Communication method and device based on OpenVPN

Abstract

The invention provides a communication method and device based on an OpenVPN (Open Virtual Private Network). The method comprises the following steps: receiving an OpenVPN connection request sent by a target client; according to the reliability handshake request, an OpenVPN connection with the target client is completed according to a TLS handshake protocol and a TLS recording protocol; when a real local area network IP address field sent by a target client is received, judging whether a conflicting address field exists in the local area network; if yes, acquiring a non-conflict virtual local area network IP address field from the address pool, and sending the non-conflict virtual local area network IP address field to the target client, so that the target client maps the virtual local area network IP address field to a real local area network IP address field to obtain an address field mapping relationship; packaging the IP address field of the virtual local area network into routing information, and pushing the routing information to other clients within the range of the local area network; the other clients store the routing information to the routing table; according to the method, the transmission efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device based on OpenVPN. Background Art

[0002] Through OpenVPN technology, secure tunnel connections can be established in different geographical locations or network environments, thereby realizing data transmission and sharing of network resources.

[0003] Currently, a router supporting OpenVPN can usually only connect to a fixed OpenVPN server, so that a target client on the router supporting OpenVPN can access other clients connected to the OpenVPN server.

[0004] However, this method of the prior art cannot promptly solve the problem that the target client and other clients have the same IP address segment. The network anomaly problem can only be discovered when the target client cannot access other clients, which affects the transmission efficiency. Summary of the invention

[0005] The embodiments of the present application provide a communication method and device based on OpenVPN to achieve the effect of improving transmission efficiency.

[0006] In a first aspect, an embodiment of the present application provides a communication method based on OpenVPN, which is applied to an OpenVPN server, including: receiving an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request; according to the reliability handshake request, completing the OpenVPN connection with the target client in accordance with the TLS handshake protocol and the TLS record protocol; after the OpenVPN connection is successful, when receiving the real LAN IP address segment sent by the target client, determining whether there is an address segment in the LAN that conflicts with the real LAN IP address segment; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtaining a non-conflicting virtual LAN IP address segment from the address pool; according to the MQTT protocol, sending the virtual LAN IP address segment to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship; encapsulating the virtual LAN IP address segment as routing information, and pushing the routing information to the remaining clients within the LAN range; so that the remaining clients save the routing information to the routing table; the remaining clients communicate according to the routing table.

[0007] In a possible implementation, according to a reliability handshake request, an OpenVPN connection with a target client is completed according to the TLS handshake protocol and the TLS record protocol, including: according to the reliability handshake request, a reliability handshake is performed with the target client, and it is determined whether the reliability handshake is successful; if the reliability handshake is successful, the TLS handshake protocol phase is entered according to the TLS handshake protocol, and it is determined whether the TLS handshake protocol phase is successful; if the TLS handshake protocol phase is successful, the TLS record protocol phase is entered according to the TLS record protocol; an encryption key and an encryption algorithm are obtained in the TLS record protocol phase, and an OpenVPN tunnel for communicating with the target client is established according to the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

[0008] In a possible implementation, after determining whether the reliability handshake is successful, the process further includes: if the reliability handshake fails, when the number of failures is less than the fault tolerance number, re-performing a reliability handshake with the target client until the reliability handshake succeeds.

[0009] In a possible implementation, after determining whether the TLS handshake protocol phase is successful, the method further includes: if the TLS handshake protocol phase fails, re-performing a reliability handshake with the target client.

[0010] In a possible implementation, after determining whether there is an address segment in the local area network that conflicts with the real local area network IP address segment, it also includes: if there is no address segment in the local area network that conflicts with the real local area network IP address segment, encapsulating the real local area network IP address segment into routing information, and pushing the routing information to other clients within the local area network; so that the other clients save the routing information to the routing table.

[0011] In a second aspect, an embodiment of the present application provides a communication method based on OpenVPN, which is applied to a target client, including: sending an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol; after the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, so that the OpenVPN server determines whether there is an IP address in the LAN corresponding to the real LAN IP address segment. Conflicting address segments; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the LAN; so that the other clients save the routing information to the routing table; the other clients communicate according to the routing table; receive the virtual LAN IP address segment sent by the OpenVPN server according to the MQTT protocol; map the virtual LAN IP address segment to the real LAN IP address segment to obtain the address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0012] In a possible implementation, mapping the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship includes: mapping the virtual LAN IP address segment to the real LAN IP address segment through a network address mapping tool.

[0013] In a third aspect, an embodiment of the present application provides a communication device based on OpenVPN, applied to an OpenVPN server, including:

[0014] A first receiving module is used to receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request;

[0015] A connection module is used to complete the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol and the TLS record protocol;

[0016] The judgment module is used to judge whether there is an address segment in the local area network that conflicts with the real LAN IP address segment when receiving the real LAN IP address segment sent by the target client after the OpenVPN connection is successful;

[0017] The acquisition module is used to acquire a non-conflicting virtual LAN IP address segment from the address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment;

[0018] The first sending module is used to send the virtual local area network IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual local area network IP address segment to the real local area network IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship;

[0019] The push module is used to encapsulate the virtual LAN IP address segment into routing information and push the routing information to the other clients within the LAN; so that the other clients save the routing information to the routing table; the other clients communicate according to the routing table.

[0020] In a fourth aspect, an embodiment of the present application provides a communication device based on OpenVPN, applied to a target client, including:

[0021] The second sending module is used to send the OpenVPN connection request to the OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol;

[0022] The third sending module is used to send the real LAN IP address segment to the OpenVPN server after the OpenVPN connection is successful, so that the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the local area network; so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table;

[0023] The second receiving module is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol;

[0024] The mapping module is used to map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0025] In a fifth aspect, an embodiment of the present application provides an OpenVPN server, including: a memory, a processor;

[0026] The memory stores computer-executable instructions;

[0027] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0028] In a sixth aspect, an embodiment of the present application provides a target client, including: a memory, a processor;

[0029] The memory stores computer-executable instructions;

[0030] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above second aspect and / or various possible implementations of the second aspect.

[0031] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-readable storage medium is stored computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0032] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-readable storage medium is stored computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the above second aspect and / or various possible implementations of the second aspect.

[0033] In a ninth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementations of the first aspect.

[0034] In a tenth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above second aspect and / or various possible implementations of the second aspect.

[0035] The communication method and device based on OpenVPN provided by the present application, after establishing an OpenVPN connection with the OpenVPN server through the target client, the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real local area network IP address segment according to the real local area network IP address segment sent by the target client. If so, a virtual local area network IP address segment is reallocated to the target client, and the target client maps the virtual local area network IP address segment to the real local area network IP address segment; and the virtual local area network IP address segment is encapsulated into routing information and pushed to the remaining clients in the local area network, and the remaining clients save the routing information to the routing table. Through the address segment conflict judgment and the push of routing information, the situation that the target client has the same IP address segment as the remaining clients connected to the OpenVPN server can be discovered and resolved in time, thereby improving the transmission efficiency. In addition, if there is an address segment in the local area network that conflicts with the real local area network IP address segment, a virtual local area network IP address segment is reallocated to the target client, thereby improving the success rate of accessing the OpenVPN server. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0037] Figure 1 A schematic diagram of a scenario of a communication method based on OpenVPN provided in an embodiment of the present application;

[0038] Figure 2 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 1 ;

[0039] Figure 3 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 2 ;

[0040] Figure 4 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 3 ;

[0041] Figure 5 A schematic diagram of the structure of a communication device based on OpenVPN provided in an embodiment of the present application Figure 1 ;

[0042] Figure 6 A schematic diagram of the structure of a communication device based on OpenVPN provided in an embodiment of the present application Figure 2 ;

[0043] Figure 7A schematic diagram of the structure of the OpenVPN server provided in the embodiment of the present application;

[0044] Figure 8 A schematic diagram of the structure of the target client provided in an embodiment of the present application.

[0045] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0046] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0047] Figure 1 A schematic diagram of a scenario of a communication method based on OpenVPN provided in an embodiment of the present application, such as Figure 1 As shown, the specific application scenario of the present application targets the client 101, the OpenVPN server, and the remaining clients 103 in the local area network where the OpenVPN server is located.

[0048] refer to Figure 1 , the target client 101 sends an OpenVPN connection request to the OpenVPN server. After the OpenVPN connection is successful, the target client 101 sends the real LAN IP address segment to the OpenVPN server 102; the OpenVPN server 102 determines whether there is an address segment in the LAN that conflicts with the real LAN IP address segment. If so, a virtual LAN IP address segment is reallocated and sent to the target client 101, and the target client 101 maps the virtual LAN IP address segment to the real LAN IP address segment. The OpenVPN server 102 encapsulates the virtual LAN IP address segment into routing information and pushes it to the remaining clients 103. The remaining clients 103 save the routing information to the routing table. If not, the real LAN IP address segment is encapsulated into routing information and pushed to the remaining clients 103, and the remaining clients 103 save the routing information to the routing table.

[0049] Through OpenVPN technology, secure tunnel connections can be established in different geographical locations or network environments, thereby achieving data transmission and sharing of network resources. At present, routers that support OpenVPN can usually only connect to a fixed OpenVPN server, so that the target client on the router side that supports OpenVPN can access other clients that have been connected to the OpenVPN server. However, this method of the prior art cannot promptly solve the situation where the target client has the same IP address segment as other clients. Only when the target client cannot access other clients can the network abnormality be discovered, affecting the transmission efficiency.

[0050] In order to solve the above technical problems, the embodiment of the present application proposes the following technical ideas: considering that it is impossible to solve the situation that the target client has the same IP address segment as other clients in time, the network abnormality problem can only be discovered when the target client cannot access other clients, which affects the transmission efficiency. The inventor thought of the OpenVPN server actively judging whether there is an address segment that conflicts with the real LAN IP address segment of the target client. If so, a virtual LAN IP address segment is reallocated to the target client, and the target client maps the virtual LAN IP address segment to the real LAN IP address segment; and encapsulates the virtual LAN IP address segment into routing information and pushes it to the remaining clients in the LAN. By judging the address segment conflict and routing push, it is possible to timely discover and solve the situation that the target client has the same IP address segment as the remaining clients connected to the OpenVPN server, thereby improving the transmission efficiency.

[0051] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0052] Figure 2 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 1 The execution subject of this embodiment can be an OpenVPN server, and this embodiment does not make any special restrictions. Figure 2 As shown, the method includes:

[0053] S201: Receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request.

[0054] Optionally, the reliability handshake request includes a target client identifier and the like.

[0055] S202: According to the reliability handshake request, the OpenVPN connection with the target client is completed according to the TLS handshake protocol and the TLS record protocol.

[0056] Specifically, step S202 includes S2021 to S2024:

[0057] S2021: Perform a reliability handshake with the target client according to the reliability handshake request, and determine whether the reliability handshake is successful.

[0058] Among them, the reliability handshake is used to initially verify network connectivity.

[0059] S2022: If the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol, and determine whether the TLS handshake protocol phase is successful.

[0060] In this embodiment, if the reliability handshake is successful, it proves that the network connectivity is normal and the TLS handshake protocol phase can be entered.

[0061] Among them, the Transport Layer Security (TLS) handshake protocol is a key part of the Transport Layer Security protocol, which is used to establish a secure connection between two devices.

[0062] Optionally, the TLS handshake protocol phase is responsible for negotiating security parameters such as encryption algorithms, encryption keys, key lengths, and certificates between the target client and the OpenVPN server.

[0063] Optionally, if the reliability handshake fails, when the number of failures is less than the fault tolerance number, the reliability handshake is performed again with the target client until the reliability handshake succeeds.

[0064] The fault tolerance times is a preset maximum fault tolerance times limit.

[0065] S2023: If the TLS handshake protocol phase is successful, the TLS record protocol phase is entered according to the TLS record protocol.

[0066] Optionally, if the TLS handshake protocol phase is successful, a secure TLS channel will be established.

[0067] Optionally, if the TLS handshake protocol phase fails, a reliability handshake is performed again with the target client.

[0068] S2024: Obtain an encryption key and an encryption algorithm in the TLS record protocol phase, and establish an OpenVPN tunnel for communicating with the target client based on the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

[0069] In this embodiment, an encryption key and an encryption algorithm are obtained in the TLS record protocol stage, and encryption is performed on the established TLS communication channel according to the encryption key and the encryption algorithm. The encrypted communication channel is used to establish an OpenVPN tunnel. Once the OpenVPN tunnel is established, the OpenVPN connection between the target client and the OpenVPN server is completed.

[0070] S203: After the OpenVPN connection is successful, when the real LAN IP address segment sent by the target client is received, it is determined whether there is an address segment in the local area network that conflicts with the real LAN IP address segment.

[0071] Optionally, there is an allocated IP address segment list on the OpenVPN server side, which can include all allocated static IP address segments and dynamic IP address segment ranges allocated by the DHCP server. The received client real LAN IP address segment and the allocated IP address segment maintained by the server are parsed into a start IP address segment and an end IP address segment. The allocated IP address segment list is traversed, and each allocated IP address segment is compared with the real LAN IP address segment. If any overlap is found, that is, there is an intersection between the start IP address segment and the end IP address segment, it is determined that there is a conflict.

[0072] S204: If there is an address segment in the local area network that conflicts with the real local area network IP address segment, obtain a non-conflicting virtual local area network IP address segment from the address pool.

[0073] Among them, the address pool is a collection of freely definable Class A private addresses, Class B private addresses, and Class C private addresses. Class A private addresses: range from 10.0.0.0 to 10.255.255.255. This is a very large address space, suitable for large private networks; Class B private addresses: range from 172.16.0.0 to 172.31.255.255. This address space is moderate and suitable for medium-sized networks; Class C private addresses: range from 192.168.0.0 to 192.168.255.255. This is the most common private address range, usually used in small home or office networks.

[0074] S205: According to the MQTT protocol, the virtual LAN IP address segment is sent to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0075] Among them, the Message Queuing Telemetry Transport (MQTT) protocol is a lightweight message transmission protocol built on the TCP / IP protocol stack that can communicate between different devices and platforms. The MQTT protocol adopts a publish-subscribe model, where the message publisher publishes the message to a topic, and the message subscriber subscribes to the topic to receive the message.

[0076] In this embodiment, when a data packet is transmitted between a target client and an OpenVPN server, correct address conversion can be performed according to the address segment mapping relationship to perform communication.

[0077] S206: Encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the LAN range; so that other clients save the routing information to the routing table; and other clients communicate according to the routing table.

[0078] Optionally, the virtual WAN IP address segment is encapsulated into routing information, including information such as the virtual LAN IP address segment, subnet mask, and gateway, etc. The routing information is pushed to other clients within the LAN range through the MQTT protocol and the OpenVPN record protocol.

[0079] In this embodiment, the other clients add the routing information to their own routing tables to update the routing tables. When the other clients need to forward data packets, they make forwarding decisions based on the routing information in the routing tables.

[0080] In summary, after the target client establishes an OpenVPN connection with the OpenVPN server, the OpenVPN server determines whether there is an address segment in the LAN that conflicts with the real LAN IP address segment based on the real LAN IP address segment sent by the target client. If so, a virtual LAN IP address segment is reallocated to the target client, and the target client maps the virtual LAN IP address segment to the real LAN IP address segment; and the virtual LAN IP address segment is encapsulated into routing information and pushed to the other clients in the LAN, and the other clients save the routing information to the routing table. Through address segment conflict judgment and routing information push, the situation that the target client has the same IP address segment as the other clients connected to the OpenVPN server can be discovered and resolved in time, thereby improving transmission efficiency. In addition, if there is an address segment in the LAN that conflicts with the real LAN IP address segment, a virtual LAN IP address segment is reallocated to the target client, thereby improving the success rate of accessing the OpenVPN server.

[0081] Optionally, if there is no address segment in the LAN that conflicts with the real LAN IP address segment, the real LAN IP address segment is encapsulated as routing information, and the routing information is pushed to other clients within the LAN; so that the other clients save the routing information to the routing table.

[0082] Optionally, if there is no address segment in the local area network that conflicts with the real local area network IP address segment, the information that does not need to be modified is sent to the target client through the MQTT protocol.

[0083] In summary, if there is no address segment that conflicts with the real LAN IP address segment, the real LAN IP address segment will be pushed to the other clients within the LAN through routing information, which can ensure that the other clients receive the latest routing information in time and save the routing information in the routing table to update the forwarding decision, ensuring that the data packets can be correctly routed to the target network during subsequent communications.

[0084] Figure 3 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 2 , the execution subject of this embodiment can be the target client, and this embodiment does not make any special restrictions, such as Figure 3 As shown, the method includes:

[0085] S301: Sending an OpenVPN connection request to an OpenVPN server, wherein the OpenVPN connection request includes a reliability handshake request, so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol and the TLS record protocol.

[0086] S302: After the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, so that the OpenVPN server determines whether there is an address segment in the LAN that conflicts with the real LAN IP address segment; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to the remaining clients within the LAN range; so that the remaining clients save the routing information to the routing table; the remaining clients communicate according to the routing table.

[0087] S303: Receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol.

[0088] S304: Map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0089] In this embodiment, the virtual LAN IP address segment is mapped to the real LAN IP address segment through a network address mapping tool.

[0090] Optionally, the virtual LAN IP address segment can be mapped to the real LAN IP address segment through the netmap module of Netfilter / IPtables.

[0091] In summary, when the target client receives the virtual LAN IP address segment sent by the OpenVPN server, it maps the virtual LAN IP address segment to the real LAN IP address segment to obtain the address segment mapping relationship, so that all data packets passing through the communication process will be converted to the LAN IP address segment according to the address segment mapping relationship. This can ensure that the target client can successfully access the OpenVPN server and communicate with other clients.

[0092] Figure 4 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 3 This embodiment takes the interaction process performed by the target data terminal, the OpenVPN server and other clients in the local area network where the OpenVPN server is located as an example to illustrate the communication process. Figure 4 As shown, the details are as follows:

[0093] S401: The target client sends an OpenVPN connection request to the OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request.

[0094] S402: The OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol rules and the TLS record protocol rules;

[0095] S403: After the OpenVPN connection is successful, the target client sends the real LAN IP address segment to the OpenVPN server;

[0096] S404: The OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real local area network IP address segment;

[0097] S405: If the OpenVPN server determines that there is an address segment in the local area network that conflicts with the real local area network IP address segment, a non-conflicting virtual local area network IP address segment is obtained from the address pool.

[0098] S406: The OpenVPN server sends the virtual LAN IP address segment to the target client according to the MQTT protocol rules.

[0099] S407: The target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0100] S408: The OpenVPN server encapsulates the virtual LAN IP address segment into routing information, and pushes the routing information to other clients within the LAN.

[0101] S409: The remaining clients save the routing information to the routing table; the remaining clients communicate according to the routing table.

[0102] Figure 5 A schematic diagram of the structure of a communication device based on OpenVPN provided in an embodiment of the present application Figure 1 ,like Figure 5 As shown, the OpenVPN-based communication device provided in this embodiment includes: a first receiving module 501 , a connecting module 502 , a determining module 503 , an acquiring module 504 , a first sending module 505 and a pushing module 506 .

[0103] The first receiving module 501 is used to receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request.

[0104] The connection module 502 is used to complete the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol and the TLS record protocol.

[0105] The judgment module 503 is used to judge whether there is an address segment in the local area network that conflicts with the real LAN IP address segment when receiving the real LAN IP address segment sent by the target client after the OpenVPN connection is successful.

[0106] The acquisition module 504 is used to acquire a non-conflicting virtual LAN IP address segment from the address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment.

[0107] The first sending module 505 is used to send the virtual LAN IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0108] The push module 506 is used to encapsulate the virtual LAN IP address segment into routing information and push the routing information to other clients within the LAN range; so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table.

[0109] In one possible implementation, the connection module 502 is specifically used to: perform a reliability handshake with the target client according to a reliability handshake request, and determine whether the reliability handshake is successful; if the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol, and determine whether the TLS handshake protocol phase is successful; if the TLS handshake protocol phase is successful, enter the TLS record protocol phase according to the TLS record protocol; obtain an encryption key and an encryption algorithm in the TLS record protocol phase, and establish an OpenVPN tunnel for communicating with the target client according to the encryption key and the encryption algorithm, and complete the OpenVPN connection with the target client.

[0110] In a possible implementation, the OpenVPN-based communication device further includes: a fault tolerance number judgment module, which is used to re-perform a reliability handshake with the target client if the reliability handshake fails and the number of failures is less than the fault tolerance number, until the reliability handshake succeeds.

[0111] In a possible implementation, the OpenVPN-based communication device further includes: a first determination module, configured to re-perform a reliability handshake with the target client if the TLS handshake protocol phase fails.

[0112] In a possible implementation, the OpenVPN-based communication device also includes: a second determination module, which is used to encapsulate the real LAN IP address segment as routing information if there is no address segment in the LAN that conflicts with the real LAN IP address segment, and push the routing information to the remaining clients within the LAN; so that the remaining clients save the routing information to the routing table.

[0113] The OpenVPN-based communication device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0114] Figure 6 A schematic diagram of the structure of a communication device based on OpenVPN provided in an embodiment of the present application Figure 2 ,like Figure 6 As shown, the OpenVPN-based communication device provided in this embodiment includes: a second sending module 601 , a third sending module 602 , a second receiving module 603 and a mapping module 604 .

[0115] The second sending module 601 is used to send an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol;

[0116] The third sending module 602 is used to send the real LAN IP address segment to the OpenVPN server after the OpenVPN connection is successful, so that the OpenVPN server determines whether there is an address segment in the LAN that conflicts with the real LAN IP address segment; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the LAN range; so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table;

[0117] The second receiving module 603 is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol;

[0118] The mapping module 604 is used to map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0119] In a possible implementation, the mapping module 604 is specifically used to map the virtual LAN IP address segment to the real LAN IP address segment through a network address mapping tool.

[0120] Figure 7 This is a schematic diagram of the structure of the OpenVPN server provided in the embodiment of the present application. Figure 7 As shown, the OpenVPN server provided in this embodiment includes: at least one processor 701 and a memory 702. Optionally, the OpenVPN server also includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0121] In a specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that at least one processor 701 executes the above method.

[0122] The specific implementation process of the processor 701 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0123] Figure 8This is a schematic diagram of the structure of the target client provided in the embodiment of the present application. Figure 8 As shown, the target client provided in this embodiment includes: at least one processor 801 and a memory 802. Optionally, the target client also includes a communication component 803. The processor 801, the memory 802 and the communication component 803 are connected via a bus 804.

[0124] In a specific implementation process, at least one processor 801 executes the computer-executable instructions stored in the memory 802, so that at least one processor 801 executes the above method.

[0125] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0126] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0127] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0128] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0129] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0130] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0131] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0132] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0133] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0134] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0135] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0136] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0137] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0138] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A communication method based on OpenVPN, characterized in that: Applicable to OpenVPN servers, including: Receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request; According to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol, completing the OpenVPN connection with the target client; After the OpenVPN connection is successful, upon receiving the real LAN IP address segment sent by the target client, it is determined whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; If there is an address segment in the local area network that conflicts with the real local area network IP address segment, obtain a non-conflicting virtual local area network IP address segment from the address pool; According to the MQTT protocol, the virtual LAN IP address segment is sent to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship; The virtual local area network IP address segment is encapsulated as routing information, and the routing information is pushed to other clients within the local area network; so that the other clients save the routing information to the routing table; the other clients communicate according to the routing table.

2. The method according to claim 1, characterized in that The method of completing the OpenVPN connection with the target client according to the reliability handshake request and the TLS handshake protocol and the TLS record protocol includes: Performing a reliability handshake with the target client according to the reliability handshake request, and determining whether the reliability handshake is successful; If the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol, and determine whether the TLS handshake protocol phase is successful; If the TLS handshake protocol phase is successful, then the TLS record protocol phase is entered according to the TLS record protocol; An encryption key and an encryption algorithm are obtained in the TLS record protocol stage, and an OpenVPN tunnel for communicating with the target client is established based on the encryption key and the encryption algorithm to complete the OpenVPN connection with the target client.

3. The method according to claim 2, characterized in that After determining whether the reliability handshake is successful, the method further includes: If the reliability handshake fails, when the number of failures is less than the fault tolerance number, the reliability handshake is performed again with the target client until the reliability handshake succeeds.

4. The method according to claim 3, characterized in that After determining whether the TLS handshake protocol phase is successful, the method further includes: If the TLS handshake protocol phase fails, a reliability handshake is performed again with the target client.

5. The method according to any one of claims 1 to 4, characterized in that: After determining whether there is an address segment in the local area network that conflicts with the real local area network IP address segment, the method further includes: If there is no address segment in the LAN that conflicts with the real LAN IP address segment, the real LAN IP address segment is encapsulated as routing information, and the routing information is pushed to other clients within the LAN; so that the other clients save the routing information to the routing table.

6. A communication method based on OpenVPN, characterized in that: Applied to target clients, including: Sending an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol; After the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, so that the OpenVPN server determines whether there is an address segment in the LAN that conflicts with the real LAN IP address segment; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, a non-conflicting virtual LAN IP address segment is obtained from the address pool; the virtual LAN IP address segment is encapsulated as routing information, and the routing information is pushed to the remaining clients within the LAN range; so that the remaining clients save the routing information to the routing table; the remaining clients communicate according to the routing table; Receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol; The virtual LAN IP address segment is mapped to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

7. The method according to claim 6, characterized in that The step of mapping the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship includes: The virtual LAN IP address segment is mapped to the real LAN IP address segment through a network address mapping tool.

8. A communication device based on OpenVPN, characterized in that: Applicable to OpenVPN servers, including: A first receiving module is configured to receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request; A connection module, configured to complete an OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol; A judgment module is used for judging whether there is an address segment in the local area network that conflicts with the real local area network IP address segment when receiving the real local area network IP address segment sent by the target client after the OpenVPN connection is successful; An acquisition module, used for acquiring a non-conflicting virtual LAN IP address segment from an address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment; A first sending module is used to send the virtual LAN IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship; The push module is used to encapsulate the virtual LAN IP address segment into routing information and push the routing information to other clients within the LAN; so that the other clients save the routing information to the routing table; the other clients communicate according to the routing table.

9. A communication device based on OpenVPN, characterized in that: Applied to target clients, including: The second sending module is used to send the OpenVPN connection request to the OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol; The third sending module is used to send the real LAN IP address segment to the OpenVPN server after the OpenVPN connection is successful, so that the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to the remaining clients within the local area network; so that the remaining clients save the routing information to the routing table; the remaining clients communicate according to the routing table; The second receiving module is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol; A mapping module is used to map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

10. An OpenVPN server, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

11. A target client, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 6 to 7.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 6 to 7 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when being executed by a processor.

15. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 6 to 7 when being executed by a processor.

Images