Data transmission network system based on mobile communication

Abstract

The invention relates to a data transmission network system based on mobile communication. The data transmission network system comprises headquarter CPE terminal equipment and a headquarter application server group which are deployed in an enterprise headquarter and are in communication connection, branch CPE terminal equipment deployed in an enterprise branch, and an operator base station, and the headquarter CPE terminal equipment, the operator base station and the branch CPE terminal equipment are sequentially in communication connection to form a wireless communication link. Compared with the prior art, the method has the advantages that the existing network architecture of a user does not need to be changed, the user can plug and play after getting the configured CPE terminal equipment, the delivery is simple and convenient, and the safety is high.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data transmission network system based on mobile communication. Background Art

[0002] Existing enterprise data dedicated lines are mainly based on data networking technologies such as SDH / PTN / ATM / IPRAN / SDWAN / MPLS-VPN. These technologies all require the deployment of optical fibers to each user's computer room, which has the following defects:

[0003] 1) Increased investment costs for enterprises and operators, as most enterprises’ main lines are already connected by optical cables, and backup lines only carry very little traffic, so the investment in backup lines is the same as that of main lines, which is not conducive to cost reduction and efficiency improvement for enterprises, and also causes duplicate investment by multiple operators.

[0004] 2) If enterprises directly use the operator's 5G or future 6G and other mobile communication technologies to build a network, they need to apply to the radio management department for electromagnetic spectrum resources. However, electromagnetic spectrum resources are very scarce and cannot be allocated to individual enterprise users. For customers, not only is the investment huge, but the technical implementation is also difficult. In addition, it is a three-layer networking architecture. Multiple points of the enterprise need to transparently transmit or announce the IP address to the operator's core network. The technical implementation is very complex and requires a lot of data configuration, which is a big challenge for the IT of general enterprises. The main focus of enterprise IT technology is on the daily operation and maintenance of the enterprise's business application system, and it is not good at operator networking technology.

[0005] 3) The wireless access technology currently provided by operators is mainly based on a three-layer networking architecture, and requires the establishment of independent radio spectrum resource base stations in enterprise factories. Radio spectrum resources are extremely valuable resources for the country and cannot be invested on a large scale in enterprise internal networking.

[0006] 4) The main application scenarios of enterprise networking are usually low-bandwidth demand scenarios such as 2Mbps-50Mbps, and the connections are mainly within the metropolitan area network and cross-regional long-distance needs. For operators, repeated fiber optic cables are used to meet the low-bandwidth Layer 2 data dedicated line transmission of some customers. For example, there is a large demand for 2M dedicated lines between securities companies and banks. With the current network transmission speed and latency, it is fully capable of meeting the above scenario requirements. Summary of the invention

[0007] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a data transmission network system based on mobile communication. The system does not need to change the user's existing network architecture. After the user gets the configured CPE terminal device, it is plug-and-play, with simple delivery and high security.

[0008] The purpose of the present invention can be achieved by the following technical solutions:

[0009] A data transmission network system based on mobile communications, including headquarters CPE terminal equipment and headquarters application server groups deployed at the enterprise headquarters and communicatively connected, branch CPE terminal equipment deployed at the enterprise branches, and operator base stations; the headquarters CPE terminal equipment, operator base stations and branch CPE terminal equipment are communicatively connected in sequence to form a wireless communication link.

[0010] Preferably, a GREover IPSec encrypted tunnel and a LAN port based on virtual Ethernet binding between the headquarters CPE terminal device and the branch CPE terminal device are used to form an Ethernet type layer 2 transparent network.

[0011] Preferably, the headquarters CPE terminal device and the branch CPE terminal device are both provided with a wireless network module, an operator SIM card is inserted into the wireless interface of the wireless network module, and the headquarters CPE terminal device and the branch CPE terminal device are both interconnected with the operator base station through the SIM card.

[0012] Preferably, the virtual Ethernet binding based on GRE over IPSec encrypted tunnel and LAN port of the headquarters CPE terminal device and the branch CPE terminal device is specifically: the headquarters CPE terminal device and the branch CPE terminal device are interconnected with the operator base station through a SIM card, obtain a private IP address, use the private IP address and the headquarters dedicated line to establish a GRE over IPSec encrypted tunnel based on, and bind the GRE over IPSec encrypted tunnel based on to the LAN port.

[0013] Preferably, the data transmission link between the headquarters CPE terminal device and the branch CPE terminal device includes:

[0014] The headquarters Ethernet data packet and VLAN ID are encapsulated into the GRE tunnel through the headquarters CPE terminal device, and then encapsulated into a data packet using the IPSec encryption protocol. The data packet is sent to the operator base station at the headquarters, and the operator core network accessed by the operator base station is used to transmit the data packet to the operator base station at the branch. The operator base station at the branch sends the data packet to the branch CPE terminal device. After receiving the data packet, the branch CPE terminal device decrypts the data packet and performs a consistency comparison on the VLAN ID. If the comparison is consistent, it is sent to the branch intranet switch.

[0015] Preferably, the system further comprises an operator PE device deployed in an operator data center, the headquarters CPE terminal device is communicatively connected to the operator PE device, and the operator PE device is communicatively connected to an operator base station.

[0016] Preferably, a dedicated line connection or a GRE over IPSec encrypted connection is established between the headquarters CPE terminal device and the operator PE device.

[0017] Preferably, the dedicated line connection is a PTN / MSTP / SDWAN / PON dedicated line connection.

[0018] Preferably, the headquarters CPE terminal device is connected to the headquarters application server group and the headquarters intranet office equipment via Ethernet, and the branch CPE terminal device is connected to the branch intranet office equipment via Ethernet.

[0019] Preferably, the corporate headquarters server group includes a CRM server, an OA server, a NAS file server and a network disk server.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] (1) Convenient user deployment: Compared with the traditional wired optical fiber deployment method, the installation and deployment method of the present invention is faster. After the CPE terminal is configured, it is delivered to the customer's on-site computer room by express delivery. After the CPE terminal device is installed, the communication antenna is adjusted and configured to the best signal reception state. After the user customizes the private IP address on the intranet gateway or switch, a data communication connection can be established. For customers, there is no technical implementation difficulty, which improves the operation and maintenance and human resource costs of general small and medium-sized enterprises.

[0022] (2) Easy maintenance by service providers: Wireless communication does not cause disconnection. As long as the computer room has coverage signal, the network will not be interrupted. All IP addresses are private network IP addresses, and there is no possibility of being hacked by outside hackers. The network operation and maintenance center of the operator's computer room can remotely operate and monitor the use of CPE terminal equipment, port traffic load, delay packet loss, fault alarm and other operation and maintenance work by obtaining the intranet IP address.

[0023] (3) High security: The present invention encrypts the customer's input and output data through the front-end CPE terminal device, and then forwards it to the operator's core network for transmission. When the data reaches the headquarters CPE terminal device, it is decrypted again to obtain complete data and forwarded to the customer's LAN network, which has higher security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] Example

[0027] like Figure 1 As shown, this embodiment provides a data transmission network system based on mobile communication, including a headquarters CPE terminal device and a headquarters application server group deployed at the enterprise headquarters and communicatively connected, a branch CPE terminal device deployed at the enterprise branch, and an operator base station; the headquarters CPE terminal device, the operator base station and the branch CPE terminal device are communicatively connected in sequence to form a wireless communication link.

[0028] Next, the system of this embodiment is introduced in detail.

[0029] 1. Operator base station

[0030] Operator base station: A signal transmitting and receiving device deployed by operators on towers in various parts of the city, which can be connected to various terminal devices such as mobile phones, computers, pads and wireless routers.

[0031] 2. CPE terminal equipment

[0032] The CPE terminal device is the user's front-end terminal device. This embodiment uses mature brand communication equipment such as Huawei AR600 / AR6000 series, which mainly realizes various underlying communication protocol conversions and encapsulation / decapsulation, wireless communication protocol and Ethernet protocol conversion, signal sending and receiving, application layer data encryption / decryption, virtual Ethernet function, Ethernet and tunnel binding function, routing switching and other complex functional modules.

[0033] The headquarters CPE terminal equipment and the branch CPE terminal equipment are both equipped with wireless network modules. The wireless interface of the wireless network module is inserted with the operator SIM card. The headquarters CPE terminal equipment and the branch CPE terminal equipment are interconnected with the operator base station through the SIM card to obtain a private IP address. The private IP address and the headquarters dedicated line are used to establish a GRE over IPSec encrypted tunnel based on the GRE over IPSec encrypted tunnel and bind the GRE over IPSec encrypted tunnel to the LAN port. Specifically:

[0034] The GRE over IPSec encrypted tunnel protocol adopted in this embodiment realizes the data security channel connection between the two CPE terminal devices through the encrypted tunnel technology, and implements AES-256 / 384 / 512 or national encryption SM2 level encryption and authentication protection for the passing data.

[0035] By obtaining a private IP address, a GRE encrypted tunnel is established with the headquarters' dedicated line, and the GRE tunnel is bound to the LAN port, so that the Ethernet protocol on the LAN side is encapsulated into the GRE protocol, and the GRE protocol is then encapsulated into the IP protocol in the wireless, and finally encoded into the mobile communication protocol and forwarded to the base station. The data of the base station is converted into the Ethernet protocol, forwarded to the operator's core network through optical fiber, routed to the CPE terminal device of the corporate headquarters that is interconnected with the core network, decapsulated and forwarded to the Ethernet protocol on the LAN side, and finally to the client server, forming a complete data chain transmission closed loop. For customers, all the transmission channels and protocol conversions in the middle are transparent, and users do not need to worry about the routing and forwarding paths and technical solutions in the middle. For users, the branch and the headquarters are a two-layer transparent network to transmit the user's application layer data. And the AES or SM4 encryption protocol and authentication protocol used in this second layer ensure that the data transmission process is not stolen or destroyed.

[0036] The headquarters CPE terminal equipment is connected to the headquarters application server group and headquarters intranet office equipment through Ethernet, and the branch CPE terminal equipment is connected to the branch intranet office equipment through Ethernet.

[0037] In this embodiment, the data transmission link between the headquarters CPE terminal device and the branch CPE terminal device includes: encapsulating the headquarters Ethernet data packet and VLAN ID into the GRE tunnel through the headquarters CPE terminal device, and then encapsulating it into a data packet using the IPSec encryption protocol, transmitting the data packet to the operator base station at the headquarters, using the operator core network accessed by the operator base station to transmit the data packet to the operator base station at the branch, the operator base station at the branch sends the data packet to the branch CPE terminal device, and the branch CPE terminal device decrypts the data packet after receiving the data packet, performs a consistency comparison on the VLAN ID, and sends it to the branch intranet switch after the comparison is consistent.

[0038] In this embodiment, the system also includes an operator PE device deployed in the operator data center, the headquarters CPE terminal device is connected to the operator PE device, and the operator PE device is connected to the operator base station. Specifically, the operator PE device uses a router, which is mainly used to establish a PTN / MSTP / SDWAN / PON dedicated line connection or a GREover IPSec encrypted tunnel connection with the enterprise headquarters CPE terminal device.

[0039] 3. Enterprise headquarters application server

[0040] Enterprise headquarters application server: refers to a general x86 server, which is divided into multiple virtual machines after virtualization. Then a general Linux operating system is installed on the virtual machine to deploy various enterprise application servers. In this embodiment, the enterprise headquarters server group includes but is not limited to CRM servers, OA servers, NAS file servers, and network disk servers.

[0041] Next, an example of an actual data access link is given, including:

[0042] (1) The office network, IP network 10.8.8.0 / 24 accesses the headquarters server group IP 10.10.10.0 / 24, and a secure closed-loop data access link is established between the CPE and CPE terminal devices based on wireless communication technology.

[0043] (2) The office network 10.8.8.0 / 24 is encapsulated into the Ethernet data frame header, enters the CPE LAN port network, converts Ethernet to PPP protocol, dials into the operator base station network through PPP protocol, then reaches the base station through the 5G core network, and then reaches the headquarters CPE device from the base station, and then converts the PPP protocol to Ethernet, decapsulates, decrypts the data, and sends it to the enterprise internal network. It reaches the visited customer server.

[0044] (3) The office network 10.9.9.0 / 24 is encapsulated into the Ethernet data frame header, enters the CPE LAN port network, converts Ethernet to PPP protocol, dials into the operator base station network through PPP protocol, then reaches the base station through the 5G core network, and then reaches the headquarters CPE device from the base station, and then converts the PPP protocol to Ethernet, decapsulates, decrypts the data, and sends it to the enterprise internal network. It reaches the accessed customer server.

[0045] For daily office users, accessing the headquarters server IP through a PC is just like accessing local resources, and the data flow is transparent to users.

[0046] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A data transmission network system based on mobile communication, characterized in that: It includes headquarters CPE terminal equipment and headquarters application server groups deployed at the enterprise headquarters and communicatively connected, branch CPE terminal equipment deployed at the enterprise branch, and operator base stations; the headquarters CPE terminal equipment, operator base stations and branch CPE terminal equipment are communicatively connected in sequence to form a wireless communication link.

2. A data transmission network system based on mobile communication according to claim 1, characterized in that: Through the virtual Ethernet binding of the headquarters CPE terminal equipment and the branch CPE terminal equipment based on the GRE over IPSec encrypted tunnel and LAN port, an Ethernet-type Layer 2 transparent network is formed.

3. A data transmission network system based on mobile communication according to claim 2, characterized in that: The headquarters CPE terminal equipment and the branch CPE terminal equipment are both provided with a wireless network module, an operator SIM card is inserted into the wireless interface of the wireless network module, and the headquarters CPE terminal equipment and the branch CPE terminal equipment are both interconnected with the operator base station through the SIM card.

4. A data transmission network system based on mobile communication according to claim 3, characterized in that: The virtual Ethernet binding based on GRE over IPSec encrypted tunnel and LAN port of the headquarters CPE terminal device and the branch CPE terminal device is specifically as follows: the headquarters CPE terminal device and the branch CPE terminal device are interconnected with the operator base station through a SIM card, obtain a private IP address, use the private IP address and the headquarters dedicated line to establish a GRE over IPSec encrypted tunnel based on, and bind the GRE over IPSec encrypted tunnel based on to the LAN port.

5. A data transmission network system based on mobile communication according to claim 4, characterized in that: The data transmission link between the headquarters CPE terminal equipment and the branch CPE terminal equipment includes: The headquarters Ethernet data packet and VLAN ID are encapsulated into the GRE tunnel through the headquarters CPE terminal device, and then encapsulated into a data packet using the IPSec encryption protocol. The data packet is sent to the operator base station at the headquarters, and the operator core network accessed by the operator base station is used to transmit the data packet to the operator base station at the branch. The operator base station at the branch sends the data packet to the branch CPE terminal device. After receiving the data packet, the branch CPE terminal device decrypts the data packet and performs a consistency comparison on the VLAN ID. If the comparison is consistent, it is sent to the branch intranet switch.

6. A data transmission network system based on mobile communication according to claim 1, characterized in that: The system also includes an operator PE device deployed in an operator data center, the headquarters CPE terminal device is communicatively connected to the operator PE device, and the operator PE device is communicatively connected to an operator base station.

7. A data transmission network system based on mobile communication according to claim 6, characterized in that: A dedicated line connection or a GRE over IPSec encrypted connection is established between the headquarters CPE terminal device and the operator PE device.

8. A data transmission network system based on mobile communication according to claim 7, characterized in that: The dedicated line connection is a PTN / MSTP / SDWAN / PON dedicated line connection.

9. A data transmission network system based on mobile communication according to claim 1, characterized in that: The headquarters CPE terminal equipment is connected to the headquarters application server group and the headquarters intranet office equipment via Ethernet, and the branch CPE terminal equipment is connected to the branch intranet office equipment via Ethernet.

10. A data transmission network system based on mobile communication according to claim 1, characterized in that: The corporate headquarters server group includes a CRM server, an OA server, a NAS file server and a network disk server.

Images