the compression header information content, and finally step S209 is executed to send the original data packet downstream. If it is not a reference message, step S204 is executed to remove the compression information header content, and after completion, step S205 is executed to select the compression algorithm according to the compression information header to perform the corresponding decompression processing on the obtained message, and then step S206 is executed to select the reference message according to the compression information header to perform reverse differential between the decompressed message and the reference message to obtain the original message, and finally step S209 is executed to send the original data packet downstream.

[0060] Therefore, the overall adaptive IPSEC VPN is divided into two parts. The first part is that the first embedded device completes the initial configuration according to the network topology information of the IPSEC VPN server (the other end). After that, when the network topology of the IPSEC VPN server (the other end) remains unchanged, the embedded device can automatically complete the configuration after starting the function to ensure that the IPSEC VPN tunnel can be easily and conveniently enabled. In addition, the remaining embedded devices only need to upgrade the same version to complete the adaptive configuration. The second part is to complete the compression of data content through differential data compression technology, such as Figure 6The comparison chart of the effects before and after using the differential data compression technology shows that the method can effectively improve the device bandwidth utilization and network transmission efficiency, and provides a feasible solution for users with harsh network environments and limited bandwidth resources, with high use value.

[0061] In addition, adaptive IPSEC VPN technology has the advantages of strong controllability, high security and high stability of traditional IPSEC VPN technology, and on this basis simplifies the usage process and facilitates user use. Users only need to complete the configuration once on the server, and the device will adaptively complete the configuration. In subsequent use, as long as the IPSEC VPN function is turned on, the device will adaptively complete the IPSEC VPN configuration according to the existing network conditions and IP policy settings, greatly reducing the negative correlation between security and performance. For the client, when the transmission bandwidth remains unchanged, it can reduce data redundancy, improve performance utilization, improve network transmission efficiency, and greatly improve network bandwidth utilization.

[0062] On the other hand, this embodiment also proposes an embedded emergency communication system based on adaptive IPSEC technology, the system comprising: an embedded device-side module, used to configure a network range that can adapt to changes in IP addresses, and establish an IPSEC tunnel for data transmission; a server-side module, used to configure a fixed public IP address and a corresponding network range, and establish an IPSEC tunnel with the embedded device side for data transmission; an encryption and decryption module, used to configure the same encryption, decryption and authentication protocol between the embedded device side and the server side; a differential data compression module, used to compress and decompress data transmitted through the IPSEC tunnel.

[0063] Furthermore, the differential data compression module also includes: a judgment unit, used to judge whether the original message can be sent as a reference message; a differential processing unit, used to perform differential processing on the original message and the reference message that cannot be used as a reference message; a compression algorithm unit, used to execute the compression algorithm for compression processing according to the differential result; and an encapsulation unit, used to encapsulate the compressed information header content, including a reference message identifier, a compression algorithm identifier and a current message identifier.

[0064] Furthermore, the system also includes a decompression module, which includes: a receiving unit, used to receive encapsulated IP messages from the IPSEC tunnel; a header information removal unit, used to remove the header information of each layer in the IPSEC tunnel; a reference message judgment unit, used to judge whether the received message is a reference message; an update unit, used to update the reference message and compression header information when it is judged to be a reference message; and a decompression processing unit, used to perform corresponding decompression processing and restore the original message.

[0065] In summary, in an embedded emergency communication method and system based on adaptive IPSEC technology provided by an embodiment of the present invention, adaptive IPSEC technology is used to allow the embedded device to configure a network range that can adapt to changes in IP addresses, thereby simplifying the complexity of configuring VPN in an environment where IP addresses change frequently. The user only needs to complete the configuration once on the server, and all subsequent devices can complete the configuration adaptively according to the network situation, greatly reducing the configuration difficulty and maintenance cost.

[0066] In addition, the present invention can reduce redundancy in data transmission and improve network transmission efficiency through differential data compression technology, especially in environments with limited bandwidth or poor network conditions, effectively solving the problem of mutual restriction between security and performance in traditional IPSEC VPN. At the same time, this compression technology not only improves the utilization rate of network bandwidth, but also reduces the negative correlation between security and performance, so that while ensuring data transmission security, higher transmission performance can also be obtained.

[0067] The above is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any technician in the relevant technical field, without departing from the scope of the technical solution of the present invention, makes any form of equivalent replacement or modification to the technical solution and technical content disclosed in the present invention, which does not depart from the content of the technical solution of the present invention and still falls within the protection scope of the present invention.

Claims

1. An embedded emergency communication method based on adaptive IPSEC technology, characterized in that: The communication method comprises the following steps: Configure a network range on the embedded device that can adapt to changes in IP addresses; Configure a fixed public IP address and the corresponding network range on the server; Establishing an IPSEC tunnel between the embedded device and the server, and transmitting data through the IPSEC tunnel, while configuring the embedded device and the server to use the same encryption, decryption and authentication protocol; The differential data compression technology is used to compress and decompress the data transmitted through the IPSEC tunnel.

2. The communication method according to claim 1, characterized in that: The establishment of the IPSEC tunnel includes the processes of authentication, encryption and decryption, and the embedded device and the server at both ends need to be configured when the IPSEC tunnel is first established, and the configuration can be automatically completed later.

3. The communication method according to claim 1, characterized in that: The compression process comprises the following steps: Determining whether the original message can be sent as a reference message; If it cannot be used as a reference message, the original message and the reference message are differentiated and then compressed according to a compression algorithm; Encapsulates the compressed information header content, including the reference message identifier, compression algorithm identifier and current message identifier.

4. The communication method according to claim 1, characterized in that: The decompression process comprises the following steps: Receiving an encapsulated IP message from the IPSEC tunnel; Removing header information of each layer in the IPSEC tunnel; Determine whether it is a reference message. If so, update the reference message and compressed header information. If not, remove the compressed header information, perform corresponding decompression processing, and restore the original message.

5. An embedded emergency communication system based on adaptive IPSEC technology, characterized in that: The system comprises: Embedded device-side module, used to configure a network range that can adapt to IP address changes and establish IPSEC tunnels for data transmission; The server module is used to configure a fixed public IP address and the corresponding network range, and establish an IPSEC tunnel with the embedded device for data transmission.

6. The system according to claim 5, characterized in that The system also includes an encryption and decryption module, which is used to configure the same encryption and decryption and authentication protocol between the embedded device end and the server end.

7. The system according to claim 6, characterized in that The system also includes a differential data compression module for compressing and decompressing data transmitted through the IPSEC tunnel.

8. The system according to claim 7, characterized in that The differential data compression module also includes: A judging unit, used to judge whether the original message can be sent as a reference message; A differential processing unit, used for performing differential processing on an original message that cannot be used as a reference message and a reference message; A compression algorithm unit, used for executing a compression algorithm to perform compression processing according to the difference result; The encapsulation unit is used to encapsulate the compressed information header content, including the reference message identifier, the compression algorithm identifier and the current message identifier.

9. The system according to claim 5, characterized in that The system further includes a decompression module, wherein the decompression module includes: A receiving unit, used for receiving encapsulated IP packets from the IPSEC tunnel; Header information removal unit, used to remove the header information of each layer in the IPSEC tunnel; A reference message judging unit, used to judge whether a received message is a reference message; An updating unit, used for updating the reference message and the compressed header information when it is determined to be a reference message; The decompression processing unit is used to perform corresponding decompression processing to restore the original message.

Images