Communication method and device based on OpenVPN

Abstract

The present application provides a communication method and device based on OpenVPN. The method includes: receiving an OpenVPN connection request sent by a target client; completing an OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol, and the TLS record protocol; upon receiving a real LAN IP address segment sent by the target client, determining whether there is a conflicting address segment in the local area network; if so, obtaining a non-conflicting virtual LAN IP address segment from an address pool and sending it to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; encapsulating the virtual LAN IP address segment into routing information and pushing it to other clients within the local area network range; so that the other clients save the routing information in a routing table. The method of the present application improves transmission efficiency.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device based on OpenVPN. Background Art

[0002] Through OpenVPN technology, secure tunnel connections can be established in different geographical locations or network environments, thereby realizing data transmission and sharing of network resources.

[0003] Currently, a router supporting OpenVPN can usually only connect to a fixed OpenVPN server, so that a target client on the side of the router supporting OpenVPN can access other clients connected to the OpenVPN server.

[0004] However, this method of the prior art cannot promptly resolve the situation where the target client and other clients have the same IP address segment. Network anomalies can only be discovered when the target client cannot access other clients, affecting transmission efficiency. Summary of the Invention

[0005] The embodiments of the present application provide a communication method and apparatus based on OpenVPN to achieve the effect of improving transmission efficiency.

[0006] In a first aspect, an embodiment of the present application provides a communication method based on OpenVPN, which is applied to an OpenVPN server, including: receiving an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request; according to the reliability handshake request, completing the OpenVPN connection with the target client in accordance with the TLS handshake protocol and the TLS record protocol; after the OpenVPN connection is successful, when receiving the real LAN IP address segment sent by the target client, determining whether there is an address segment in the LAN that conflicts with the real LAN IP address segment; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtaining a non-conflicting virtual LAN IP address segment from the address pool; according to the MQTT protocol, sending the virtual LAN IP address segment to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship; encapsulating the virtual LAN IP address segment as routing information, and pushing the routing information to the remaining clients within the LAN range; so that the remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table.

[0007] In one possible implementation, according to a reliability handshake request, an OpenVPN connection with a target client is completed in accordance with the TLS handshake protocol and the TLS record protocol, including: according to the reliability handshake request, performing a reliability handshake with the target client, and determining whether the reliability handshake is successful; if the reliability handshake is successful, entering the TLS handshake protocol phase in accordance with the TLS handshake protocol, and determining whether the TLS handshake protocol phase is successful; if the TLS handshake protocol phase is successful, entering the TLS record protocol phase in accordance with the TLS record protocol; obtaining an encryption key and an encryption algorithm in the TLS record protocol phase, and establishing an OpenVPN tunnel for communicating with the target client based on the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

[0008] In a possible implementation, after determining whether the reliability handshake is successful, the method further includes: if the reliability handshake fails, re-performing a reliability handshake with the target client when the number of failures is less than the fault tolerance number, until the reliability handshake succeeds.

[0009] In a possible implementation, after determining whether the TLS handshake protocol phase is successful, the method further includes: if the TLS handshake protocol phase fails, re-performing a reliability handshake with the target client.

[0010] In a possible implementation, after determining whether there is an address segment in the local area network that conflicts with the real local area network IP address segment, it also includes: if there is no address segment in the local area network that conflicts with the real local area network IP address segment, encapsulating the real local area network IP address segment into routing information, and pushing the routing information to the remaining clients within the local area network; so that the remaining clients save the routing information to the routing table.

[0011] In a second aspect, an embodiment of the present application provides a communication method based on OpenVPN, which is applied to a target client, including: sending an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol; after the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, so that the OpenVPN server determines whether there is an IP address in the LAN that matches the real LAN IP address segment. Conflicting address segments; if there is an address segment in the LAN that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the LAN range; so that the other clients save the routing information to the routing table; the other clients communicate according to the routing table; receive the virtual LAN IP address segment sent by the OpenVPN server according to the MQTT protocol; map the virtual LAN IP address segment to the real LAN IP address segment to obtain the address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0012] In a possible implementation, mapping the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship includes: mapping the virtual LAN IP address segment to the real LAN IP address segment through a network address mapping tool.

[0013] In a third aspect, an embodiment of the present application provides an OpenVPN-based communication device, which is applied to an OpenVPN server, including:

[0014] A first receiving module is configured to receive an OpenVPN connection request sent by a target client, wherein the OpenVPN connection request includes a reliability handshake request;

[0015] The connection module is used to complete the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol and the TLS record protocol;

[0016] The judgment module is used to judge whether there is an address segment in the local area network that conflicts with the real LAN IP address segment when receiving the real LAN IP address segment sent by the target client after the OpenVPN connection is successful;

[0017] The acquisition module is used to obtain a non-conflicting virtual LAN IP address segment from the address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment;

[0018] The first sending module is used to send the virtual local area network IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual local area network IP address segment to the real local area network IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship;

[0019] The push module is used to encapsulate the virtual LAN IP address segment into routing information and push the routing information to the other clients within the LAN range; so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table.

[0020] In a fourth aspect, an embodiment of the present application provides an OpenVPN-based communication device, applied to a target client, comprising:

[0021] The second sending module is configured to send the OpenVPN connection request to the OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request in accordance with the TLS handshake protocol and the TLS record protocol;

[0022] The third sending module is used to send the real LAN IP address segment to the OpenVPN server after the OpenVPN connection is successful, so that the OpenVPN server can determine whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the local area network range; so that the other clients save the routing information in the routing table; and the other clients communicate according to the routing table;

[0023] The second receiving module is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol;

[0024] The mapping module is used to map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0025] In a fifth aspect, an embodiment of the present application provides an OpenVPN server, comprising: a memory, a processor;

[0026] The memory stores computer-executable instructions;

[0027] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0028] In a sixth aspect, an embodiment of the present application provides a target client, comprising: a memory, a processor;

[0029] The memory stores computer-executable instructions;

[0030] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above second aspect and / or various possible implementations of the second aspect.

[0031] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0032] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above second aspect and / or various possible implementations of the second aspect.

[0033] In a ninth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementations of the first aspect.

[0034] In a tenth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above second aspect and / or various possible implementations of the second aspect.

[0035] The OpenVPN-based communication method and device provided in this application establish an OpenVPN connection between a target client and an OpenVPN server. The OpenVPN server then determines, based on the real LAN IP address segment sent by the target client, whether there is an address segment in the target client's local area network (LAN) that conflicts with the real LAN IP address segment. If so, the server reassigns a virtual LAN IP address segment to the target client, which then maps the virtual LAN IP address segment to the real LAN IP address segment. The virtual LAN IP address segment is then encapsulated into routing information and pushed to other clients in the target LAN. These clients then save the routing information to their routing tables. By determining address segment conflicts and pushing routing information, situations where the target client shares an IP address segment with other clients connected to the OpenVPN server can be promptly detected and resolved, thereby improving transmission efficiency. Furthermore, if there is an address segment in the target client's local area network that conflicts with the real LAN IP address segment, the server reassigns a virtual LAN IP address segment to the target client, thereby increasing the success rate of accessing the OpenVPN server. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0037] Figure 1 A schematic diagram of a scenario of an OpenVPN-based communication method provided in an embodiment of the present application;

[0038] Figure 2 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 1 ;

[0039] Figure 3 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 2 ;

[0040] Figure 4 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 3 ;

[0041] Figure 5 Schematic diagram of the structure of the communication device based on OpenVPN provided in the embodiment of the present application Figure 1 ;

[0042] Figure 6 Schematic diagram of the structure of the communication device based on OpenVPN provided in the embodiment of the present application Figure 2 ;

[0043] Figure 7A schematic diagram of the structure of the OpenVPN server provided in this embodiment;

[0044] Figure 8 A schematic diagram of the structure of the target client provided in an embodiment of the present application.

[0045] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0046] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0047] Figure 1 A schematic diagram of a scenario of a communication method based on OpenVPN provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the specific application scenario of this application targets the client 101, the OpenVPN server, and the remaining clients 103 in the local area network where the OpenVPN server is located.

[0048] refer to Figure 1 , target client 101 sends an OpenVPN connection request to the OpenVPN server. After the OpenVPN connection is successful, target client 101 sends the real LAN IP address segment to OpenVPN server 102; OpenVPN server 102 determines whether there is an address segment in its LAN that conflicts with the real LAN IP address segment. If so, it reallocates a virtual LAN IP address segment and sends it to target client 101. Target client 101 maps the virtual LAN IP address segment to the real LAN IP address segment. OpenVPN server 102 encapsulates the virtual LAN IP address segment into routing information and pushes it to the remaining clients 103. The remaining clients 103 save the routing information in the routing table. If not, the real LAN IP address segment is encapsulated into routing information and pushed to the remaining clients 103. The remaining clients 103 save the routing information in the routing table.

[0049] OpenVPN technology enables secure tunnel connections across diverse geographic locations or network environments, enabling data transmission and sharing of network resources. Currently, OpenVPN-enabled routers typically connect only to a single OpenVPN server, enabling target clients on the OpenVPN-enabled router to access other clients connected to the OpenVPN server. However, this existing approach fails to address situations where the target client shares an IP address with other clients. Network anomalies are only detected when the target client is unable to access other clients, impacting transmission efficiency.

[0050] In order to solve the above technical problems, the embodiment of the present application proposes the following technical ideas: considering that it is impossible to solve the situation in which the target client and other clients have the same IP address segment in a timely manner, the network anomaly problem can only be discovered when the target client cannot access other clients, which affects the transmission efficiency. The inventor thought of the OpenVPN server actively judging whether there is an address segment that conflicts with the real LAN IP address segment of the target client. If so, a virtual LAN IP address segment is reallocated to the target client, and the target client maps the virtual LAN IP address segment to the real LAN IP address segment; and encapsulates the virtual LAN IP address segment into routing information and pushes it to the remaining clients in the LAN. By judging the address segment conflict and routing push, it is possible to timely discover and resolve the situation in which the target client and the other clients connected to the OpenVPN server have the same IP address segment, thereby improving the transmission efficiency.

[0051] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0052] Figure 2 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 1 , the execution subject of this embodiment can be an OpenVPN server, and this embodiment does not make special restrictions, such as Figure 2 As shown, the method includes:

[0053] S201: Receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request.

[0054] Optionally, the reliability handshake request includes a target client identifier, etc.

[0055] S202: According to the reliability handshake request, the OpenVPN connection with the target client is completed according to the TLS handshake protocol and the TLS record protocol.

[0056] Specifically, step S202 includes S2021 to S2024:

[0057] S2021: Perform a reliability handshake with the target client based on the reliability handshake request, and determine whether the reliability handshake is successful.

[0058] Among them, the reliability handshake is used to preliminarily verify network connectivity.

[0059] S2022: If the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol and determine whether the TLS handshake protocol phase is successful.

[0060] In this embodiment, if the reliability handshake is successful, it proves that the network connectivity is normal and the TLS handshake protocol phase can be entered.

[0061] Among them, the Transport Layer Security (TLS) handshake protocol is a key part of the Transport Layer Security protocol, which is used to establish a secure connection between two devices.

[0062] Optionally, the TLS handshake protocol phase is responsible for negotiating security parameters such as encryption algorithm, encryption key, key length, and certificate between the target client and the OpenVPN server.

[0063] Optionally, if the reliability handshake fails, when the number of failures is less than the fault tolerance number, the reliability handshake is performed again with the target client until the reliability handshake succeeds.

[0064] The fault tolerance times are the preset maximum fault tolerance times.

[0065] S2023: If the TLS handshake protocol phase is successful, the TLS record protocol phase is entered according to the TLS record protocol.

[0066] Optionally, if the TLS handshake protocol phase is successful, a secure TLS channel will be established.

[0067] Optionally, if the TLS handshake protocol phase fails, a reliability handshake is performed again with the target client.

[0068] S2024: Obtain an encryption key and an encryption algorithm in the TLS record protocol phase, and establish an OpenVPN tunnel for communicating with the target client based on the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

[0069] In this embodiment, an encryption key and an encryption algorithm are obtained during the TLS record protocol phase, and encryption is performed on the established TLS communication channel based on the encryption key and the encryption algorithm. An OpenVPN tunnel is established using the encrypted communication channel. Once the OpenVPN tunnel is established, the OpenVPN connection between the target client and the OpenVPN server is completed.

[0070] S203: After the OpenVPN connection is successful, when the real LAN IP address segment sent by the target client is received, it is determined whether there is an address segment in the local area network that conflicts with the real LAN IP address segment.

[0071] Optionally, the OpenVPN server maintains a list of allocated IP address segments, which can include all allocated static IP address segments and dynamic IP address segment ranges assigned by the DHCP server. The server parses the received client's real LAN IP address segment and the allocated IP address segments maintained by the server into starting and ending IP address segments. The server then iterates through the list of allocated IP address segments, comparing each allocated IP address segment with the real LAN IP address segment. If any overlap is found, that is, if the starting and ending IP address segments overlap, a conflict is determined.

[0072] S204: If there is an address segment in the local area network that conflicts with the real local area network IP address segment, obtain a non-conflicting virtual local area network IP address segment from the address pool.

[0073] The address pool is a freely definable collection of Class A, Class B, and Class C private addresses. Class A private addresses range from 10.0.0.0 to 10.255.255.255. This is a very large address space suitable for large private networks. Class B private addresses range from 172.16.0.0 to 172.31.255.255. This address space is moderate and suitable for medium-sized networks. Class C private addresses range from 192.168.0.0 to 192.168.255.255. This is the most common private address range, typically used in small home or office networks.

[0074] S205: According to the MQTT protocol, the virtual LAN IP address segment is sent to the target client, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0075] The Message Queuing Telemetry Transport (MQTT) protocol is a lightweight message transmission protocol built on the TCP / IP protocol stack that enables communication between different devices and platforms. The MQTT protocol uses a publish-subscribe model, where publishers publish messages to a topic, and subscribers subscribe to this topic to receive messages.

[0076] In this embodiment, when a data packet is transmitted between the target client and the OpenVPN server, correct address translation can be performed according to the address segment mapping relationship to facilitate communication.

[0077] S206: Encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the LAN range, so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table.

[0078] Optionally, the virtual WAN IP address segment is encapsulated into routing information, including the virtual LAN IP address segment, subnet mask, gateway, etc. The routing information is pushed to other clients within the LAN range via the MQTT protocol and the OpenVPN record protocol.

[0079] In this embodiment, the other clients add the routing information to their own routing tables to update the routing tables. When the other clients need to forward data packets, they make forwarding decisions based on the routing information in the routing tables.

[0080] As can be seen from the above, after the target client establishes an OpenVPN connection with the OpenVPN server, the server determines whether there is an address segment on the target client's LAN that conflicts with the real LAN IP segment based on the real LAN IP segment sent by the target client. If so, the server reassigns a virtual LAN IP segment to the target client, which then maps the virtual LAN IP segment to the real LAN IP segment. The server then encapsulates the virtual LAN IP segment into routing information and pushes it to other clients on the same LAN, which then save the routing information to their routing tables. This conflict detection and routing information push allows for timely detection and resolution of situations where the target client shares an IP segment with other clients connected to the OpenVPN server, thereby improving transmission efficiency. Furthermore, if there is an address segment on the target client's LAN that conflicts with the real LAN IP segment, the server reassigns a virtual LAN IP segment, increasing the success rate of connecting to the OpenVPN server.

[0081] Optionally, if there is no address segment in the LAN that conflicts with the real LAN IP address segment, the real LAN IP address segment is encapsulated as routing information, and the routing information is pushed to other clients within the LAN range; so that the other clients save the routing information to the routing table.

[0082] Optionally, if there is no address segment in the local area network that conflicts with the real local area network IP address segment, the information without modification is sent to the target client via the MQTT protocol.

[0083] In summary, if there is no address segment that conflicts with the real LAN IP address segment, the real LAN IP address segment will be pushed to the other clients within the LAN range through routing information, which can ensure that the other clients receive the latest routing information in time and save the routing information to the routing table to update the forwarding decision, ensuring that the data packets can be correctly routed to the target network during subsequent communications.

[0084] Figure 3 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 2 , the execution subject of this embodiment can be the target client, and this embodiment does not make special restrictions, such as Figure 3 As shown, the method includes:

[0085] S301: Sending an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol and the TLS record protocol.

[0086] S302: After the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, which determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment. If there is an address segment in the local area network that conflicts with the real LAN IP address segment, the OpenVPN server obtains a non-conflicting virtual LAN IP address segment from the address pool. The virtual LAN IP address segment is encapsulated as routing information and the routing information is pushed to other clients within the local area network. The other clients save the routing information in the routing table, and the other clients communicate according to the routing table.

[0087] S303: Receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol.

[0088] S304: Map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0089] In this embodiment, the virtual LAN IP address segment is mapped to the real LAN IP address segment through a network address mapping tool.

[0090] Optionally, the virtual LAN IP address segment can be mapped to the real LAN IP address segment through the netmap module of Netfilter / IPtables.

[0091] In summary, when the target client receives the virtual LAN IP address segment sent by the OpenVPN server, it maps the virtual LAN IP address segment to the real LAN IP address segment, obtaining an address segment mapping relationship. This ensures that all data packets passing through the communication process will be converted to the LAN IP address segment according to the address segment mapping relationship. This ensures that the target client can successfully connect to the OpenVPN server and communicate with other clients.

[0092] Figure 4 Schematic diagram of the process of the communication method based on OpenVPN provided in the embodiment of the present application Figure 3 This embodiment takes the interaction process performed by the target data terminal, the OpenVPN server and the other clients in the local area network where the OpenVPN server is located as an example to illustrate the communication process. Figure 4 As shown, the details are as follows:

[0093] S401: The target client sends an OpenVPN connection request to the OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request.

[0094] S402: The OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request, in accordance with the TLS handshake protocol rules and the TLS record protocol rules;

[0095] S403: After the OpenVPN connection is successful, the target client sends the real LAN IP address segment to the OpenVPN server;

[0096] S404: The OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real local area network IP address segment;

[0097] S405: If the OpenVPN server determines that there is an address segment in the local area network that conflicts with the real local area network IP address segment, it obtains a non-conflicting virtual local area network IP address segment from the address pool.

[0098] S406: The OpenVPN server sends the virtual local area network IP address segment to the target client according to the MQTT protocol rules.

[0099] S407: The target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0100] S408: The OpenVPN server encapsulates the virtual LAN IP address segment into routing information and pushes the routing information to other clients within the LAN.

[0101] S409: The remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table.

[0102] Figure 5 Schematic diagram of the structure of the communication device based on OpenVPN provided in the embodiment of the present application Figure 1 ,like Figure 5 As shown, the OpenVPN-based communication device provided in this embodiment includes: a first receiving module 501 , a connecting module 502 , a determining module 503 , an acquiring module 504 , a first sending module 505 and a pushing module 506 .

[0103] The first receiving module 501 is configured to receive an OpenVPN connection request sent by a target client, wherein the OpenVPN connection request includes a reliability handshake request.

[0104] The connection module 502 is used to complete the OpenVPN connection with the target client according to the reliability handshake request, the TLS handshake protocol and the TLS record protocol.

[0105] The judgment module 503 is used to judge whether there is an address segment in the local area network that conflicts with the real LAN IP address segment when receiving the real LAN IP address segment sent by the target client after the OpenVPN connection is successful.

[0106] The acquisition module 504 is configured to acquire a non-conflicting virtual LAN IP address segment from the address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment.

[0107] The first sending module 505 is used to send the virtual LAN IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0108] The push module 506 is used to encapsulate the virtual LAN IP address segment into routing information and push the routing information to the remaining clients within the LAN range; so that the remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table.

[0109] In one possible implementation, the connection module 502 is specifically configured to: perform a reliability handshake with the target client according to a reliability handshake request, and determine whether the reliability handshake is successful; if the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol, and determine whether the TLS handshake protocol phase is successful; if the TLS handshake protocol phase is successful, enter the TLS record protocol phase according to the TLS record protocol; obtain an encryption key and an encryption algorithm in the TLS record protocol phase, and establish an OpenVPN tunnel for communicating with the target client based on the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

[0110] In a possible implementation, the OpenVPN-based communication device further includes: a fault tolerance number judgment module configured to, if the reliability handshake fails, re-perform a reliability handshake with the target client when the number of failures is less than the fault tolerance number, until the reliability handshake succeeds.

[0111] In a possible implementation, the OpenVPN-based communication device further includes: a first determination module, configured to re-perform a reliability handshake with the target client if the TLS handshake protocol phase fails.

[0112] In one possible implementation, the OpenVPN-based communication device further includes: a second determination module, configured to encapsulate the real LAN IP address segment as routing information if there is no address segment in the LAN that conflicts with the real LAN IP address segment, and push the routing information to the remaining clients within the LAN; so that the remaining clients save the routing information to the routing table.

[0113] The OpenVPN-based communication device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and are not described in detail in this embodiment.

[0114] Figure 6 Schematic diagram of the structure of the communication device based on OpenVPN provided in the embodiment of the present application Figure 2 ,like Figure 6 As shown, the OpenVPN-based communication device provided by this embodiment includes: a second sending module 601 , a third sending module 602 , a second receiving module 603 and a mapping module 604 .

[0115] The second sending module 601 is configured to send an OpenVPN connection request to an OpenVPN server, wherein the OpenVPN connection request includes a reliability handshake request, so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request and the TLS handshake protocol and the TLS record protocol;

[0116] The third sending module 602 is configured to, after the OpenVPN connection is successful, send the real LAN IP address segment to the OpenVPN server, so that the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the local area network range; so that the other clients save the routing information in the routing table; and the other clients communicate according to the routing table;

[0117] The second receiving module 603 is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol;

[0118] The mapping module 604 is used to map the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

[0119] In a possible implementation, the mapping module 604 is specifically configured to map the virtual LAN IP address segment to a real LAN IP address segment through a network address mapping tool.

[0120] Figure 7 This is a schematic diagram of the structure of the OpenVPN server provided in this application embodiment. Figure 7 As shown, the OpenVPN server provided in this embodiment includes: at least one processor 701 and a memory 702. Optionally, the OpenVPN server also includes a communication component 703. The processor 701, the memory 702, and the communication component 703 are connected via a bus 704.

[0121] During the specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that the at least one processor 701 performs the above method.

[0122] The specific implementation process of the processor 701 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0123] Figure 8This is a schematic diagram of the structure of the target client provided in the embodiment of this application. Figure 8 As shown, the target client provided in this embodiment includes: at least one processor 801 and a memory 802. Optionally, the target client also includes a communication component 803. The processor 801, the memory 802 and the communication component 803 are connected via a bus 804.

[0124] During the specific implementation process, at least one processor 801 executes the computer-executable instructions stored in the memory 802, so that the at least one processor 801 performs the above method.

[0125] The specific implementation process of the processor 801 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0126] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0127] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0128] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0129] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0130] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0131] The readable storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0132] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0133] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0134] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0135] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0136] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0137] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0138] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A communication method based on OpenVPN, characterized in that: Applicable to OpenVPN servers, including: Receive an OpenVPN connection request sent by a target client; wherein the OpenVPN connection request includes a reliability handshake request; According to the reliability handshake request, the OpenVPN connection with the target client is completed in accordance with the TLS handshake protocol and the TLS record protocol; After the OpenVPN connection is successful, upon receiving the real LAN IP address segment sent by the target client, it is determined whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; If there is an address segment in the local area network that conflicts with the real local area network IP address segment, obtain a non-conflicting virtual local area network IP address segment from the address pool; According to the MQTT protocol, the virtual local area network IP address segment is sent to the target client, so that the target client maps the virtual local area network IP address segment to the real local area network IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship; The virtual local area network IP address segment is encapsulated as routing information, and the routing information is pushed to the remaining clients within the local area network; so that the remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table.

2. The method according to claim 1, characterized in that The method of completing the OpenVPN connection with the target client according to the reliability handshake request and the TLS handshake protocol and the TLS record protocol includes: Performing a reliability handshake with the target client according to the reliability handshake request, and determining whether the reliability handshake is successful; If the reliability handshake is successful, enter the TLS handshake protocol phase according to the TLS handshake protocol and determine whether the TLS handshake protocol phase is successful; If the TLS handshake protocol phase is successful, then the TLS record protocol phase is entered according to the TLS record protocol; An encryption key and an encryption algorithm are obtained in the TLS record protocol stage, and an OpenVPN tunnel for communicating with the target client is established based on the encryption key and the encryption algorithm, thereby completing the OpenVPN connection with the target client.

3. The method according to claim 2, characterized in that After determining whether the reliability handshake is successful, the method further includes: If the reliability handshake fails, when the number of failures is less than the fault tolerance number, the reliability handshake is performed again with the target client until the reliability handshake succeeds.

4. The method according to claim 3, characterized in that After determining whether the TLS handshake protocol phase is successful, the method further includes: If the TLS handshake protocol phase fails, a reliability handshake is performed again with the target client.

5. The method according to any one of claims 1 to 4, characterized in that After determining whether there is an address segment in the local area network that conflicts with the real local area network IP address segment, the method further includes: If there is no address segment in the local area network that conflicts with the real local area network IP address segment, the real local area network IP address segment is encapsulated as routing information, and the routing information is pushed to the remaining clients within the local area network; so that the remaining clients save the routing information to the routing table.

6. A communication method based on OpenVPN, characterized in that: Applied to target clients, including: Sending an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request in accordance with the TLS handshake protocol and the TLS record protocol; After the OpenVPN connection is successful, the real LAN IP address segment is sent to the OpenVPN server, so that the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, a non-conflicting virtual LAN IP address segment is obtained from the address pool; the virtual LAN IP address segment is encapsulated as routing information, and the routing information is pushed to the remaining clients within the local area network range; so that the remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table; Receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol; The virtual local area network IP address segment is mapped to the real local area network IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

7. The method according to claim 6, characterized in that Mapping the virtual LAN IP address segment to the real LAN IP address segment to obtain an address segment mapping relationship includes: The virtual LAN IP address segment is mapped to the real LAN IP address segment through a network address mapping tool.

8. A communication device based on OpenVPN, characterized in that: Applicable to OpenVPN servers, including: A first receiving module is configured to receive an OpenVPN connection request sent by a target client, wherein the OpenVPN connection request includes a reliability handshake request; A connection module is used to complete the OpenVPN connection with the target client according to the reliability handshake request and the TLS handshake protocol and the TLS record protocol; A judgment module is used to judge whether there is an address segment in the local area network that conflicts with the real local area network IP address segment when receiving the real local area network IP address segment sent by the target client after the OpenVPN connection is successful; An acquisition module is used to acquire a non-conflicting virtual LAN IP address segment from an address pool if there is an address segment in the local area network that conflicts with the real LAN IP address segment; A first sending module is configured to send the virtual local area network IP address segment to the target client according to the MQTT protocol, so that the target client maps the virtual local area network IP address segment to the real local area network IP address segment to obtain an address segment mapping relationship; and the target client communicates according to the address segment mapping relationship; The push module is used to encapsulate the virtual local area network IP address segment into routing information and push the routing information to the remaining clients within the local area network; so that the remaining clients save the routing information to the routing table; and the remaining clients communicate according to the routing table.

9. A communication device based on OpenVPN, characterized in that: Applied to target clients, including: A second sending module is configured to send an OpenVPN connection request to an OpenVPN server; wherein the OpenVPN connection request includes a reliability handshake request; so that the OpenVPN server completes the OpenVPN connection with the target client according to the reliability handshake request in accordance with the TLS handshake protocol and the TLS record protocol; The third sending module is configured to, after the OpenVPN connection is successfully established, send the real LAN IP address segment to the OpenVPN server, so that the OpenVPN server determines whether there is an address segment in the local area network that conflicts with the real LAN IP address segment; if there is an address segment in the local area network that conflicts with the real LAN IP address segment, obtain a non-conflicting virtual LAN IP address segment from the address pool; encapsulate the virtual LAN IP address segment into routing information, and push the routing information to other clients within the local area network; so that the other clients save the routing information to the routing table; and the other clients communicate according to the routing table; The second receiving module is used to receive the virtual local area network IP address segment sent by the OpenVPN server according to the MQTT protocol; A mapping module is used to map the virtual local area network IP address segment to the real local area network IP address segment to obtain an address segment mapping relationship; the target client communicates according to the address segment mapping relationship.

10. An OpenVPN server, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

11. A target client, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 6 to 7.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 6 to 7 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when executed by a processor.

15. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 6 to 7 when executed by a processor.

Images