Virtual private network communication method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a virtual private network communication method and device, computer equipment, a computer readable storage medium and a computer program product, relates to the technical field of virtual private networks, and can improve the load balancing efficiency of virtual network equipment. The method comprises the following steps: acquiring a communication address node tree, and determining a to-be-newly added first allowable communication address of a first communication node communicating with virtual private network equipment; if the communication address node tree does not comprise the node corresponding to the first allowed communication address, adding a main node corresponding to the first allowed communication address and the second communication node in the communication address node tree; if the communication address node tree comprises the master node corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node in a slave node linked list corresponding to the first allowed communication address; and when the information address of the to-be-transmitted information is matched with the first allowable communication address, determining a target node from the master node or the slave nodes, and transmitting the to-be-transmitted information through the target node.

Description

Technical Field

[0001] The present application relates to the technical field of virtual private networks, and in particular to a virtual private network communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of computer technology, virtual private networks (VPNs) have been increasingly widely used. As a modern VPN protocol, WireGuard has become the preferred solution for building virtual private networks due to its high performance, security, reliability, ease of use, and cross-platform support. In the implementation of WireGuard, the virtual network device used by the WireGuard protocol can communicate with communication nodes within the range of IP addresses that allow communication, but there are situations where a single virtual network device cannot achieve load balancing between multiple communication nodes.

[0003] In the related technology, multiple virtual network devices are mainly provided, and then the traffic load is balanced to multiple virtual network devices through equal-cost multi-path (ECMP) routing, and each virtual network device then transmits the traffic to the communication node.

[0004] However, the above method requires configuration of multiple virtual network devices on the one hand, and ECMP routing on the other hand, which increases the complexity of use and management, and there is a problem of low load balancing efficiency of virtual network devices. Summary of the invention

[0005] Based on this, it is necessary to provide a virtual private network communication method, apparatus, computer equipment, computer readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a virtual private network communication method, comprising:

[0007] Acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0008] If the communication address node tree does not include a node corresponding to the first allowed communication address, adding a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree;

[0009] If the communication address node tree includes the master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node;

[0010] When the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0011] In one embodiment, the method further comprises:

[0012] Constructing a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, each of the hash tree nodes having a corresponding node hash value;

[0013] The determining of the target node from the master node and the slave node associated with the first allowed communication address information comprises:

[0014] Obtaining an information hash value corresponding to the information to be transmitted;

[0015] According to the information hash value and the node hash values ​​of the multiple hash tree nodes in the consistent hash tree, the target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the corresponding hash tree node of the target node in the consistent hash tree matches the information hash value.

[0016] In one embodiment, obtaining the information hash value corresponding to the information to be transmitted includes:

[0017] If the information to be transmitted is information leaving a virtual private network, obtaining a source IP address and a source port of the information to be transmitted, and determining an information hash value corresponding to the information to be transmitted according to the source IP address and the source port;

[0018] If the information to be transmitted is information for entering a virtual private network, the destination IP address and the destination port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined according to the destination IP address and the destination port.

[0019] In one embodiment, constructing the consistent hash tree corresponding to the first allowed communication address includes:

[0020] When at least one node is newly associated with the first allowed communication address, for each of the nodes, a plurality of virtual nodes corresponding to the node are generated; the at least one node includes a master node and / or a slave node associated with the first allowed communication address;

[0021] A consistent hash tree is constructed according to each of the virtual nodes.

[0022] In one embodiment, the method further comprises:

[0023] Determine a second allowed communication address to be deleted of a second communication node communicating with the virtual private network device;

[0024] If the master node corresponding to the second allowed communication address is found on the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after each slave node in the slave node linked list of the second allowed communication address is deleted, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

[0025] In one of the embodiments, after determining the second allowed communication address to be deleted of the second communication node communicating with the virtual private network device, the method further includes:

[0026] If the master node corresponding to the second allowed communication address is not found on the communication address node tree, obtaining a slave node linked list of the second allowed communication address;

[0027] In the slave node linked list of the second allowed communication address, the slave node corresponding to the second communication node is deleted.

[0028] In a second aspect, the present application further provides a virtual private network communication device, comprising:

[0029] An information acquisition module is used to acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0030] A first node adding module, configured to add a master node corresponding to the first allowed communication address and the first communication node in the communication address node tree if the communication address node tree does not include a node corresponding to the first allowed communication address;

[0031] A second node adding module is used to add a slave node corresponding to the first communication node in a slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address;

[0032] An information transmission module is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, and transmit the information to be transmitted through the target node.

[0033] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0034] Acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0035] If the communication address node tree does not include a node corresponding to the first allowed communication address, adding a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree;

[0036] If the communication address node tree includes the master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node;

[0037] When the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0039] Acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0040] If the communication address node tree does not include a node corresponding to the first allowed communication address, adding a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree;

[0041] If the communication address node tree includes the master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node;

[0042] When the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0043] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0044] Acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0045] If the communication address node tree does not include a node corresponding to the first allowed communication address, adding a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree;

[0046] If the communication address node tree includes the master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node;

[0047] When the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0048] The above-mentioned virtual private network communication method, device, computer equipment, computer-readable storage medium and computer program product obtain a communication address node tree corresponding to the virtual private network device, and determine a first allowed communication address to be added to the first communication node communicating with the virtual private network device, wherein each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information allowed to be transmitted between the virtual private network device and the first communication node; then, if the communication address node tree does not include a node corresponding to the first allowed communication address, a master node corresponding to the first allowed communication address and the second communication node is added to the communication address node tree; if the communication address node tree includes a master node corresponding to the first allowed communication address, a slave node corresponding to the first communication node is added to the slave node linked list corresponding to the first allowed communication address; and then, when the information address of the information to be transmitted by the virtual private network device matches the first allowed communication address, a target node is determined from the master node or slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node. In an embodiment of the present application, by including a master node corresponding to the first allowed communication address in the communication address node tree, a slave node corresponding to the first communication node is added in the slave node linked list corresponding to the first allowed communication address, so that multiple communication nodes of the same virtual private network device can be configured with the same allowed communication address, so that traffic with the same IP address or IP network segment can reach multiple communication nodes through multiple WireGuard tunnels of the same wg device, thereby achieving the purpose of traffic load balancing with a single virtual private network device. At the same time, this method does not require the addition of additional ECMP routing and other configurations, greatly simplifies the configuration and management complexity of load balancing, and improves the efficiency of load balancing of virtual network devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 A configuration diagram in one embodiment;

[0051] Figure 2 A data structure organization diagram in one embodiment;

[0052] Figure 3 A schematic diagram of a flow chart of a virtual private network communication method in one embodiment;

[0053] Figure 4 Another data structure organization diagram in one embodiment;

[0054] Figure 5a A schematic diagram of a process of information to be transmitted leaving a virtual private network in one embodiment;

[0055] Figure 5b A schematic diagram of a process of information to be transmitted entering a virtual private network in one embodiment;

[0056] Figure 6 An application environment diagram of a virtual private network communication method in one embodiment;

[0057] Figure 7 It is another configuration schematic diagram of an embodiment;

[0058] Figure 8 is a structural block diagram of a virtual private network communication device in one embodiment;

[0059] Fig. 9 is an internal structure diagram of a computer device in one embodiment;

[0060] Fig.10 The figure is a diagram of the internal structure of another computer device in one embodiment. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] In order to enable those skilled in the art to better understand the present application, the relevant technology is first introduced below.

[0063] With the development of computer technology, virtual private networks (VPN) have been increasingly widely used. As a modern open source VPN protocol, WireGuard has become the preferred solution for building virtual private networks due to its high performance, security, reliability, ease of use, and cross-platform support. It is used in cloud service security, zero trust and other solutions.

[0064] WireGuard can be implemented through the WireGuard driver. The WireGuard driver refers to the functional module that implements the WireGuard protocol, including user-mode and kernel-mode implementations, and supports mainstream operating systems such as Linux, Windows, FreeBSD, Android, iOS, and macOS. In the implementation of WireGuard, the virtual network device used by the WireGuard protocol (hereinafter referred to as the wg device) can communicate with communication nodes within the range of IP addresses that allow communication, but there are situations where a single wg device cannot achieve load balancing between multiple communication nodes. To better understand the following, the relevant concepts are explained first.

[0065] The communication node that communicates with the virtual network device is also called a peer. In WireGuard, it refers to the devices or nodes at both ends of the VPN tunnel. Each peer can be identified by its unique public key, which is used to uniquely identify the peer in the network.

[0066] AllowedIPs is used to define the IP address segments that each peer (node) in the VPN tunnel is allowed to pass through. It can be a list of IP addresses or IP address segments. It specifies which IP address packets should be forwarded through the WireGuard tunnel. In some examples, it can be specified in the configuration file in the format of AllowedIPs = 10.0.0.0 / 24,192.168.1.0 / 24.

[0067] In practical applications, a communication node (hereinafter referred to as a peer) can represent a device or node in a VPN network. AllowedIPs is used to specify the IP address range that is allowed to communicate between peers. These two mechanisms together constitute the core of WireGuard network access control. By properly configuring Peer and AllowedIPs, refined network access control can be achieved to ensure that only authorized devices can access resources in the VPN network. For example, if AllowedIPs is set to 0.0.0.0 / 0 (for IPv4) and :: / 0 (for IPv6), all data packets will be sent through the WireGuard tunnel because these settings match all IP addresses; if AllowedIPs is set to a specific subnet (such as 10.0.0.0 / 24), only data packets whose destination is within that subnet will be sent through the WireGuard tunnel. At the same time, Peer also has an EndPoint, which refers to the IP address and Listen Port of the other end (Peer). It can identify the machine communicating at the other end of the WireGuard tunnel, that is, the network location of the Peer. In the configuration file, it can be specified in the format of Endpoint = [IPv4 / IPv6]:PORT. WireGuard uses the UDP protocol to communicate and encapsulate messages. EndPoint specifies the IP address and UDP port of the other end of the tunnel. Therefore, messages within the range of AllowedIPs can be sent to the specified peer through the WireGuard tunnel.

[0068] Figure 1 A configuration of a WireGuard device is shown. The following first introduces the main flow of WireGuard message processing in two directions: egress (that is, data traffic sent from a network or device, which can be understood as the path or process when data leaves a network or device) and ingress (as opposed to egress, it refers to data traffic entering a network or device, that is, the path or process when data arrives at a network or device) in combination with this configuration.

[0069] The main flow of message processing in the egress direction is as follows:

[0070] (1) The plaintext message with the destination address 192.168.1.123 arrives at the wg0 device network card.

[0071] (2) wg0 obtains the destination address "192.168.1.123" of the message, and then uses 192.168.1.123 as the keyword (key) to search for AllowedIPs and Peer. After the search, it confirms that it matches Peer A's AllowedIPs: 192.168.1.0 / 24, indicating that the message is allowed to pass.

[0072] (3) The message is encrypted according to the public key information of Peer A and the private key information of the wg0 device to obtain the encrypted message (i.e., ciphertext).

[0073] (4) Add the header information corresponding to the wg0 device to the encrypted message.

[0074] (5) Send the message obtained in step (4) to Peer A's Endpoint 1.1.1.1:6666. The message will be encapsulated into a UDP message with a destination IP of 1.1.1.1 and a destination port of 6666.

[0075] The main flow of message processing in the ingress direction is as follows:

[0076] (1) The above return UDP message arrives at port 6666 of the local machine (wg0 device).

[0077] (2) According to the WireGuard header information of the message, find the peer, which is Peer A.

[0078] (3) Decapsulate and decrypt the message to obtain the source IP address of the inner IP header: 192.168.1.123.

[0079] (4) Use the source IP address: 192.168.1.123 as the key to search for AllowedIPs. If the peer associated with AllowedIPs is also Peer A, it means that Peer A allows the message to pass.

[0080] (5) Throw the message into the receiving queue of the wg0 network card for further processing.

[0081] In the relevant specifications and implementations, AllowedIPs is visible and unique within the scope of the wg device, that is, on the same wg device, the same AllowedIPs segment can only appear on one of the peers. The data structure organization relationship is as follows: Figure 2As shown, the wg device maintains an allowedips tree. The nodes on the tree (called allowedips_node) are used to store IP address segments. At the same time, allowedips_node will point to Peer, indicating the Peer to which it belongs. Peer also has an allowedips_list linked list, which links its allowedips_node, that is, it maintains all allowedIPs address segments configured by Peer. Since allowedips_node is stored in the same tree and only points to one Peer, when a new Peer is configured with the same AllowedIPs segment, the allowedips_node's Peer pointer will be updated, and the allowedips_node will be linked to the new Peer's allowedips_list linked list, which is equivalent to deleting the originally linked allowedips_node from the original Peer.

[0082] Continue with Figure 1 The configuration shown is an example. After AllowedIPs 192.168.1.0 / 24 is configured on Peer A, if AllowedIPs 192.168.1.0 / 24 is also configured on Peer B, 192.168.1.0 / 24 disappears from the AllowedIPs list of Peer A and only exists in the AllowedIPs list of Peer B.

[0083] Peer A allows packets from the 192.168.1.0 / 24 network segment to pass through, and the IP address of the other end of the tunnel is 1.1.1.1, that is, all traffic in the 192.168.1.0 / 24 network segment will go to the 1.1.1.1 machine. Assume that the number of connections and traffic in the 192.168.1.0 / 24 network segment is very large, and the performance of the 1.1.1.1 machine is poor and cannot bear it. One solution is to add machines, that is, to load balance the traffic in the 192.168.1.0 / 24 network segment to 2 (or more) machines. However, since the same AllowedIPs can only exist on one Peer, a single wg device cannot achieve load balancing.

[0084] In this regard, the solutions for implementing load balancing using related technologies are as follows:

[0085] (1) Create multiple wg devices, for example, two wg devices: wg0 and wg1.

[0086] (2) wg0 and wg1 listen on different ports.

[0087] (3) The AllowedIPs configuration of the Peers of wg0 and wg1 is the same, for example, both are configured with 192.168.1.0 / 24, but the EndPoint configuration is different, wg0 is configured with 1.1.1.1:6666, and wg1 is configured with 2.2.2.2:6666.

[0088] (3) The machine is configured with ECMP routing. ECMP routing is a technology used to achieve load balancing and link backup in computer networks. Through ECMP routing, traffic from the same IP address or IP network segment can be load balanced to multiple links. As a result, traffic from 192.168.1.0 / 24 is equally routed to the wg0 and wg1 devices.

[0089] In the above solution, the traffic load is balanced to two wg devices through ECMP routing. Since the AllowedIPs of the two wg devices are configured the same, the traffic can pass through. However, the EndPoint configurations of the two wg devices are different, so the purpose of load balancing to different Peer devices can be achieved.

[0090] However, in the above solution, multiple wg devices need to be configured, and ECMP routing needs to be configured at the same time, which increases the complexity of use and management. Specifically, on the one hand, multiple wg devices need to be configured, and each wg device needs to be configured with a different listening port. The listening ports need to be uniformly managed and allocated, which increases the port consumption and management complexity; on the other hand, the same AllowedIPs and different EndPoints need to be configured on the peers of multiple wg devices. When the peer machines go online and offline, multiple wg devices need to be operated at the same time to modify their configurations, which makes it difficult to ensure the consistency of transactions; on the other hand, ECMP routing needs to be maintained. When the peer machines go online and offline, ECMP routing needs to be updated. Since ECMP routing is stateless, each update of ECMP routing may cause the routing results of all messages to change, causing the existing connected messages to be routed to different wg devices, and then distributed to different peer devices, resulting in service anomalies. At the same time, the maintenance of ECMP routing also increases the complexity of management.

[0091] It can be seen that the related technology has the problem of low efficiency of load balancing of virtual network devices.

[0092] Based on this, the present application provides a virtual private network communication method, apparatus, computer equipment, computer-readable storage medium and computer program product.

[0093] In one embodiment, Figure 3As shown, a virtual private network communication method is provided. This embodiment uses the method applied to a virtual private network device as an example. The virtual private network device can be a terminal or a server. Of course, the embodiment of the present application can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0094] S301, obtaining a communication address node tree corresponding to the virtual private network device, and determining a first allowed communication address to be added to a first communication node that communicates with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of information allowed to be transmitted between the virtual private network device and the first communication node.

[0095] In a specific implementation, the virtual private network device can maintain a communication address node tree, which includes multiple nodes. The multiple nodes in the communication address node tree correspond to different allowed communication addresses, wherein the allowed communication address is also called AllowedIPs. The allowed communication address in the communication address node tree represents the address of the information allowed to be transmitted between the virtual private network device and the first communication node, that is, when the transmitted information corresponds to a certain allowed communication address, it can be transmitted between the virtual private network device and the first communication node.

[0096] In this step, a communication address node tree can be obtained, and the allowed communication address to be added to the communication node that communicates with the virtual private network device can be determined. For the sake of distinction, the communication node to which the new allowed communication address is to be added is called the first communication node, and the allowed communication address to be added to the first communication node is called the first allowed communication address.

[0097] S302: If the communication address node tree does not include a node corresponding to the first allowed communication address, a master node corresponding to the first allowed communication address and the second communication node is added to the communication address node tree.

[0098] After determining the first allowed communication address, it is possible to search whether there is a node corresponding to the first allowed communication address in the communication address node tree. If the node corresponding to the first allowed communication address is not found, a master node corresponding to the first allowed communication address and the second communication node can be added to the communication address node tree. For example, a master node corresponding to the first allowed communication address is added to the communication address node tree, and the master node can point to the first communication node.

[0099] S303: If the communication address node tree includes a master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, a slave node corresponding to the first communication node is added.

[0100] If it is found that the communication address node tree already includes the master node corresponding to the first allowed communication address, that is, other communication nodes have requested to add a new first allowed communication node and have been added to the communication address node tree as the master node, then in this embodiment, the slave node linked list corresponding to the first allowed communication address can be obtained, and the slave node corresponding to the first communication node can be added to the slave node linked list.

[0101] It can be understood that the embodiment of the present application expands allowedips_node to a main node and a slave node, where the main node is a node on the communication address node tree (allowedips tree), and the slave node is a node in the slave_list linked list (i.e., the slave node list linked list), such as Figure 4 As shown, for each master node, multiple slave nodes can be maintained through the slave_list linked list, and each slave node can point to a communication node. Therefore, the embodiment of the present application supports the AllowedIPs configured by multiple Peers of the same wg device to contain the same IP address (segment), and can allow allowedips_node to point to multiple Peers and be added to the allowedips_list linked lists of multiple Peers. For example, the AllowedIPs of Peer B, Peer C, and Peer D of device wg0 all contain the address segment 192.168.1.0 / 24.

[0102] S304, when the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, determining a target node from the master node or slave node associated with the first allowed communication address, and transmitting the information to be transmitted through the target node.

[0103] Furthermore, when the virtual private network receives information to be transmitted and the information address of the information to be transmitted matches the first allowed communication address, if the information address of the information to be transmitted is the same as the first allowed communication address, or when the first allowed communication address is an IP address segment and the information address of the information to be transmitted falls into the IP address segment, the master node and slave node associated with the first allowed communication address can be obtained from the communication address node tree, and then the target node can be determined from the master node and the slave node by load balancing, and the information to be transmitted can be transmitted through the target node.

[0104] In the above-mentioned virtual private network communication method, a communication address node tree corresponding to the virtual private network device is obtained, and a first allowed communication address to be added to the first communication node communicating with the virtual private network device is determined, wherein each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information allowed to be transmitted between the virtual private network device and the first communication node; then, if the communication address node tree does not include the node corresponding to the first allowed communication address, a master node corresponding to the first allowed communication address and the second communication node is added to the communication address node tree; if the communication address node tree includes the master node corresponding to the first allowed communication address, a slave node corresponding to the first communication node is added to the slave node linked list corresponding to the first allowed communication address; and then, when the information address of the information to be transmitted by the virtual private network device matches the first allowed communication address, a target node is determined from the master node or slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node. In an embodiment of the present application, by including a master node corresponding to the first allowed communication address in the communication address node tree, a slave node corresponding to the first communication node is added in the slave node linked list corresponding to the first allowed communication address, so that multiple communication nodes of the same virtual private network device can be configured with the same allowed communication address, so that traffic with the same IP address or IP network segment can reach multiple communication nodes through multiple WireGuard tunnels of the same wg device, thereby achieving the purpose of traffic load balancing with a single virtual private network device. At the same time, this method does not require the addition of additional ECMP routing and other configurations, greatly simplifies the configuration and management complexity of load balancing, and improves the efficiency of load balancing of virtual network devices.

[0105] In an exemplary embodiment, the method may further include the following steps:

[0106] Construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, each hash tree node having a corresponding node hash value.

[0107] Specifically, in addition to expanding allowedips_node to a main node and a slave node, the embodiment of the present application also maintains a consistent hash tree (called conhash tree) for selecting peers during load balancing. In practical applications, for the same allowed communication address, there may be a consistent hash tree corresponding to it, and the consistent hash tree includes hash tree nodes corresponding to the main node and the slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value.

[0108] In some exemplary embodiments, constructing a consistent hash tree corresponding to the first allowed communication address may include the following steps:

[0109] When at least one node associated with the first allowed communication address is newly added, multiple virtual nodes corresponding to each node are generated for each node; and a consistent hash tree is constructed according to each virtual node.

[0110] Wherein, at least one node includes a master node and / or a slave node associated with the first allowed communication address.

[0111] Accordingly, in step S304, determining the target node from the master node and the slave node associated with the first allowed communication address information may include the following steps:

[0112] Obtain an information hash value corresponding to the information to be transmitted; determine a target node from the master node and the slave node associated with the first allowed communication address information according to the information hash value and the node hash values ​​of multiple hash tree nodes in the consistent hash tree; the node hash value of the corresponding hash tree node of the target node in the consistent hash tree matches the information hash value.

[0113] Specifically, when a Peer (i.e., the first communication node) adds a new AllowedIPs address segment, it will first check whether the AllowedIPs address segment already exists on the allowedips tree of the wg device. If not, it will be assigned an allowedips_node of type main node and added to the allowedips tree. At the same time, the main node will also create a consistent hash tree and add the Peer to the conhash tree. In order to make the consistent hashing more balanced, when adding each Peer to the conhash tree, multiple nodes can be virtualized for the Peer. For example, the same Peer can have 128 nodes associated with the Peer on the conhashtree. These nodes are also called virtual nodes (peer_vnode). By generating multiple corresponding virtual nodes for each node, the virtual nodes of the same communication node can be more evenly distributed in the consistent hash tree, thereby improving the effectiveness of load balancing.

[0114] If the AllowedIPs address segment already exists on the allowedips tree, that is, it hits a main node, then an allowedips_node of type slave node will be assigned to it. The slave node will not be added directly to the allowedips tree, but will be added to the slave list of the main node. At the same time, the slave node will point to the peer and the allowedips_list linked list added to the peer, just like the mainnode, and will also point to the main node. In short, when an AllowedIPs address segment is first added by a peer, it will be added to the allowedipstree as a main node. After that, when other peers add the same AllowedIPs address segment, they will be added to the slave_list linked list of the mainnode as slave nodes.

[0115] Then, when the information to be transmitted is obtained, the information hash value corresponding to the information to be transmitted can be obtained, and then the information hash value is matched with the node hash values ​​of multiple hash tree nodes in the consistent hash tree, and the hash tree node corresponding to the successfully matched node hash value is used as the target node. Thus, for the same virtual private network device, the traffic within the AllowedIPs range can be load balanced and transmitted to multiple Peer devices through multiple tunnels.

[0116] In an exemplary embodiment, obtaining the information hash value corresponding to the information to be transmitted may include the following steps:

[0117] If the information to be transmitted is information leaving a virtual private network, the source IP address and source port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined based on the source IP address and the source port; if the information to be transmitted is information entering a virtual private network, the destination IP address and destination port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined based on the destination IP address and the destination port.

[0118] Among them, the information leaving the virtual private network can be understood as information in the egress direction, and the information entering the virtual private network can be understood as information in the ingress direction.

[0119] In one embodiment, reference Figure 5a, the original message (i.e. the information to be transmitted) can be routed to the specified wg device according to the destination IP address. Then, the destination IP address of the original message is used as the key to search for allowedips_node on the allowedips tree of the wg device. If it does not hit, it means that the message is not allowed to pass, and an ICMP destination unreachable message is sent to the source IP, then the packet is dropped and the processing ends; if it hits, the source IP address and source port of the message (TCP / UDP message, other message source ports use 0) are used as the key to calculate the information hash value, and then the node hash values ​​of multiple hash tree nodes in the consistent hash tree are used for consistent hashing, and a peer is selected from the conhash tree of allowedips_node to continue processing the message. When the traffic is large, the source IP address and source port of the message will be relatively scattered, and the peers selected by the consistent hashing will be different and relatively balanced, so the purpose of balancing the traffic load to different peers can be achieved. After that, the original message can be encrypted, the WireGuard header can be added, and the encrypted message can be encapsulated with the UDP and IP headers according to the EndPoint information of the selected Peer. That is, the encapsulated message is a UDP message, and then the encapsulated UDP message is sent from the UDPsocket configured by the wg device, and finally sent to the specified Peer device.

[0120] On the other hand, reference Figure 5b , when the UDP socket of the wg device receives the message, it finds the peer according to the key information carried in the WireGuard header of the message, and first decrypts and decapsulates the message. Then, the source IP address of the decapsulated and decrypted original message is used as the key to search for allowedips_node on the allowedips tree of the wg device. If it does not hit, it means that the message is not allowed to pass, the packet is dropped and the processing ends; if it hits, the destination IP address and destination port of the original message (TCP / UDP message, other message source ports use 0) are used as the key to calculate the hash value, perform consistent hashing, and select a peer from the conhash tree of allowedips_node. The key used for consistent hashing here is the destination IP address and destination port of the original message. The egress above uses the source IP address and source port of the original message, which are actually the same IP and port. Consistent hashing ensures that the messages in both the egress and ingress directions of the same session will hit the same peer. In one embodiment, it is also possible to compare whether the peers selected twice are the same. If they are the same, the message is released. Otherwise, it means that the message is not allowed to pass, the packet is discarded and the processing is terminated.

[0121] Through the information hash value acquisition method in this embodiment, it is effectively guaranteed that the messages of the same session or connection are processed by the same peer of the wg device in both the ingress and egress directions, which can effectively improve the security of the session information transmission process during load balancing.

[0122] In an exemplary embodiment, the method may further include the following steps:

[0123] Determine the second allowed communication address to be deleted of the second communication node that communicates with the virtual private network device; if the master node corresponding to the second allowed communication address is found on the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after each slave node in the slave node linked list of the second allowed communication address is deleted, delete the master node corresponding to the second allowed communication address from the communication address node tree.

[0124] In practical applications, the existing allowed communication addresses on the communication address node tree can be deleted. For easy distinction, the communication node requesting to delete the allowed communication address is called the second communication node, and the allowed communication address to be deleted by the second communication node is called the second allowed communication address.

[0125] Specifically, when a second communication node intends to delete the second allowed communication address (AllowedIPs address segment), it will search for the AllowedIPs address segment on the allowedips tree of the wg device. If there is no hit in the communication address node tree, it will end directly; if there is a hit, it can further check whether the communication node pointed to by the hit allowedips_node (that is, the main node) is consistent with the current second communication node. If they are consistent, check the slave node linked list of the second allowed communication address, that is, the slave_list linked list associated with allowedips_node, to determine whether there are any slave nodes on it. If so, it can be determined that multiple peers are configured with the AllowedIPs address segment. The main node main node cannot be deleted directly, but it is marked. After all slave nodes are deleted, the main node is deleted from the allowedips tree. In this way, the normal communication between other communication nodes with the same allowed communication address and the virtual private network device is effectively guaranteed.

[0126] In one embodiment, after determining the second allowed communication address to be deleted of the second communication node communicating with the virtual private network device, the following steps may also be included:

[0127] If the master node corresponding to the second allowed communication address is not found in the communication address node tree, the slave node linked list of the second allowed communication address is obtained; in the slave node linked list of the second allowed communication address, the slave node corresponding to the second communication node is deleted.

[0128] Specifically, when a second communication node intends to delete the second allowed communication address (AllowedIPs address segment), it will search for the AllowedIPs address segment on the wg device's allowedips tree. If there is no hit in the communication address node tree, the process ends directly; if there is a hit, it can be further checked whether the communication node pointed to by the hit allowedips_node (i.e., the master node) is consistent with the current second communication node. If they are inconsistent, the slave node list of the master node can be traversed to match each slave node in the slave node list with the current Peer (second communication node). If they are the same, the hit slave node will be deleted, otherwise it means that the Peer has not configured the AllowedIPs address segment to be deleted, and the process ends. Through this embodiment, it can be determined that the correct slave node will be deleted from the slave node list to avoid interfering with the normal communication between other communication nodes with the same allowed communication address and the virtual private network device.

[0129] In order to enable those skilled in the art to better understand the above steps, the embodiment of the present application is illustrated below by using an example, but it should be understood that the embodiment of the present application is not limited to this.

[0130] The following is an exemplary embodiment of the present application, and its application scenario is zero trust. Figure 6 As an example diagram, employees of a certain enterprise's branch use zero-trust products to access the company's database, web services, and various APP services. The zero-trust product implements VPN based on the WireGuard protocol.

[0131] 1) The enterprise uses IP addresses in the 192.168.1.0 / 24 network segment, including the addresses of employees' terminal devices and the addresses of various enterprise services.

[0132] 2) The employee's terminal device accesses the enterprise's VPN network through the zero-trust POP node POP1. The POP node is also called a POP point or point-of-presence, which is mainly located outside the edge of the network enterprise and is the entry point to the enterprise network.

[0133] 3) Various services of the enterprise access the enterprise’s VPN network by reversely accessing the zero-trust POP node POP2 through the enterprise connector.

[0134] 4) The VPN tunnels between POP1, POP2 and the enterprise connectors Peer A, Peer B, and Peer C are implemented using the WireGuard protocol, and AllowedIPs is configured as 192.168.1.0 / 24, allowing the IP addresses of the enterprise intranet to pass. WireGuard tunnels are established in segments between the client and POP1, between POP1 and POP2, and between POP2 and the enterprise connector.

[0135] 5) The enterprise connector deploys three machines, namely PeerA, Peer B, and Peer C. It is hoped that the traffic from POP2 can be load balanced to these three devices to avoid single point failures caused by failures such as enterprise connector downtime or insufficient performance, which will make all enterprise services inaccessible.

[0136] 6) On the wg0 device of POP2, do Figure 7 The configuration shown indicates that POP2 can send packets from the 192.168.1.0 / 24 network segment to Peer A, Peer B, and Peer C.

[0137] 7) Assume that employee A’s source IP address is 192.168.1.123, and initiates an HTTP request service to the Web server. Its destination IP address is 192.168.1.1, TCP destination port is 80, and TCP source port is 4567. Then when the message is sent from POP2 to the enterprise connector, the destination IP address 192.168.1.1 will be used to match AllowedIPs and hit the AllowedIPs segment 192.168.1.0 / 24. Then the source IP address 192.168.1.123 and the source port 4567 will be used as the key to calculate the hash value. According to the consistent hashing algorithm, a peer is selected from the three peers associated with AllowedIPs: 192.168.1.0 / 24: PeerA, PeerB, and PeerC. Assuming that PeerB is selected, the message will be encrypted and encapsulated according to the key of wg0, the public key configured by PeerB, and the EndPoint. The encapsulated message will be added with a UDP header and an IP header. The outer IP destination address is 2.2.2.2 specified by PeerB EndPoint, and the destination port of the outer UDP header is 6666 specified by PeerB EndPoint. In this way, the message will be sent to Peer B for processing. After receiving the message, Peer B will decrypt and decapsulate it, and finally forward it to the Web server for processing. After processing, the Web server sends a response message. The four-tuple of the response message is exactly the opposite of the four-tuple of employee A's request message. The response message is processed by Peer B and sent to POP2.

[0138] 8) POP2 receives the response message. It first searches for the peer based on the key information in the WireGuard header of the message, which is Peer B. It then decrypts and decapsulates the message. It then matches AllowedIPs based on the source IP address of the inner message after decryption and decapsulation: 192.168.1.1, and hits the AllowedIPs segment 192.168.1.0 / 24. It then uses the destination IP address 192.168.1.123 and destination port 4567 of the inner message as the key to calculate the hash value. It then selects a peer from the three peers associated with AllowedIPs: 192.168.1.0 / 24: PeerA, PeerB, and PeerC according to the consistent hashing algorithm. PeerB is selected here. If the same peer is selected twice, it means that the message can be released. The message is then delivered to the wg0 device for further processing, forwarded to POP1, and finally reaches employee A's device.

[0139] 9) POP2 will select different peers based on the IP addresses and ports of different employees, so the traffic load can be balanced to different peers.

[0140] 10) Zero trust networks can also add POP points as needed and perform load balancing between POP points.

[0141] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0142] Based on the same inventive concept, the embodiment of the present application also provides a virtual private network communication device for implementing the virtual private network communication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more virtual private network communication device embodiments provided below can refer to the limitations on the virtual private network communication method above, and will not be repeated here.

[0143] In an exemplary embodiment, Figure 8As shown, a virtual private network communication device is provided, comprising:

[0144] The information acquisition module 801 is used to acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node;

[0145] A first node adding module 802 is configured to add a master node corresponding to the first allowed communication address and the first communication node in the communication address node tree if the communication address node tree does not include a node corresponding to the first allowed communication address;

[0146] A second node adding module 803 is configured to add a slave node corresponding to the first communication node in a slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address;

[0147] The information transmission module 804 is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, and transmit the information to be transmitted through the target node.

[0148] In one embodiment, the apparatus further comprises:

[0149] A hash tree construction module, used to construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, each of the hash tree nodes having a corresponding node hash value;

[0150] The information transmission module 804 is used to:

[0151] Obtaining an information hash value corresponding to the information to be transmitted;

[0152] According to the information hash value and the node hash values ​​of the multiple hash tree nodes in the consistent hash tree, the target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the corresponding hash tree node of the target node in the consistent hash tree matches the information hash value.

[0153] In one embodiment, the information transmission module 804 is used to:

[0154] If the information to be transmitted is information leaving a virtual private network, obtaining a source IP address and a source port of the information to be transmitted, and determining an information hash value corresponding to the information to be transmitted according to the source IP address and the source port;

[0155] If the information to be transmitted is information for entering a virtual private network, the destination IP address and the destination port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined according to the destination IP address and the destination port.

[0156] In one embodiment, the hash tree construction module is used to:

[0157] When at least one node is newly associated with the first allowed communication address, for each of the nodes, a plurality of virtual nodes corresponding to the node are generated; the at least one node includes a master node and / or a slave node associated with the first allowed communication address;

[0158] A consistent hash tree is constructed according to each of the virtual nodes.

[0159] In one embodiment, the device further includes a node deletion module, wherein the node deletion module is configured to:

[0160] Determine a second allowed communication address to be deleted of a second communication node communicating with the virtual private network device;

[0161] If the master node corresponding to the second allowed communication address is found on the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after each slave node in the slave node linked list of the second allowed communication address is deleted, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

[0162] In one embodiment, the node deletion module is further used to:

[0163] If the master node corresponding to the second allowed communication address is not found on the communication address node tree, obtaining a slave node linked list of the second allowed communication address;

[0164] In the slave node linked list of the second allowed communication address, the slave node corresponding to the second communication node is deleted.

[0165] Each module in the above-mentioned virtual private network communication device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0166] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store a communication address node tree. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a virtual private network communication method is implemented.

[0167] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a virtual private network communication method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0168] Those skilled in the art will understand that Fig. 9 and Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0169] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0170] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0171] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0172] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0173] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0174] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0175] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A virtual private network communication method, characterized in that: The method comprises: Acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node; If the communication address node tree does not include a node corresponding to the first allowed communication address, adding a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree; If the communication address node tree includes the master node corresponding to the first allowed communication address, then in the slave node linked list corresponding to the first allowed communication address, adding a slave node corresponding to the first communication node; When the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

2. The method according to claim 1, characterized in that The method further comprises: Constructing a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, each of the hash tree nodes having a corresponding node hash value; The determining of the target node from the master node and the slave node associated with the first allowed communication address information comprises: Obtaining an information hash value corresponding to the information to be transmitted; According to the information hash value and the node hash values ​​of the multiple hash tree nodes in the consistent hash tree, the target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the corresponding hash tree node of the target node in the consistent hash tree matches the information hash value.

3. The method according to claim 2, characterized in that The obtaining of the information hash value corresponding to the information to be transmitted includes: If the information to be transmitted is information leaving a virtual private network, obtaining a source IP address and a source port of the information to be transmitted, and determining an information hash value corresponding to the information to be transmitted according to the source IP address and the source port; If the information to be transmitted is information for entering a virtual private network, the destination IP address and the destination port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined according to the destination IP address and the destination port.

4. The method according to claim 2, characterized in that: The constructing the consistent hash tree corresponding to the first allowed communication address includes: When at least one node is newly associated with the first allowed communication address, for each of the nodes, a plurality of virtual nodes corresponding to the node are generated; the at least one node includes a master node and / or a slave node associated with the first allowed communication address; A consistent hash tree is constructed according to each of the virtual nodes.

5. The method according to claim 1, characterized in that: The method further comprises: Determine a second allowed communication address to be deleted of a second communication node communicating with the virtual private network device; If the master node corresponding to the second allowed communication address is found on the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after each slave node in the slave node linked list of the second allowed communication address is deleted, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

6. The method according to claim 5, characterized in that After determining the second allowed communication address to be deleted of the second communication node communicating with the virtual private network device, the method further includes: If the master node corresponding to the second allowed communication address is not found on the communication address node tree, obtaining a slave node linked list of the second allowed communication address; In the slave node linked list of the second allowed communication address, the slave node corresponding to the second communication node is deleted.

7. A virtual private network communication device, characterized in that: The device comprises: An information acquisition module is used to acquire a communication address node tree corresponding to a virtual private network device, and determine a first allowed communication address to be added to a first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents an address of information allowed to be transmitted between the virtual private network device and the first communication node; A first node adding module, configured to add a master node corresponding to the first allowed communication address and the first communication node in the communication address node tree if the communication address node tree does not include a node corresponding to the first allowed communication address; A second node adding module is used to add a slave node corresponding to the first communication node in a slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address; An information transmission module is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted of the virtual private network device matches the first allowed communication address, and transmit the information to be transmitted through the target node.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images