Virtual private network communication method, apparatus and device, and readable storage medium

Abstract

The invention relates to a virtual private network communication method, device and equipment and a readable storage medium, and the method comprises the steps: forwarding a to-be-transmitted data stream to a virtual private network gateway through a private network, and transmitting the data stream to a virtual private network channel through the virtual private network gateway, and transmitting the data stream to a client through at least two tunnels in the virtual private network channel. Compared with the prior art, the embodiment of the invention has the advantages that the private network and the virtual private network are separated, the routing independence of the private network is guaranteed, the to-be-transmitted data stream is further forwarded to the virtual private network gateway through the private network, and the data stream is sent to the virtual private network channel through the virtual private network gateway. And transmitting the data stream to the client through at least two tunnels in the virtual private network channel, using a plurality of VPN tunnels, providing active-standby and active-active modes, providing more VPN networking choices, and ensuring high availability of services.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a virtual private network communication method, device, equipment and readable storage medium. Background Art

[0002] A Virtual Private Network (VPN) is a remote access technology that establishes a private network on a public network for encrypted communication. Currently, VPN communication uses the IPSEC protocol suite to encrypt the end-to-end data flow on the cloud through the data flow protected by the ACL flow of interest.

[0003] Normally, the two ends of VPN communication confirm data protection and authentication policies (mainly including security protocols, authentication algorithms, encryption algorithms, shared keys, and key lifetimes, etc.) and establish an IPsec tunnel in the following ways: 1) Define the data stream that needs IPsec protection and implement it through ACL rules; 2) The IPsec sender uses the encryption algorithm and key to encrypt the message that needs to be protected. The encrypted message generates a signature through the authentication algorithm and authentication key, which is encapsulated in the message and sent; 3) The responder regenerates a new signature for the received encrypted message through the same authentication algorithm and authentication key, and then compares it with the signature in the message. If the signatures are different, the message is considered illegal and discarded; if the signatures are the same, the message is considered legal, and the legal message is decrypted through the decryption algorithm and key, and the responder finally obtains the original message.

[0004] In the existing solutions, the IKEv1 mode of ACL interest flow in IPSEC is usually used for message encryption. The policy has great limitations and the requirements for the negotiation environment at both ends are also very limited. It only focuses on the encryption and decryption of data in and out of the public network and data encapsulation issues. The networking flexibility is poor and the high availability of the business cannot be guaranteed. Summary of the invention

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a virtual private network communication method, device, equipment and readable storage medium to reduce the limitations of the negotiation environment, provide a flexible networking communication method, and ensure high availability of services.

[0006] In a first aspect, an embodiment of the present disclosure provides a virtual private network communication method, the method comprising:

[0007] forwarding the data stream to be transmitted to the virtual private network gateway through the private network;

[0008] sending the data stream to a virtual private network channel through the virtual private network gateway;

[0009] The data stream is transmitted to the client through at least two tunnels in the virtual private network channel.

[0010] In some embodiments, the virtual private network gateway carries outbound routing and inbound routing, the outbound routing points to the virtual private network channel, and the inbound routing points to the private network.

[0011] In some embodiments, forwarding the data stream to be transmitted to the virtual private network gateway through the private network includes:

[0012] Establishing a communication connection between the private network and the virtual private network gateway;

[0013] The data stream to be transmitted is forwarded to the virtual private network gateway through the private network based on the inbound route of the virtual private network gateway.

[0014] In some embodiments, sending the data stream to the virtual private network channel through the virtual private network gateway includes:

[0015] Establishing a communication connection between the virtual private network gateway and the virtual private network channel;

[0016] The data flow is sent to the virtual private network channel through the outbound routing of the virtual private network gateway.

[0017] In some embodiments, the virtual private network channel is composed of a route reflector and a service switch;

[0018] The service switch is used to establish at least two tunnel connections with the virtual private network switch of the client; and the route reflector is used to monitor whether each of the at least two tunnels has communication abnormalities.

[0019] In some embodiments, transmitting the data stream to the client through at least two tunnels in the virtual private network channel includes:

[0020] Sending the tunnel configuration information of the service switch and the identifier of the virtual private network switch of the client to the service switch through the route reflector;

[0021] Determining the virtual private network switch of the client to be connected according to the identifier of the virtual private network switch of the client by the service switch, and establishing at least two tunnel connections with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch;

[0022] The data stream is transmitted to the virtual private network switch of the client through at least two tunnels of the service switch, so that the virtual private network switch of the client transmits the data stream to the client.

[0023] In some embodiments, after transmitting the data stream to the virtual private network switch of the client through the at least two tunnels of the service switch, the method further includes:

[0024] Monitoring each of the at least two tunnels of the service switch in real time through the route reflector;

[0025] For each tunnel, if the communication of the tunnel is detected to be abnormal, the connection of the tunnel will be cut off.

[0026] In a second aspect, an embodiment of the present disclosure provides a virtual private network communication device, the device comprising:

[0027] A forwarding module, used for forwarding the data stream to be transmitted to the virtual private network gateway through the private network;

[0028] A sending module, used for sending the data stream to a virtual private network channel through the virtual private network gateway;

[0029] The transmission module is used to transmit the data stream to the client through at least two tunnels in the virtual private network channel.

[0030] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0031] Memory;

[0032] Processor; and

[0033] Computer programs;

[0034] The computer program is stored in the memory and is configured to be executed by the processor to implement the method as described in the first aspect.

[0035] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method as described in the first aspect.

[0036] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the method described in the first aspect is implemented.

[0037] The virtual private network communication method, device, equipment and readable storage medium provided in the embodiments of the present disclosure forward the data stream to be transmitted to the virtual private network gateway through the private network, send the data stream to the virtual private network channel through the virtual private network gateway, and transmit the data stream to the client through at least two tunnels in the virtual private network channel. Compared with the prior art, the embodiments of the present disclosure separate the private network and the virtual private network to ensure the independence of the private network routing, further forward the data stream to be transmitted to the virtual private network gateway through the private network, send the data stream to the virtual private network channel through the virtual private network gateway, and transmit the data stream to the client through at least two tunnels in the virtual private network channel, use multiple VPN tunnels, provide active-standby and active-active modes, provide more VPN networking options, and ensure high availability of services. In addition, the present disclosure can support two negotiation modes, IKEv1 / IKEv2, under the IPSEC protocol cluster, reducing the limitations of the negotiation environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 A flow chart of a virtual private network communication method provided by an embodiment of the present disclosure;

[0041] Figure 2 A schematic diagram of an application scenario provided by an embodiment of the present disclosure;

[0042] Figure 3 A flow chart of a virtual private network communication method provided by another embodiment of the present disclosure;

[0043] Figure 4 A schematic diagram of an application scenario provided for another embodiment of the present disclosure;

[0044] Figure 5 A schematic diagram of the structure of a virtual private network communication device provided in an embodiment of the present disclosure;

[0045] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0047] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0048] A virtual private network (VPN) is a remote access technology that establishes a private network on a public network for encrypted communication. Currently, VPN communication uses the IPSEC protocol suite to encrypt the end-to-end data flow on the cloud through the data flow protected by the ACL flow of interest.

[0049] Normally, the two ends of VPN communication confirm data protection and authentication policies (mainly including security protocols, authentication algorithms, encryption algorithms, shared keys, and key lifetimes, etc.) and establish an IPsec tunnel in the following ways: 1) Define the data stream that needs IPsec protection and implement it through ACL rules; 2) The IPsec sender uses the encryption algorithm and key to encrypt the message that needs to be protected. The encrypted message generates a signature through the authentication algorithm and authentication key, which is encapsulated in the message and sent; 3) The responder regenerates a new signature for the received encrypted message through the same authentication algorithm and authentication key, and then compares it with the signature in the message. If the signatures are different, the message is considered illegal and discarded; if the signatures are the same, the message is considered legal, and the legal message is decrypted through the decryption algorithm and key, and the responder finally obtains the original message.

[0050] In the existing solutions, the IKEv1 mode of the ACL interest flow in IPSEC is usually used for message encryption, which has great policy limitations and great requirements on the negotiation environment at both ends. It only focuses on the encryption and decryption of data entering and leaving the public network and data encapsulation issues, has poor networking flexibility, and cannot guarantee high service availability. To address this problem, the embodiments of the present disclosure provide a virtual private network communication method, which is introduced below in conjunction with specific embodiments.

[0051] Figure 1 A flow chart of a virtual private network communication method provided by an embodiment of the present disclosure. The method can be applied to Figure 2The application scenario shown includes a private network (Virtual Private Cloud, VPC), a virtual private network gateway (VPN gateway), a virtual private network channel (VPN channel) and a client, which can be applied to a scenario of communication based on a virtual private network, and can also be applied to a scenario of transmitting cloud network resources to a client. It can be understood that the virtual private network communication method provided in the embodiment of the present disclosure can also be applied in other scenarios.

[0052] Combine the following Figure 2 Application scenarios Figure 1 The virtual private network communication method shown in the figure is introduced, and the specific steps of the method are as follows:

[0053] S101. Forwarding a data stream to be transmitted to a virtual private network gateway through a private network.

[0054] In this step, the data stream to be transmitted is obtained, such as Figure 2 As shown, the data flow to be transmitted is forwarded to the VPN gateway through the VPC. Optionally, the VPC can be associated with a PEER VPC, and the data flow to be transmitted can also be forwarded to the VPN gateway through the PEER VPC.

[0055] The VPC next hop points to the VPN gateway. The product layer separates VPC and VPN to ensure the independence of VPC routing.

[0056] In some embodiments, the virtual private network gateway carries outbound routing and inbound routing, the outbound routing points to the virtual private network channel, and the inbound routing points to the private network.

[0057] The VPN gateway manages VPN outbound and inbound routes. Outbound routes point to independent VPN channels, and inbound routes point to VPCs in the cloud environment. VPCs can be mounted for the VPN, or VPCs can be associated with PEER VPCs.

[0058] S102: Send the data stream to the virtual private network channel through the virtual private network gateway.

[0059] like Figure 2 As shown, the data flow is sent to an independent VPN channel through a VPN gateway.

[0060] S103: Transmit the data stream to the client through at least two tunnels in the virtual private network channel.

[0061] Under each independent VPN channel, two or more logical VPN tunnels are managed to make a high-availability configuration. In this embodiment, the data stream is transmitted to the client through at least two tunnels in the VPN channel. The present disclosure can support two negotiation modes, IKEv1 / IKEv2, under the IPSEC protocol cluster, reducing the limitations of the negotiation environment. Using multiple VPN tunnels, active-standby and active-active modes are provided, providing more VPN networking options and ensuring high service availability.

[0062] In some embodiments, an IPSEC-ACL flow of interest encapsulation mode is provided, and one IPsec tunnel protects one data flow. The data flow corresponding to each rule in the ACL is protected by a separately created IPsec tunnel. The IPSEC-ACL flow of interest is a data flow (interface) that needs to be protected specified in IPSEC. If the message sent by the interface matches the permit rule of the ACL in the IPsec security policy applied on the interface, it will be protected by the outbound IPsec SA and encapsulated.

[0063] In some embodiments, an IPSEC-routing policy encapsulation mode is provided, and the encapsulation / decapsulation of the message by the tunnel interface occurs on the tunnel interface. After the message entering the device is routed to the tunnel interface to which the IPsec security framework is applied, the tunnel interface will encapsulate / decapsulate these messages. The IPSEC-routing policy is that the encapsulation mode of IPsec must be the tunnel mode. After the IPsec security framework is applied on the tunnel interface, the message routed to the tunnel interface will be protected by IPsec.

[0064] The disclosed embodiment forwards the data stream to be transmitted to the virtual private network gateway through the private network, sends the data stream to the virtual private network channel through the virtual private network gateway, and transmits the data stream to the client through at least two tunnels in the virtual private network channel. Compared with the prior art, the disclosed embodiment separates the private network and the virtual private network to ensure the independence of the private network routing, further forwards the data stream to be transmitted to the virtual private network gateway through the private network, sends the data stream to the virtual private network channel through the virtual private network gateway, and transmits the data stream to the client through at least two tunnels in the virtual private network channel, uses multiple VPN tunnels, provides active-standby and active-active modes, provides more VPN networking options, and ensures high availability of services. In addition, the disclosed embodiment can support two negotiation modes, IKEv1 / IKEv2, under the IPSEC protocol cluster, reducing the limitations of the negotiation environment.

[0065] Figure 3 A flowchart of a virtual private network communication method provided by another embodiment of the present disclosure is shown below in conjunction with Figure 4 Application scenarios Figure 3 The virtual private network communication method shown in the figure is introduced, and the method includes the following steps:

[0066] S301, establishing a communication connection between a private network and a virtual private network gateway.

[0067] like Figure 4 As shown, the VPC has established a communication connection with the hybrid cloud GW (virtual private network gateway).

[0068] S302: forwarding the data stream to be transmitted to the virtual private network gateway through the private network based on the inbound route of the virtual private network gateway.

[0069] The VPN gateway can be Figure 4 In the hybrid cloud GW shown, the VPN gateway serves as a logical gateway, which carries outbound routing and inbound routing, and the data flow (traffic) is forwarded to the VPN gateway through the VPC routing.

[0070] S303: Establish a communication connection between the virtual private network gateway and the virtual private network channel.

[0071] In some embodiments, the virtual private network channel is composed of a route reflector and a service switch; wherein the service switch is used to establish at least two tunnel connections with the client's virtual private network switch; and the route reflector is used to monitor whether each of the at least two tunnels has communication abnormalities.

[0072] like Figure 4 As shown in the figure, the virtual private network channel includes a route reflector (VPN-RR) and a service switch (VPN-Switch). VPN-RR serves as a route reflector, and the VPN-RR cluster and the VPN-Switch cluster build an EVPN-BGP environment.

[0073] S304: Send the data stream to the virtual private network channel through the outbound routing of the virtual private network gateway.

[0074] like Figure 4 As shown, the data flow is sent to the virtual private network channel through the outbound routing of the virtual private network gateway.

[0075] S305: Send the tunnel configuration information of the service switch and the identifier of the virtual private network switch of the client to the service switch through the route reflector.

[0076] The route reflector sends the tunnel configuration information (i.e., IPSEC configuration) and the identifier of the client's virtual private network switch to the VPN-Switch. The tunnel configuration information is used to characterize the tunnel configuration of the service switch.

[0077] S306: Determine the virtual private network switch of the client to be connected according to the identifier of the virtual private network switch of the client through the service switch, and establish at least two tunnel connections with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch.

[0078] The VPN-Switch determines the virtual private network switch of the client to be connected according to the identifier of the virtual private network switch of the client, and further establishes at least two tunnel connections with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch.

[0079] S307: Transmit the data stream to the virtual private network switch of the client through at least two tunnels of the service switch, so that the virtual private network switch of the client transmits the data stream to the client.

[0080] like Figure 4 As shown, the VPN-Switch transmits the data stream to the virtual private network switch of the client through at least two tunnels, and the virtual private network switch of the client transmits the data stream to the client.

[0081] S308: Monitor each of the at least two tunnels of the service switch in real time through the route reflector.

[0082] VPN-RR monitors each tunnel in VPN-Switch in real time and identifies the service availability of each tunnel. Using VPN-RR devices as traffic bearers and route reflection devices ensures VPN route monitoring and convergence.

[0083] S309: For each tunnel, if the communication of the tunnel is monitored to be abnormal, the connection of the tunnel is cut off.

[0084] When the communication of the tunnel is detected to be abnormal, the connection of the tunnel is cut off, and the outbound route on the VPN-Switch is automatically invalidated, so that the data flow is transmitted through other tunnels to ensure high availability of the service. The VPN route convergence can be achieved without additional detection and convergence logic intervention.

[0085] In some embodiments, multiple versions of IPSEC one-phase encryption algorithms ('3des', 'aes', 'des', '3des-cbc', 'aes-cbc-128', 'aes-cbc-192', 'aes-cbc-256', 'des-cbc', 'sm1-cbc-128', 'sm4-cbc') and one-phase authentication algorithms ('md5', 'sha', 'sha256', 'sha384', 'sha512', 'sm3') are provided.

[0086] In some embodiments, multiple versions of IPSEC two-stage encryption algorithms ('esp-3des', 'esp-aes', 'esp-des', 'esp-null', 'esp-seal', '3des-cbc', 'aes-cbc-128', 'aes-cbc-192', 'aes-cbc-256', 'aes-ctr-128', 'aes-ctr-192', 'aes-ctr-256', 'camellia-cbc-128', 'camellia-cbc-192', 'camel lia-cbc-256','des-cbc','gmac-128','gmac-192','gmac-256','gcm-128','gcm-192','gcm-256','null','sm1-cbc-128','sm4-cbc') and two-stage authentication algorithms ('esp-sha-hmac','esp-md5-hmac','aes-xcbc-mac','md5','sha1','sha256','sha384','sha512','sm3').

[0087] The disclosed embodiment provides two IPSEC negotiation modes, IKEv1 / IKEv2, and supports multiple IPSEC negotiation algorithms and authentication algorithms, and can provide more powerful IPSEC encryption protection.

[0088] The disclosed embodiment establishes a communication connection between a private network and a virtual private network gateway, forwards the data stream to be transmitted to the virtual private network gateway through the private network based on the inbound route of the virtual private network gateway, establishes a communication connection between the virtual private network gateway and a virtual private network channel, and sends the data stream to the virtual private network channel through the outbound route of the virtual private network gateway. Further, the tunnel configuration information of the service switch and the identifier of the virtual private network switch of the client are sent to the service switch through the route reflector, the virtual private network switch of the client to be connected is determined by the service switch according to the identifier of the virtual private network switch of the client, at least two tunnel connections are established with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch, and the data stream is transmitted to the virtual private network switch of the client through the at least two tunnels of the service switch, so that the virtual private network switch of the client transmits the data stream to the client. Then, each of the at least two tunnels of the service switch is monitored in real time through the route reflector, and for each tunnel, if the communication abnormality of the tunnel is monitored, the connection of the tunnel is cut off. Since VPN gateway is used to forward VPN traffic on the VPC side, traffic classification and traction are performed, VPC and VPN are logically isolated, dual VPN tunnels are used, active-standby and active-active modes are provided, more VPN networking options are provided, and high service availability is guaranteed. Routing reflectors are used as traffic carriers and routing reflection devices to ensure VPN routing monitoring and convergence, further ensuring high service availability. Each of the at least two tunnels of the service switch is monitored in real time through the routing reflector. If the communication of the tunnel is abnormal, the connection of the tunnel is cut off, the interruption of VPN can be sensed, and the data transmission of the abnormal tunnel can be interrupted in time to avoid affecting the business.

[0089] Figure 5 The schematic diagram of the structure of the virtual private network communication device provided in the embodiment of the present disclosure. The virtual private network communication device may be the electronic device as described in the above embodiment, or the virtual private network communication device may be a component or assembly in the electronic device. The virtual private network communication device provided in the embodiment of the present disclosure may execute the processing flow provided in the embodiment of the virtual private network communication method, such as Figure 5 As shown, the virtual private network communication device 50 includes: a forwarding module 51, a sending module 52, and a transmission module 53; wherein the forwarding module 51 is used to forward the data stream to be transmitted to the virtual private network gateway through the private network; the sending module 52 is used to send the data stream to the virtual private network channel through the virtual private network gateway; the transmission module 53 is used to transmit the data stream to the client through at least two tunnels in the virtual private network channel.

[0090] Optionally, the virtual private network gateway carries an outbound route and an inbound route, the outbound route points to the virtual private network channel, and the inbound route points to the private network.

[0091] Optionally, when the forwarding module 51 forwards the data stream to be transmitted to the virtual private network gateway through the private network, it is specifically used to: establish a communication connection between the private network and the virtual private network gateway; and forward the data stream to be transmitted to the virtual private network gateway through the private network based on the inbound routing of the virtual private network gateway.

[0092] Optionally, when the sending module 52 sends the data stream to the virtual private network channel through the virtual private network gateway, it is specifically used to: establish a communication connection between the virtual private network gateway and the virtual private network channel; and send the data stream to the virtual private network channel through the outbound routing of the virtual private network gateway.

[0093] Optionally, the virtual private network channel is composed of a route reflector and a service switch; wherein the service switch is used to establish at least two tunnel connections with the virtual private network switch of the client; and the route reflector is used to monitor whether each of the at least two tunnels has communication abnormalities.

[0094] Optionally, when the transmission module 53 transmits the data stream to the client through at least two tunnels in the virtual private network channel, it is specifically used to: send the tunnel configuration information of the service switch and the identifier of the client's virtual private network switch to the service switch through the route reflector; determine the virtual private network switch of the client to be connected according to the identifier of the client's virtual private network switch through the service switch, and establish at least two tunnel connections with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch; transmit the data stream to the client's virtual private network switch through at least two tunnels of the service switch, so that the client's virtual private network switch transmits the data stream to the client.

[0095] Optionally, after transmitting the data stream to the client's virtual private network switch through at least two tunnels of the service switch, the device also includes: a monitoring module 54 and an interruption module 55; the monitoring module 54 is used to monitor each of the at least two tunnels of the service switch in real time through the route reflector; the interruption module 55 is used to cut off the connection of each tunnel if a communication abnormality is detected in the tunnel.

[0096] Figure 5The virtual private network communication device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0097] Figure 6 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 6 , which shows a structural schematic diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0098] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603 to implement the virtual private network communication method of the embodiment described in the present disclosure. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0099] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0100] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the virtual private network communication method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0101] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0102] In addition, an embodiment of the present disclosure also provides a vehicle, comprising: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the virtual private network communication method as described above.

[0103] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0104] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0105] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0106] forwarding the data stream to be transmitted to the virtual private network gateway through the private network;

[0107] sending the data stream to a virtual private network channel through the virtual private network gateway;

[0108] The data stream is transmitted to the client through at least two tunnels in the virtual private network channel.

[0109] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0110] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0111] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, constitute a limitation on the unit itself.

[0113] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0114] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0116] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0117] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A virtual private network communication method, characterized in that: include: forwarding the data stream to be transmitted to the virtual private network gateway through the private network; sending the data stream to a virtual private network channel through the virtual private network gateway; The data stream is transmitted to the client through at least two tunnels in the virtual private network channel.

2. The method according to claim 1, characterized in that The virtual private network gateway carries outbound routing and inbound routing, wherein the outbound routing points to the virtual private network channel, and the inbound routing points to the private network.

3. The method according to claim 2, characterized in that The method of forwarding the data stream to be transmitted to the virtual private network gateway through the private network includes: Establishing a communication connection between the private network and the virtual private network gateway; The data stream to be transmitted is forwarded to the virtual private network gateway through the private network based on the inbound route of the virtual private network gateway.

4. The method according to claim 2, characterized in that: The sending the data stream to the virtual private network channel through the virtual private network gateway comprises: Establishing a communication connection between the virtual private network gateway and the virtual private network channel; The data flow is sent to the virtual private network channel through the outbound routing of the virtual private network gateway.

5. The method according to claim 1, characterized in that: The virtual private network channel is composed of a route reflector and a service switch; The service switch is used to establish at least two tunnel connections with the virtual private network switch of the client; and the route reflector is used to monitor whether each of the at least two tunnels has communication abnormalities.

6. The method according to claim 5, characterized in that The step of transmitting the data stream to the client through at least two tunnels in the virtual private network channel comprises: Sending the tunnel configuration information of the service switch and the identifier of the virtual private network switch of the client to the service switch through the route reflector; Determining the virtual private network switch of the client to be connected according to the identifier of the virtual private network switch of the client by the service switch, and establishing at least two tunnel connections with the virtual private network switch of the client to be connected according to the tunnel configuration information of the service switch; The data stream is transmitted to the virtual private network switch of the client through at least two tunnels of the service switch, so that the virtual private network switch of the client transmits the data stream to the client.

7. The method according to claim 6, characterized in that After transmitting the data stream to the virtual private network switch of the client through at least two tunnels of the service switch, the method further includes: Monitoring each of the at least two tunnels of the service switch in real time through the route reflector; For each tunnel, if the communication of the tunnel is detected to be abnormal, the connection of the tunnel will be cut off.

8. A virtual private network communication device, characterized in that: include: A forwarding module, used for forwarding the data stream to be transmitted to the virtual private network gateway through the private network; A sending module, used for sending the data stream to a virtual private network channel through the virtual private network gateway; The transmission module is used to transmit the data stream to the client through at least two tunnels in the virtual private network channel.

9. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images