Virtual Private Network (VPN) communication methods, apparatus, computer equipment, readable storage media, and program products

Abstract

This application relates to a virtual private network (VPN) communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product, belonging to the field of VPN technology, and can improve the load balancing efficiency of VPN devices. The method includes: obtaining a communication address node tree; determining a first allowed communication address to be added as a first communication node communicating with the VPN device; if the communication address node tree does not include a node corresponding to the first allowed communication address, then adding a master node corresponding to the first allowed communication address and a second communication node to the communication address node tree; if the communication address node tree includes a master node corresponding to the first allowed communication address, then adding a slave node corresponding to the first communication node to the slave node linked list corresponding to the first allowed communication address; when the information address of the information to be transmitted matches the first allowed communication address, determining a target node from the master node or slave node, and transmitting the information to be transmitted through the target node.

Description

Technical Field

[0001] This application relates to the field of virtual private network (VPN) technology, and in particular to a VPN communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of computer technology, Virtual Private Networks (VPNs) are being used more and more widely. WireGuard, as a modern VPN protocol, has become the preferred solution for building VPNs due to its high performance, security, reliability, ease of use, and cross-platform support. In the implementation of WireGuard, the virtual network device used by the protocol can communicate with communication nodes within the allowed IP address range. However, there are situations where a single virtual network device cannot achieve load balancing among multiple communication nodes.

[0003] In related technologies, the main approach is to provide multiple virtual network devices and then use Equal-Cost Multi-Path (ECMP) routing to balance the traffic load across the multiple virtual network devices, with each virtual network device then transmitting the traffic to the communication node.

[0004] However, the above method requires configuring multiple virtual network devices and ECMP routing, which increases the complexity of use and management and results in low load balancing efficiency of virtual network devices. Summary of the Invention

[0005] Therefore, it is necessary to provide a virtual private network communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] Firstly, this application provides a virtual private network communication method, including:

[0007] Obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added for the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0008] If the communication address node tree does not include the node corresponding to the first allowed communication address, then a master node corresponding to the first allowed communication address and the first communication node is added to the communication address node tree;

[0009] If the communication address node tree includes a master node corresponding to the first allowed communication address, then a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address.

[0010] When the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0011] In one embodiment, the method further includes:

[0012] Construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value;

[0013] Determining the target node from the master node and the slave node associated with the first allowed communication address information includes:

[0014] Obtain the information hash value corresponding to the information to be transmitted;

[0015] Based on the information hash value and the node hash values ​​of multiple hash tree nodes in the consistent hash tree, a target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the target node corresponding to the hash tree node in the consistent hash tree matches the information hash value.

[0016] In one embodiment, obtaining the information hash value corresponding to the information to be transmitted includes:

[0017] If the information to be transmitted is information leaving the virtual private network, then obtain the source IP address and source port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the source IP address and the source port;

[0018] If the information to be transmitted is information for entering a virtual private network, then obtain the destination IP address and destination port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the destination IP address and the destination port.

[0019] In one embodiment, constructing the consistent hash tree corresponding to the first allowed communication address includes:

[0020] When the first allowed communication address adds at least one associated node, multiple virtual nodes are generated for each node; the at least one node includes the master node and / or slave node associated with the first allowed communication address;

[0021] A consistent hash tree is constructed based on each of the virtual nodes.

[0022] In one embodiment, the method further includes:

[0023] Determine the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device;

[0024] If a master node corresponding to the second allowed communication address is found in the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after deleting each slave node in the slave node linked list of the second allowed communication address, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

[0025] In one embodiment, after determining the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device, the method further includes:

[0026] If no master node corresponding to the second allowed communication address is found in the communication address node tree, then the slave node list of the second allowed communication address is obtained;

[0027] In the slave node list of the second allowed communication address, delete the slave node corresponding to the second communication node.

[0028] Secondly, this application also provides a virtual private network communication device, comprising:

[0029] The information acquisition module is used to acquire the communication address node tree corresponding to the virtual private network device, and to determine the first allowed communication address to be added to the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0030] The first node adding module is used to add a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree if the communication address node tree does not include the node corresponding to the first allowed communication address.

[0031] The second node adding module is used to add a slave node corresponding to the first communication node to the slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address.

[0032] The information transmission module is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, and to transmit the information to be transmitted through the target node.

[0033] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0034] Obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added for the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0035] If the communication address node tree does not include the node corresponding to the first allowed communication address, then a master node corresponding to the first allowed communication address and the first communication node is added to the communication address node tree;

[0036] If the communication address node tree includes a master node corresponding to the first allowed communication address, then a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address.

[0037] When the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0038] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0039] Obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added for the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0040] If the communication address node tree does not include the node corresponding to the first allowed communication address, then a master node corresponding to the first allowed communication address and the first communication node is added to the communication address node tree;

[0041] If the communication address node tree includes a master node corresponding to the first allowed communication address, then a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address.

[0042] When the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0043] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0044] Obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added for the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0045] If the communication address node tree does not include the node corresponding to the first allowed communication address, then a master node corresponding to the first allowed communication address and the first communication node is added to the communication address node tree;

[0046] If the communication address node tree includes a master node corresponding to the first allowed communication address, then a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address.

[0047] When the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0048] The aforementioned virtual private network (VPN) communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire a communication address node tree corresponding to a VPN device, and determine a first allowed communication address to be added for a first communication node communicating with the VPN device. Each node in the communication address node tree corresponds to a corresponding allowed communication address, which represents the address of the information allowed to be transmitted between the VPN device and the first communication node. Then, if the communication address node tree does not include a node corresponding to the first allowed communication address, a master node corresponding to the first allowed communication address and the second communication node is added to the communication address node tree. If the communication address node tree includes a master node corresponding to the first allowed communication address, a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address. Furthermore, when the information address of the information to be transmitted by the VPN device matches the first allowed communication address, a target node is determined from the master node or slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node. In this embodiment, by including the master node corresponding to the first allowed communication address in the communication address node tree, a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address. This allows multiple communication nodes of the same virtual private network device to be configured with the same allowed communication address. Traffic with the same IP address or IP segment can reach multiple communication nodes through multiple WireGuard tunnels of the same WG device, achieving the purpose of traffic load balancing with a single virtual private network device. At the same time, this method does not require additional ECMP routing or other configurations, greatly simplifying the configuration and management complexity of load balancing and improving the efficiency of virtual network device load balancing. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a schematic diagram of one configuration in one embodiment;

[0051] Figure 2 This is a data structure organization diagram in one embodiment;

[0052] Figure 3 This is a flowchart illustrating a virtual private network communication method in one embodiment;

[0053] Figure 4 This is a diagram showing another data structure organization in one embodiment;

[0054] Figure 5a This is a schematic diagram illustrating the process of information to be transmitted leaving a virtual private network in one embodiment;

[0055] Figure 5b This is a schematic diagram illustrating the process of information to be transmitted entering a virtual private network in one embodiment;

[0056] Figure 6 This is an application environment diagram of a virtual private network communication method in one embodiment;

[0057] Figure 7 This is a schematic diagram of another configuration in one embodiment;

[0058] Figure 8 This is a structural block diagram of a virtual private network communication device in one embodiment;

[0059] Figure 9 This is an internal structural diagram of a computer device in one embodiment;

[0060] Figure 10 This is an internal structural diagram of another computer device in one embodiment. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0062] To enable those skilled in the art to better understand this application, the relevant technologies are first introduced below.

[0063] With the development of computer technology, Virtual Private Networks (VPNs) are being used more and more widely. WireGuard, as a modern open-source VPN protocol, has become the preferred solution for building VPNs due to its high performance, security, reliability, ease of use, and cross-platform support. For example, it is used in cloud service security and zero-trust solutions.

[0064] WireGuard can be implemented through WireGuard drivers. A WireGuard driver is a functional module that implements the WireGuard protocol, including user-space and kernel-space implementations, and supports major operating systems such as Linux, Windows, FreeBSD, Android, iOS, and macOS. In the implementation of WireGuard, the virtual network device (hereinafter referred to as a wg device) used by the WireGuard protocol can communicate with communication nodes within the allowed IP address range. However, there are situations where a single wg device cannot achieve load balancing among multiple communication nodes. To better understand the following text, the relevant concepts will be explained first.

[0065] The communication node that communicates with the virtual network device is also called a peer. In WireGuard, it refers to the device or node at both ends of the VPN tunnel. Each peer can be identified by its unique public key, which is used to uniquely identify the peer in the network.

[0066] AllowedIPs is used to define the range of IP addresses that are allowed to pass through each peer (node) in the VPN tunnel. It can be a single IP address or a list of IP address ranges. It specifies which IP address packets should be forwarded through the WireGuard tunnel. In some examples, it can be specified in the configuration file in the format AllowedIPs = 10.0.0.0 / 24,192.168.1.0 / 24.

[0067] In practical applications, a communication node (hereinafter referred to as a peer) can represent a device or node in a VPN network. AllowedIPs is used to specify the range of IP addresses allowed to communicate between peers. These two mechanisms together constitute the core of WireGuard network access control. By properly configuring peers and AllowedIPs, fine-grained network access control can be achieved, ensuring that only authorized devices can access resources in the VPN network. For example, if AllowedIPs are set to 0.0.0.0 / 0 (for IPv4) and :: / 0 (for IPv6), all packets will be sent through the WireGuard tunnel because these settings match all IP addresses. If AllowedIPs are set to a specific subnet (such as 10.0.0.0 / 24), then only packets destined for that subnet will be sent through the WireGuard tunnel. Additionally, a Peer also has an EndPoint, which refers to the IP address and listening port of the peer. It identifies the machine communicating at the other end of the WireGuard tunnel, i.e., the network location of the Peer. In the configuration file, it can be specified in the format Endpoint = [IPv4 / IPv6]:PORT. WireGuard uses the UDP protocol for communication and packet encapsulation, and the EndPoint specifies the IP address and UDP port of the tunnel peer. Therefore, packets within the allowed IP range can be sent to the specified peer through the WireGuard tunnel.

[0068] Figure 1 The following describes the configuration of a WireGuard device. Based on this configuration, we will first introduce the main message processing flow of WireGuard in two directions: egress (i.e., data traffic sent out from a network or device, which can be understood as the path or process when data leaves a network or device) and ingress (as opposed to egress, referring to data traffic entering a network or device, i.e., the path or process when data arrives at a network or device).

[0069] The main message processing flow in the egress direction is as follows:

[0070] (1) A plaintext message with a destination address of 192.168.1.123 arrives at the network card of the wg0 device.

[0071] (2) wg0 obtains the destination address of the packet "192.168.1.123", and then uses 192.168.1.123 as the key to search for AllowedIPs and Peer. After the search, it is confirmed that it matches the AllowedIPs of Peer A: 192.168.1.0 / 24, which means that the packet is allowed to pass.

[0072] (3) The message is encrypted based on the public key information of Peer A and the private key information of wg0 device to obtain the encrypted message (i.e. ciphertext).

[0073] (4) Add header information corresponding to the wg0 device to the encrypted message.

[0074] (5) Send the message obtained in step (4) to Peer A’s Endpoint 1.1.1.1:6666. The message will be encapsulated into a UDP message with a destination IP of 1.1.1.1 and a destination port of 6666.

[0075] The main message processing flow in the ingress direction is as follows:

[0076] (1) The above return UDP message arrived at port 6666 of the local machine (wg0 device).

[0077] (2) Based on the WireGuard header information of the message, find the Peer. Here, Peer A is found.

[0078] (3) Decapsulate and decrypt the message to obtain the source IP address of the inner IP header: 192.168.1.123.

[0079] (4) Using the source IP address: 192.168.1.123 as the key, search for AllowedIPs. If the Peer associated with AllowedIPs is also Peer A, it means that Peer A allows the packet to pass.

[0080] (5) Add the message to the receive queue of the wg0 network card for further processing.

[0081] In relevant specifications and implementations, AllowedIPs are visible and unique within the wg device scope. That is, on the same wg device, the same AllowedIPs segment can only appear on one peer. Its data structure organization is as follows: Figure 2As shown, the WG device maintains an allowedips tree. Nodes in the tree (called allowedips_nodes) store IP address ranges. Each allowedips_node points to a Peer, indicating the Peer it belongs to. Each Peer also has an allowedips_list linked list, which links to its allowedips_nodes, thus maintaining all allowedIP address ranges configured by the Peer. Since allowedips_nodes are stored in the same tree and point to only one Peer, when a new Peer configures the same allowedIP range, the peer pointer of the allowedips_node is updated, and the allowedips_node is linked to the new Peer's allowedips_list. This is equivalent to deleting the previously linked allowedips_node from the original Peer.

[0082] Continue with Figure 1 The configuration shown is an example. After configuring AllowedIPs 192.168.1.0 / 24 on Peer A, if AllowedIPs 192.168.1.0 / 24 is also configured on Peer B, then 192.168.1.0 / 24 will disappear from the AllowedIPs list of Peer A and only exist in the AllowedIPs list of Peer B.

[0083] Peer A allows packets from the 192.168.1.0 / 24 network segment to pass through, and the IP address of the tunnel's peer is 1.1.1.1. This means that all traffic within the 192.168.1.0 / 24 network segment will go to the machine 1.1.1.1. Assuming that the number of connections and traffic in the 192.168.1.0 / 24 network segment is very large, and the machine 1.1.1.1 has poor performance and cannot handle the load, one solution is to add more machines, i.e., hoping to load balance the traffic within the 192.168.1.0 / 24 network segment to two (or more) machines. However, since the same AllowedIPs can only exist on one Peer, a single wg device cannot achieve load balancing.

[0084] The following are solutions for load balancing based on relevant technologies:

[0085] (1) Create multiple wg devices, such as two wg devices: wg0 and wg1.

[0086] (2) wg0 and wg1 listen on different ports.

[0087] (3) The AllowedIPs configuration of the Peer of wg0 and wg1 is the same, for example, both are configured with 192.168.1.0 / 24, but the EndPoint configuration is different. wg0 is configured with 1.1.1.1:6666, and wg1 is configured with 2.2.2.2:6666.

[0088] (3) Configure ECMP routing on the machine. ECMP routing is a technology used in computer networks to achieve load balancing and link backup. Through ECMP routing, traffic with the same IP address or IP segment can be load balanced across multiple links. Thus, the traffic of 192.168.1.0 / 24 is equivalently routed to wg0 and wg1 devices.

[0089] In the above scheme, traffic load balancing is achieved on two wg devices using ECMP routing. Since the allowed IPs of the peer are configured the same on both wg devices, traffic can pass through. However, the endpoints of the two wg devices are configured differently, thus achieving the goal of load balancing on different peer devices.

[0090] However, the above solution requires configuring multiple WG devices and ECMP routes, increasing the complexity of use and management. Specifically, on the one hand, multiple WG devices need to be configured, each with a different listening port, requiring unified management and allocation of these ports, increasing port consumption and management complexity. On the other hand, the same AllowedIPs and different EndPoints need to be configured on the peers of multiple WG devices. When a peer machine goes online or offline, multiple WG devices need to be operated simultaneously to modify their configurations, making it difficult to guarantee transaction consistency. Furthermore, ECMP routes need to be maintained. When a peer machine goes online or offline, ECMP routes need to be updated. Since ECMP routes are stateless, each update may cause changes to the routing results of all packets, resulting in packets from existing connections being routed to different WG devices and then distributed to different peer devices, leading to service anomalies. The maintenance of ECMP routes also increases management complexity.

[0091] It is evident that the relevant technologies suffer from low load balancing efficiency of virtual network devices.

[0092] Based on this, this application provides a virtual private network communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product.

[0093] In one embodiment, such as Figure 3As shown, a virtual private network (VPN) communication method is provided. This embodiment illustrates the application of this method to a VPN device, which can be a terminal or a server. Of course, this embodiment can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0094] S301, obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added to the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node.

[0095] In a specific implementation, a virtual private network device can maintain a communication address node tree, which includes multiple nodes. Each node in the communication address node tree corresponds to a different allowed communication address. The allowed communication address is also called AllowedIPs. The allowed communication address in the communication address node tree represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node. That is, when the transmitted information corresponds to a certain allowed communication address, it can be transmitted between the virtual private network device and the first communication node.

[0096] In this step, the communication address node tree can be obtained, and the allowed communication addresses to be added to the communication nodes communicating with the virtual private network device can be determined. For easy distinction, the communication node to which a new allowed communication address is to be added is called the first communication node, and the allowed communication address to be added to the first communication node is called the first allowed communication address.

[0097] S302, if the communication address node tree does not include the node corresponding to the first allowed communication address, then add a master node corresponding to the first allowed communication address and the second communication node to the communication address node tree.

[0098] After determining the first allowed communication address, we can check if a node corresponding to the first allowed communication address exists in the communication address node tree. If no node corresponding to the first allowed communication address is found, a master node corresponding to the first allowed communication address and the second communication node can be added to the communication address node tree. For example, a master node corresponding to the first allowed communication address can be added to the communication address node tree, and this master node can point to the first communication node.

[0099] S303, if the communication address node tree includes a master node corresponding to the first allowed communication address, then add a slave node corresponding to the first communication node to the slave node linked list corresponding to the first allowed communication address.

[0100] If the communication address node tree already contains the master node corresponding to the first allowed communication address, meaning that other communication nodes have requested to add the first allowed communication node and have already been added as master nodes to the communication address node tree, then in this embodiment, the slave node list corresponding to the first allowed communication address can be obtained, and a slave node corresponding to the first communication node can be added to the slave node list.

[0101] It is understood that in this application embodiment, allowedips_node is expanded to include a main node and slave nodes. The main node is a node in the allowedips tree, and the slave nodes are nodes in the slave_list linked list (i.e., the list of slave nodes). Figure 4 As shown, for each master node, multiple slave nodes can be maintained through the slave_list linked list. Each slave node can point to a communication node. Thus, this embodiment of the application supports multiple peers of the same wg device having AllowedIPs containing the same IP address (segment). It allows allowedips_node to point to multiple peers and be added to the allowedips_list linked list of multiple peers. For example, the AllowedIPs of peers B, peers C, and peers D of device wg0 all contain the address segment 192.168.1.0 / 24.

[0102] S304, when the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, the target node is determined from the master node or slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

[0103] Furthermore, when the virtual private network receives information to be transmitted and the information address of the information to be transmitted matches the first allowed communication address, such as when the information address of the information to be transmitted is the same as the first allowed communication address, or when the first allowed communication address is an IP address range and the information address of the information to be transmitted falls into that IP address range, the master node and slave node associated with the first allowed communication address can be obtained from the communication address node tree. Then, the target node can be determined from the master node and slave node through load balancing, and the information to be transmitted can be transmitted through the target node.

[0104] In the aforementioned virtual private network (VPN) communication method, a communication address node tree corresponding to the VPN device is obtained, and a first allowed communication address to be added for the first communication node communicating with the VPN device is determined. Each node in the communication address node tree corresponds to a corresponding allowed communication address, which represents the address of the information allowed to be transmitted between the VPN device and the first communication node. Then, if the communication address node tree does not include a node corresponding to the first allowed communication address, a master node corresponding to the first allowed communication address and the second communication node is added to the communication address node tree. If the communication address node tree includes a master node corresponding to the first allowed communication address, a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address. Furthermore, when the information address of the information to be transmitted by the VPN device matches the first allowed communication address, a target node is determined from the master node or slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node. In this embodiment, by including the master node corresponding to the first allowed communication address in the communication address node tree, a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address. This allows multiple communication nodes of the same virtual private network device to be configured with the same allowed communication address. Traffic with the same IP address or IP segment can reach multiple communication nodes through multiple WireGuard tunnels of the same WG device, achieving the purpose of traffic load balancing with a single virtual private network device. At the same time, this method does not require additional ECMP routing or other configurations, greatly simplifying the configuration and management complexity of load balancing and improving the efficiency of virtual network device load balancing.

[0105] In one exemplary embodiment, the method may further include the following steps:

[0106] Construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value.

[0107] Specifically, in addition to expanding allowedips_node to include a main node and a slave node, this embodiment of the application also maintains a consistent hash tree (called a conhash tree) for selecting peers during load balancing. In practical applications, for the same allowed communication address, there can be a corresponding consistent hash tree, which includes hash tree nodes corresponding to the main node and slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value.

[0108] In some exemplary real-time scenarios, constructing a consistent hash tree corresponding to the first allowed communication address may include the following steps:

[0109] When adding at least one associated node to the first allowed communication address, generate multiple virtual nodes for each node; and construct a consistent hash tree based on each virtual node.

[0110] At least one node includes a master node and / or a slave node that are first allowed to communicate via an address.

[0111] Accordingly, in step S304, determining the target node from the master node and slave node associated with the first allowed communication address information may include the following steps:

[0112] Obtain the information hash value corresponding to the information to be transmitted; determine the target node from the master node and the slave node associated with the first allowed communication address information based on the information hash value and the node hash values ​​of multiple hash tree nodes in the consistent hash tree; the node hash value of the target node corresponding to the hash tree node in the consistent hash tree matches the information hash value.

[0113] Specifically, when a Peer (i.e., the first communication node) adds an AllowedIPs address range, it first checks the allowedips tree of the wg device to see if the allowedips address range already exists. If not, it assigns an allowedips_node of type main node and adds it to the allowedips tree. Simultaneously, the main node creates a consistent hash tree and adds the Peer to the conhash tree. To achieve a more balanced consistent hashing, multiple virtual nodes can be created for each Peer when adding it to the conhash tree. For example, the same Peer can have 128 nodes associated with it on the conhash tree. These nodes are also called virtual nodes (peer_vnodes). By generating multiple virtual nodes for each node, the virtual nodes of the same communication node can be more evenly distributed in the consistent hash tree, improving the effectiveness of load balancing.

[0114] If the AllowedIPs address range already exists in the allowedips tree (meaning it has been matched with a main node), then an allowedips_node of type slave node will be assigned to it. The slave node is not directly added to the allowedips tree, but rather added to the main node's slave list. Like the main node, the slave node points to the peer, and the allowedips_list added to the peer also points to the main node. In short, when an AllowedIPs address range is first added to a peer, it is added to the allowedips tree as a main node. Subsequent additions of the same AllowedIPs address range by other peers will be added to the main node's slave_list as slave nodes.

[0115] Then, when the information to be transmitted is obtained, the information hash value corresponding to the information to be transmitted can be obtained, and then the information hash value is matched with the node hash values ​​of multiple hash tree nodes in the consistent hash tree. The hash tree node corresponding to the successfully matched node hash value is taken as the target node. Thus, for the same virtual private network device, the traffic within the AllowedIPs range can be load balanced and transmitted to multiple peer devices through multiple tunnels.

[0116] In one exemplary embodiment, obtaining the information hash value corresponding to the information to be transmitted may include the following steps:

[0117] If the information to be transmitted is information leaving the VPN, then the source IP address and source port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined based on the source IP address and source port; if the information to be transmitted is information entering the VPN, then the destination IP address and destination port of the information to be transmitted are obtained, and the information hash value corresponding to the information to be transmitted is determined based on the destination IP address and destination port.

[0118] Information leaving the VPN can be understood as information in the egress direction, while information entering the VPN can be understood as information in the ingress direction.

[0119] In one embodiment, reference Figure 5aThe original packet (i.e., the information to be transmitted) can first be routed to the designated wg device based on the destination IP address. Then, using the destination IP address of the original packet as the key, the allowedips_node is searched in the allowedips tree of the wg device. If no match is found, it means that the packet is not allowed to pass, an ICMP destination unreachable message is sent to the source IP, the packet is dropped, and processing ends. If a match is found, the source IP address and source port (for TCP / UDP packets, the source port is 0 for other packets) of the packet are used as the key to calculate the information hash value. Then, consistent hashing is performed based on the node hash values ​​of multiple hash tree nodes in the consistent hash tree, and a peer is selected from the conhash tree of the allowedips_node to continue processing the packet. When the traffic is large, the source IP addresses and source ports of the packets will be relatively dispersed, and the peers selected by consistent hashing will be different and relatively balanced, thus achieving the purpose of load balancing traffic across different peers. Afterwards, the original message can be encrypted, a WireGuard header can be added, and the encrypted message can be encapsulated with UDP and IP headers according to the EndPoint information of the selected peer. That is, the encapsulated message is a UDP message. Then the encapsulated UDP message is sent out from the UDP socket configured on the wg device, and finally it will be sent to the specified peer device.

[0120] On the other hand, reference Figure 5b When the UDP socket of the wg device receives a packet, it locates the peer based on the key information carried in the WireGuard header of the packet and first decrypts and decapsulates the packet. Then, using the source IP address of the decapsulated and decrypted original packet as the key, it searches for the allowedips_node in the allowedips tree of the wg device. If no match is found, it means that the packet is not allowed to pass, the packet is dropped, and processing ends; if a match is found, a hash value is calculated using the destination IP address and destination port of the original packet (for TCP / UDP packets, the source port of other packets is 0) as the key, and consistent hashing is performed to select a peer from the conhash tree of allowedips_node. Here, the key used for consistent hashing is the destination IP address and destination port of the original packet. The egress above uses the source IP address and source port of the original packet, which are actually the same IP and port. Consistent hashing ensures that packets in both the egress and ingress directions of the same session will hit the same peer. In one embodiment, it is also possible to compare whether the Peer selected in the two instances is the same. If it is the same, the message is allowed to pass; otherwise, the message is not allowed to pass, the packet is dropped, and the processing ends.

[0121] By using the information hash value acquisition method in this embodiment, it is effectively ensured that the packets of the same session or connection are processed by the same peer of the wg device in both the ingress and egress directions, which can effectively improve the security of session information transmission during load balancing.

[0122] In one exemplary embodiment, the method may further include the following steps:

[0123] Determine the second allowed communication address to be deleted from the second communication node that communicates with the virtual private network device; if a master node corresponding to the second allowed communication address is found in the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after deleting each slave node in the slave node list of the second allowed communication address, delete the master node corresponding to the second allowed communication address from the communication address node tree.

[0124] In practical applications, existing allowed communication addresses in the communication address node tree can be deleted. For ease of distinction, the communication node requesting the deletion of an allowed communication address is called the second communication node, and the allowed communication address that the second communication node intends to delete is called the second allowed communication address.

[0125] Specifically, when a second communication node intends to delete the second allowed communication address (AllowedIPs address range), it searches for the AllowedIPs address range in the allowedips tree of the wg device. If it is not found in the communication address node tree, the process ends directly. If it is found, it can further check whether the communication node pointed to by the found allowedips_node (i.e., the master node) is consistent with the current second communication node. If they are consistent, it checks the slave node linked list of the second allowed communication address, i.e., the slave_list linked list associated with allowedips_node, to determine whether there are any slave nodes. If there are, it can be determined that multiple peers have configured the AllowedIPs address range. The master node cannot be deleted directly, but is marked. It is then deleted from the allowedips tree after all slave nodes have been deleted. In this way, normal communication between other communication nodes with the same allowed communication address and the virtual private network device is effectively guaranteed.

[0126] In one embodiment, after determining the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device, the following steps may also be included:

[0127] If no master node corresponding to the second allowed communication address is found in the communication address node tree, then obtain the slave node list of the second allowed communication address; in the slave node list of the second allowed communication address, delete the slave node corresponding to the second communication address.

[0128] Specifically, when a second communication node intends to delete a second allowed communication address (AllowedIPs address range), it searches for the AllowedIPs address range in the allowedips tree of the wg device. If no match is found in the communication address node tree, the process ends directly. If a match is found, it further checks whether the communication node pointed to by the matched allowedips_node (i.e., the master node) is consistent with the current second communication node. If they are inconsistent, it traverses the slave node list of the master node and matches each slave node in the slave node list with the current peer (second communication node). If they match, the matched slave node is deleted; otherwise, it means that the peer has not configured the AllowedIPs address range to be deleted, and the process ends. Through this embodiment, the correct slave node can be deleted from the slave node list, avoiding interference with the normal communication between other communication nodes with the same allowed communication address and the virtual private network device.

[0129] To enable those skilled in the art to better understand the above steps, the following example illustrates the embodiments of this application, but it should be understood that the embodiments of this application are not limited thereto.

[0130] The following is an exemplary embodiment of this application, which is applied in a zero-trust scenario. Figure 6 As an example diagram, employees of a company's branch offices use a zero-trust product to access the company's database, web services, and various app services. This zero-trust product is based on the WireGuard protocol to implement a VPN.

[0131] 1) The company uses IP addresses in the 192.168.1.0 / 24 network segment, including the addresses of employees' terminal devices and the addresses of various company services.

[0132] 2) Employees’ terminal devices access the enterprise’s VPN network through the zero-trust POP node POP1. The POP node, also known as the POP point or point-of-presence, is mainly located outside the edge of the network enterprise and is the entry point for accessing the internal network of the enterprise.

[0133] 3) Various enterprise services access the enterprise's VPN network through the enterprise connector's reverse access to the zero-trust POP node POP2.

[0134] 4) VPN tunnels between POP1, POP2, and enterprise connectors Peer A, Peer B, and Peer C are implemented using the WireGuard protocol, and AllowedIPs are configured as 192.168.1.0 / 24 to allow enterprise intranet IP addresses to pass through. WireGuard tunnels are established segmented between the client and POP1, between POP1 and POP2, and between POP2 and the enterprise connectors.

[0135] 5) The enterprise connector has deployed three machines, namely PeerA, PeerB, and PeerC. It is hoped that the traffic coming from POP2 can be load balanced across these three devices to avoid single points of failure caused by enterprise connector downtime or insufficient performance, which would make all enterprise services inaccessible.

[0136] 6) Perform on the wg0 device of POP2 Figure 7 The configuration shown indicates that POP2 can send packets from the 192.168.1.0 / 24 network segment to Peer A, Peer B, and Peer C.

[0137] 7) Assume that employee A's source IP address is 192.168.1.123, and it sends an HTTP request to the web server with a destination IP address of 192.168.1.1, a TCP destination port of 80, and a TCP source port of 4567. When a message is sent from POP2 to the enterprise connector, it first matches AllowedIPs with the destination IP address 192.168.1.1, hitting the AllowedIPs segment 192.168.1.0 / 24. Then, it calculates a hash value using the source IP address 192.168.1.123 and the source port 4567 as the key. Based on the consistent hashing algorithm, it selects one Peer from the three Peers associated with AllowedIPs: 192.168.1.0 / 24: PeerA, PeerB, and PeerC. Assuming PeerB is selected, the message is encrypted and encapsulated based on the wg0 key, the public key configured for PeerB, and the EndPoint. The encapsulated message will have a UDP header and an IP header added. The outer IP destination address is 2.2.2.2 specified by the PeerB EndPoint, and the outer UDP header destination port is 6666 specified by the PeerB EndPoint. The message is then sent to PeerB for processing. After receiving the message, Peer B will decrypt and decapsulate it, and finally forward it to the Web server for processing. After the Web server processes it, it sends a response message. The four-tuple of the response message is exactly the opposite of the four-tuple of employee A's request message. The response message is processed by Peer B and then sent to POP2.

[0138] 8) When POP2 receives the response message, it first looks up the Peer based on the key information in the WireGuard header of the message, which is Peer B in this case. Then, it decrypts and decapsulates the message. Next, it matches AllowedIPs with the source IP address of the inner message after decryption and decapsulation: 192.168.1.1. It hits the AllowedIPs segment 192.168.1.0 / 24. Then, it uses the destination IP address 192.168.1.123 and the destination port 4567 of the inner message as the key to calculate the hash value. According to the consistent hashing algorithm, it selects one Peer from the three Peers associated with AllowedIPs: 192.168.1.0 / 24: Peer A, Peer B, and Peer C. Here, Peer B will be selected. Since the Peer selected twice is the same, it means that the message can be allowed to pass. The message is delivered to the wg0 device for further processing, forwarded to POP1, and finally reaches employee A's device.

[0139] 9) POP2 will select different peers based on the IP address and port of different employees, thus balancing the traffic load across different peers.

[0140] 10) Zero-trust networks can also add POP points as needed and perform load balancing among POP points.

[0141] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0142] Based on the same inventive concept, this application also provides a virtual private network (VPN) communication device for implementing the VPN communication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more VPN communication device embodiments provided below can be found in the limitations of the VPN communication method described above, and will not be repeated here.

[0143] In one exemplary embodiment, such as Figure 8As shown, a virtual private network communication device is provided, comprising:

[0144] The information acquisition module 801 is used to acquire the communication address node tree corresponding to the virtual private network device, and to determine the first allowed communication address to be added to the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node;

[0145] The first node adding module 802 is used to add a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree if the communication address node tree does not include the node corresponding to the first allowed communication address.

[0146] The second node adding module 803 is used to add a slave node corresponding to the first communication node in the slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address.

[0147] The information transmission module 804 is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, and to transmit the information to be transmitted through the target node.

[0148] In one embodiment, the apparatus further includes:

[0149] A hash tree construction module is used to construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value;

[0150] The information transmission module 804 is used for:

[0151] Obtain the information hash value corresponding to the information to be transmitted;

[0152] Based on the information hash value and the node hash values ​​of multiple hash tree nodes in the consistent hash tree, a target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the target node corresponding to the hash tree node in the consistent hash tree matches the information hash value.

[0153] In one embodiment, the information transmission module 804 is used for:

[0154] If the information to be transmitted is information leaving the virtual private network, then obtain the source IP address and source port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the source IP address and the source port;

[0155] If the information to be transmitted is information for entering a virtual private network, then obtain the destination IP address and destination port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the destination IP address and the destination port.

[0156] In one embodiment, the hash tree building module is used for:

[0157] When the first allowed communication address adds at least one associated node, multiple virtual nodes are generated for each node; the at least one node includes the master node and / or slave node associated with the first allowed communication address;

[0158] A consistent hash tree is constructed based on each of the virtual nodes.

[0159] In one embodiment, the apparatus further includes a node deletion module, the node deletion module being used to:

[0160] Determine the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device;

[0161] If a master node corresponding to the second allowed communication address is found in the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after deleting each slave node in the slave node linked list of the second allowed communication address, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

[0162] In one embodiment, the node deletion module is further configured to:

[0163] If no master node corresponding to the second allowed communication address is found in the communication address node tree, then the slave node list of the second allowed communication address is obtained;

[0164] In the slave node list of the second allowed communication address, delete the slave node corresponding to the second communication node.

[0165] Each module in the aforementioned virtual private network communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0166] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores a communication address node tree. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a virtual private network (VPN) communication method.

[0167] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a virtual private network (VPN) communication method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0168] Those skilled in the art will understand that Figure 9 and Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0169] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0170] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0171] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0172] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0173] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0174] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0175] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A virtual private network communication method, characterized in that, The method includes: Obtain the communication address node tree corresponding to the virtual private network device, and determine the first allowed communication address to be added for the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node; If the communication address node tree does not include the node corresponding to the first allowed communication address, then a master node corresponding to the first allowed communication address and the first communication node is added to the communication address node tree; If the communication address node tree includes a master node corresponding to the first allowed communication address, then a slave node corresponding to the first communication node is added to the slave node list corresponding to the first allowed communication address. When the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, a target node is determined from the master node or the slave node associated with the first allowed communication address, and the information to be transmitted is transmitted through the target node.

2. The method according to claim 1, characterized in that, The method further includes: Construct a consistent hash tree corresponding to the first allowed communication address; the consistent hash tree includes hash tree nodes corresponding to the master node and the slave node associated with the first allowed communication address, and each hash tree node has a corresponding node hash value; Determining the target node from the master node and the slave node associated with the first allowed communication address information includes: Obtain the information hash value corresponding to the information to be transmitted; Based on the information hash value and the node hash values ​​of multiple hash tree nodes in the consistent hash tree, a target node is determined from the master node and the slave node associated with the first allowed communication address information; the node hash value of the target node corresponding to the hash tree node in the consistent hash tree matches the information hash value.

3. The method according to claim 2, characterized in that, Obtaining the information hash value corresponding to the information to be transmitted includes: If the information to be transmitted is information leaving the virtual private network, then obtain the source IP address and source port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the source IP address and the source port; If the information to be transmitted is information for entering a virtual private network, then obtain the destination IP address and destination port of the information to be transmitted, and determine the information hash value corresponding to the information to be transmitted based on the destination IP address and the destination port.

4. The method according to claim 2, characterized in that, The construction of the consistent hash tree corresponding to the first allowed communication address includes: When the first allowed communication address adds at least one associated node, multiple virtual nodes are generated for each node; the at least one node includes the master node and / or slave node associated with the first allowed communication address; A consistent hash tree is constructed based on each of the virtual nodes.

5. The method according to claim 1, characterized in that, The method further includes: Determine the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device; If a master node corresponding to the second allowed communication address is found in the communication address node tree, and the master node corresponding to the second communication node is associated with the second communication node, then after deleting each slave node in the slave node linked list of the second allowed communication address, the master node corresponding to the second allowed communication address is deleted from the communication address node tree.

6. The method according to claim 5, characterized in that, After determining the second allowed communication address to be deleted for the second communication node communicating with the virtual private network device, the method further includes: If no master node corresponding to the second allowed communication address is found in the communication address node tree, then the slave node list of the second allowed communication address is obtained; In the slave node list of the second allowed communication address, delete the slave node corresponding to the second communication node.

7. A virtual private network communication device, characterized in that, The device includes: The information acquisition module is used to acquire the communication address node tree corresponding to the virtual private network device, and to determine the first allowed communication address to be added to the first communication node communicating with the virtual private network device; each node in the communication address node tree corresponds to a corresponding allowed communication address, and the allowed communication address represents the address of the information that is allowed to be transmitted between the virtual private network device and the first communication node; The first node adding module is used to add a master node corresponding to the first allowed communication address and the first communication node to the communication address node tree if the communication address node tree does not include the node corresponding to the first allowed communication address. The second node adding module is used to add a slave node corresponding to the first communication node to the slave node linked list corresponding to the first allowed communication address if the communication address node tree includes a master node corresponding to the first allowed communication address. The information transmission module is used to determine a target node from the master node or the slave node associated with the first allowed communication address when the information address of the information to be transmitted in the virtual private network device matches the first allowed communication address, and to transmit the information to be transmitted through the target node.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images