VPN optimization enhancement method and system in multi-node remote cooperation environment

Abstract

The invention belongs to the technical field of communication networks, and particularly relates to a VPN optimization enhancement method and system in a multi-node remote cooperation environment. The method comprises the following steps: S1, constructing a mapping service of a VPN account and an internal domain name; s2, constructing a mapping service of the VPN account and the temporary IP; s3, deploying a DDNS service in an internal network of a company; and S4, in combination with the mapping service information constructed in the step S1 and the step S2, realizing binding between the internal domain name and the temporary IP address by calling the DDNS service deployed in the step S3. The method has the characteristics that the binding of the fixed domain name and the dynamic IP address can be realized by introducing the DDNS service and the gateway mapping service, so that the remote cooperation process is simplified, the cooperation efficiency and the maintainability of codes are improved, the expansibility and flexibility of the system are enhanced, the safety is improved, and the user experience is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of communication networks, and in particular relates to a VPN optimization and enhancement method and system in a multi-node remote collaboration environment. Background Art

[0002] In modern enterprises, especially software development companies, engineers often need to work in different locations (such as working from home or on business trips). In order to ensure that these remote engineers can access internal company servers, databases and other resources, they are usually provided with VPN (Virtual Private Network) accounts. Through VPN, engineers can dial into the company's LAN in an external network environment, thereby accessing internal resources as if they were inside the company.

[0003] However, traditional VPN solutions have many defects when dealing with multi-node remote collaboration.

[0004] Take a typical software development scenario as an example. Front-end engineer A and back-end engineer B need to jointly develop a functional module. A works from home and B is on a business trip, and they need to access the company's internal database C. In this case, the traditional VPN solution has the following problems: (1) Changeable temporary IP addresses: Each time an engineer dials into a VPN, his or her device will be assigned a temporary intranet IP address. Since this IP address is dynamically assigned, each time A collaborates, A needs to contact B to inquire about the temporary IP information obtained and edit this content into the front-end code environment. This not only increases communication costs, but also slows down the overall collaboration progress.

[0005] (2) Poor user experience when working remotely: Each collaboration requires manual configuration of the IP address, which makes the user experience of remote work poor and far different from the experience of working on the company's intranet.

[0006] (3) The inconvenience of manually modifying the code environment: Front-end engineers need to manually modify the code environment, which not only reduces the maintainability of the code but also increases the risk of errors. In actual collaborative scenarios, a module development task often involves multiple front-end and back-end engineers at the same time, and the above problems become more serious.

[0007] (4) Insufficient scalability and flexibility of network management: Traditional VPN solutions lack scalability and flexibility when dealing with large-scale multi-node collaboration. As the number of engineers involved in the collaboration increases, the cost of management and maintenance will also increase significantly.

[0008] (5) Security issues: Due to the volatility of temporary IP addresses, manual configuration is required for each collaboration, which increases potential security risks. If an engineer’s IP address is leaked, internal resources may be illegally accessed.

[0009] like Figure 1 The figure shows a schematic diagram of the network structure of a traditional VPN solution.

[0010] Depend on Figure 1 As can be seen from the figure, traditional VPN solutions mainly focus on the connectivity between a single remote node and the headquarters intranet, and their emphasis is on enabling employees on business trips to smoothly access the company's intranet resources. In many actual work scenarios, multiple employees in different locations need to collaborate on development. In the process, not only do they need to call the resources of the company's headquarters intranet, but employees also need to transfer data and call services with each other. At this time, using only traditional VPN solutions will cause many inconveniences.

[0011] In order to solve the above problems, the present invention proposes a VPN optimization and enhancement method and system in a multi-node remote collaboration environment, aiming to eliminate the above shortcomings in the traditional VPN mode and enable personnel participating in multi-point remote collaborative office to obtain an experience close to that of the company's intranet. Summary of the invention

[0012] The present invention aims to overcome the problems of variable temporary IP addresses, inconvenient manual code modification environment, insufficient scalability and flexibility, security issues and poor user experience in traditional VPN solutions in multi-node remote collaboration scenarios in the prior art. The present invention provides a VPN optimization and enhancement method and system in a multi-node remote collaboration environment that can achieve binding of fixed domain names with dynamic IP addresses by introducing DDNS services and gateway mapping services, thereby simplifying the remote collaboration process, improving collaboration efficiency and code maintainability, enhancing the scalability and flexibility of the system, improving security, and improving user experience.

[0013] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions: The VPN optimization and enhancement method in a multi-node remote collaboration environment includes the following steps: S1, build a mapping service between VPN accounts and internal domain names; S2, builds a mapping service between VPN account and temporary IP; S3, deploy DDNS service in the company's internal network; S4, combining the mapping service information constructed in step S1 and step S2, and calling the DDNS service deployed in step S3 to implement the binding between the internal domain name and the temporary IP address.

[0014] Preferably, step S1 comprises the following steps: S11, construct a first mapping service platform for recording the mapping relationship between each VPN account and the corresponding internal domain name; whenever a new VPN account is created, the system automatically generates an internal domain name corresponding to the VPN account, and stores the mapping record between the VPN account and the corresponding internal domain name in the first mapping service platform.

[0015] Preferably, the mapping service constructed in step S1 has the following characteristics: The mapping service is deeply integrated with the existing VPN service to ensure that when a new VPN account is created, the logic of the mapping service is triggered to generate and record the corresponding internal domain name, and the entire process is fully automated; The mapping information between VPN accounts and internal domain names is available for review at any time through appropriate methods; the appropriate methods include reviewing through a front-end query interface or setting a naming rule logic between a VPN account and an internal domain name, and the user directly infers the internal domain name corresponding to the VPN account through the VPN account.

[0016] Preferably, step S2 comprises the following steps: S21, construct a second mapping service platform for recording the mapping relationship between each VPN account and the corresponding temporarily acquired intranet IP address; whenever a VPN account successfully dials into the company's intranet, the second mapping service platform automatically records the VPN account and the corresponding currently acquired temporary IP address.

[0017] Preferably, the mapping service constructed in step S2 has the following characteristics: The mapping service is also deeply integrated with the existing VPN service to ensure that when the VPN account dials into the intranet, the logic of the temporary IP mapping service is automatically triggered, the corresponding temporary IP address is generated and recorded, and the entire process is fully automated.

[0018] Preferably, in step S3, the DDNS service is used to automatically update the corresponding domain name resolution record when the intranet IP address changes, to ensure that the domain name always points to a valid IP address.

[0019] Preferably, step S4 comprises the following steps: S41, combining the information of the first mapping service platform and the second mapping service platform, the system obtains the temporary IP address of a VPN account that has dialed into the intranet and the corresponding internal domain name; S42, by calling the deployed DDNS service, the system establishes a binding relationship between the internal domain name and the temporary IP address, and updates the DNS resolution record in real time to ensure that the domain name always points to the latest IP address.

[0020] The present invention also provides a VPN optimization and enhancement system in a multi-node remote collaboration environment, including: A first mapping service building module is used to build a mapping service between a VPN account and an internal domain name; The second mapping service building module is used to build a mapping service between a VPN account and a temporary IP; Deployment module, used to deploy DDNS service in the company's internal network; The binding module is used to combine the mapping service information constructed by the first mapping service construction module and the second mapping service construction module, and realize the binding between the internal domain name and the temporary IP address by calling the DDNS service deployed by the deployment module.

[0021] Compared with the prior art, the present invention has the following beneficial effects: (1) reducing communication costs: by binding a fixed domain name with a dynamic IP address, front-end engineers no longer need to frequently contact back-end engineers to obtain temporary IP addresses, thus reducing communication costs and improving collaboration efficiency; (2) improving the user experience of remote offices: in a collaborative scenario of multiple remote offices, there is no need to perform any additional operations other than dialing a VPN, and the office experience is almost the same as being in the company's intranet, greatly improving the user experience; (3) improving code maintainability: front-end engineers only need to configure the fixed domain name address of back-end engineers once in the code environment, without having to manually modify the IP address, thus improving the maintainability of the code and reducing the risk of errors; (4) improving the scalability and flexibility of network node management: the present invention realizes efficient management and flexible configuration of multi-node remote collaboration through dynamic domain name resolution services and mapping services, and is suitable for large-scale multi-node collaboration scenarios, with significantly improved scalability and flexibility; (5) enhancing security: by binding a fixed domain name with a dynamic IP address, the security risks brought by manual configuration are avoided, thus enhancing the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of a network structure of a traditional VPN solution; Figure 2 The present invention is a schematic diagram of a network structure after the VPN optimization and enhancement method in a multi-node remote collaboration environment of the present invention is implemented. DETAILED DESCRIPTION

[0023] In order to more clearly illustrate the embodiments of the present invention, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other accompanying drawings and other implementation methods can be obtained based on these accompanying drawings without creative work.

[0024] The present invention provides a VPN optimization and enhancement method in a multi-node remote collaboration environment, comprising the following steps: 1. Build a mapping service between VPN accounts and internal domain names; 2. Build a mapping service between VPN account and temporary IP; 3. Deploy dynamic domain name resolution service (Dynamic DNS, referred to as DDNS) in the company's internal network; 4. Combine the mapping service information constructed in step 1 and step 2, and call the DDNS service deployed in step 3 to implement the binding between the internal domain name and the temporary IP address.

[0025] For step 1, the specific process is as follows: Build a mapping service platform to record the mapping relationship between each VPN account and its corresponding internal domain name. Whenever a new VPN account is created, the system will automatically generate an internal domain name corresponding to the account and store the mapping record between the two in the mapping service platform.

[0026] The mapping between VPN accounts and domain names can of course be done manually, but in order to maximize ease of use, the mapping service should have the following two features: (1) The mapping service needs to be deeply integrated with the existing VPN service, which is achieved through the following three core links: 1.VPN account creation linkage trigger An automated trigger interface is set up in the VPN service. When the administrator creates a new VPN account, the VPN service immediately sends a synchronization request to the mapping service through an encrypted API. This process is like inserting a "smart switch" into the traditional VPN account generation process, ensuring that each new account will trigger the domain name mapping action.

[0027] 2. Automatic domain name generation After receiving the VPN account information, the mapping service automatically generates an internal domain name according to the preset rules. For example, the format of "VPN account name. department code. vpn.company.com" is adopted. The rule engine is directly embedded in the underlying architecture of the mapping service and is completed synchronously with the VPN account generation process.

[0028] 3. Two-way data binding The generated domain name and VPN account information will be written into the shared database in real time. The database is managed through the built-in storage module of the mapping service and is open to the VPN service for sharing, realizing two-way mapping relationship verification.

[0029] Through the integration of the above-mentioned "mapping service for VPN accounts and internal domain names" and the "existing VPN service", it is ensured that when a new VPN account is created, the logic of the mapping service can be triggered, and the corresponding internal domain name can be automatically generated, recorded, and synchronized according to the preset rules. The entire process is completed fully automatically.

[0030] (2)The mapping information between VPN accounts and internal domain names should be available for viewing at any time through appropriate means. This requirement can be achieved by implementing a front-end query interface. Of course, there is also a more direct way, which is to agree on a naming rule logic between VPN accounts and domain names, so that everyone can directly deduce the domain name corresponding to the account through the VPN account.

[0031] For example, when creating a VPN account named "peter", the system will automatically generate a corresponding internal domain name "peter.vpn.econage.xyz" and record these two pieces of information in the mapping service.

[0032] For step 2, the specific process is as follows: Build another mapping service platform to record the mapping relationship between each VPN account and its temporarily obtained internal network IP address. Whenever a VPN account successfully dials into the company's internal network, the mapping service platform will automatically record the account and its currently obtained temporary IP address.

[0033] This mapping service also needs to be deeply integrated with the existing VPN service, which is specifically implemented through the following three core links: 1. Dynamic IP capture module Install a lightweight proxy program at the VPN gateway. When the user device completes the establishment of the VPN tunnel, the temporarily assigned IP address is captured in real time through the API interface provided by the VPN service (such as the Client-Connect script hook of OpenVPN). This module interacts with the authentication and authorization subsystem of the VPN service to ensure the atomic operation of IP address acquisition and user authentication.

[0034] 2. Event-driven data synchronization Establish a VPN service event listening mechanism to trigger mapping updates when the following key events are detected: VPN_CONNECTED: When the user dials in successfully, extract the <VPN account, temporary IP> pair from the session parameters; VPN_DISCONNECTED: When the user disconnects, automatically clear the corresponding mapping record; IP_REASSIGNED: When the VPN service reassigns the IP address, trigger a mapping update.

[0035] 3. Distributed data storage architecture The mapping service platform adopts a dual-write mechanism to write the captured mapping relationships simultaneously: In-memory database (such as Redis cluster): used for high-concurrency real-time queries; Persistent storage (such as MySQL cluster): ensure data consistency through binlog synchronization; VPN gateway local cache: provides eventual consistency guarantee in network partition scenarios.

[0036] The above integration solution can ensure that when a VPN account dials into the intranet, the logic of the temporary IP mapping service is automatically triggered to generate and record the corresponding temporary IP address. The entire process is fully automated.

[0037] For step 3, deploy DDNS service in the company's internal network to prepare for the subsequent binding and resolution of fixed domain names and dynamic IP addresses. DDNS service can automatically update the corresponding domain name resolution record when the intranet IP address changes, ensuring that the domain name always points to a valid IP address.

[0038] For step 4, the specific process is as follows: Combining the information of the two mapping service platforms built in step 1 and step 2, the system can obtain the temporary IP address of a VPN account that has dialed into the intranet and its corresponding internal fixed domain name. Then, by calling the DDNS service deployed in step 3, the system establishes a binding relationship between the fixed domain name and the temporary IP address, and updates the DNS resolution record in real time to ensure that the domain name always points to the latest IP address.

[0039] For example, when the VPN account "peter" dials into the intranet, the temporary IP address assigned to "peter" by the gateway is 192.168.1.123. At this time, the system will call the DDNS service to establish a binding relationship between "peter.vpn.econage.xyz" and 192.168.1.123 In addition, the present invention also provides a VPN optimization and enhancement system in a multi-node remote collaboration environment, including: A first mapping service building module is used to build a mapping service between a VPN account and an internal domain name; The second mapping service building module is used to build a mapping service between a VPN account and a temporary IP; Deployment module, used to deploy DDNS service in the company's internal network; The binding module is used to combine the mapping service information constructed by the first mapping service construction module and the second mapping service construction module, and realize the binding between the internal domain name and the temporary IP address by calling the DDNS service deployed by the deployment module.

[0040] In order to more clearly describe the component generation process, the present invention gives a simple example to further illustrate and practice the above technical solution: Returning to the example scenario described in the previous background technology, Figure 2 FIG. 1 is a schematic diagram of a network structure after implementing the technical solution of the present invention, and the specific process is as follows: Step 1: After the remote device A dials into the VPN intranet, the default VPN service assigns it a temporary dynamic IP and records it in "VPN Account - Temporary Dynamic IP Mapping Service".

[0041] Step 2: Query the internal domain name of remote device A in "VPN Account-Internal Fixed Domain Name Mapping Service".

[0042] Step 3: Call the "DDNS service" to bind the temporary IP obtained in the first two steps to the internal domain name.

[0043] The remote device B also repeats the above three steps to complete the binding of B's ​​temporary IP and the internal domain name.

[0044] After implementing the technical solution of the present invention, it can be seen that A and B, as remote devices, do not need to care about anytime and anywhere they dial into the VPN, and no matter how many dynamic IPs are assigned to them, they only need to maintain their internal domain names.

[0045] Remote device A only needs to maintain the domain name address of remote device B once in its code environment, and no editing operation is required in subsequent collaboration. Regardless of how the temporary IP of remote device B changes, the front-end program of remote device A can successfully call the back-end program interface of B through the domain name of remote device B.

[0046] After implementing this technical solution, in the collaborative scenario of multiple remote offices, there is no need to perform any additional operations other than dialing the VPN, and the office experience is almost the same as being in the company's intranet.

[0047] The innovative features of the present invention are as follows: 1. Requires deep integration with existing VPN services The solution of the present invention needs to be deeply integrated with the existing VPN service to ensure that when a new VPN account is created, the logic of the mapping service can be automatically triggered to generate and record the corresponding internal domain name and temporary IP address.

[0048] There are various VPN service solutions used in different enterprises. The present invention needs to fully consider good compatibility and non-intrusiveness in design to ensure that the solution can have consistent performance based on different VPN services.

[0049] 2. Design and implementation of mapping service platform Build two mapping service platforms to record the mapping relationship between VPN accounts and internal domain names, and between VPN accounts and temporary IP addresses. These two mapping service platforms need to have high availability and real-time performance, and be integrated with VPN services as part of the enterprise gateway to ensure efficient management and flexible configuration in multi-node remote collaboration scenarios.

[0050] 3. Exquisite link design and high reliability and low latency user experience From the user dialing into the VPN, to generating a dynamic IP, to querying the corresponding internal domain name, and finally calling the DDNS service to bind the dynamic IP to the internal domain name, the entire link operation can be completed smoothly and automatically. The system can ensure high reliability and low latency, ensuring that users can get a user experience close to the company's intranet when collaborating remotely on multiple nodes.

[0051] The above description is only a detailed description of the preferred embodiments and principles of the present invention. For ordinary technicians in this field, according to the ideas provided by the present invention, there will be changes in the specific implementation methods, and these changes should also be regarded as the protection scope of the present invention.

Claims

1. A VPN optimization and enhancement method in a multi-node remote collaboration environment, characterized in that: The method comprises the following steps: S1, build a mapping service between VPN accounts and internal domain names; S2, builds a mapping service between VPN account and temporary IP; S3, deploy DDNS service in the company's internal network; S4, combining the mapping service information constructed in step S1 and step S2, and implementing the binding between the internal domain name and the temporary IP address by calling the DDNS service deployed in step S3.

2. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 1 is characterized in that: Step S1 includes the following steps: S11, construct a first mapping service platform for recording the mapping relationship between each VPN account and the corresponding internal domain name; whenever a new VPN account is created, the system automatically generates an internal domain name corresponding to the VPN account, and stores the mapping record between the VPN account and the corresponding internal domain name in the first mapping service platform.

3. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 2 is characterized in that: The mapping service constructed in step S1 has the following characteristics: The mapping service is deeply integrated with the existing VPN service to ensure that when a new VPN account is created, the logic of the mapping service is triggered to generate and record the corresponding internal domain name, and the entire process is fully automated; The mapping information between VPN accounts and internal domain names is available for review at any time through appropriate methods; the appropriate methods include reviewing through a front-end query interface or setting a naming rule logic between a VPN account and an internal domain name, and the user directly infers the internal domain name corresponding to the VPN account through the VPN account.

4. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 3 is characterized in that: Step S2 includes the following steps: S21, construct a second mapping service platform for recording the mapping relationship between each VPN account and the corresponding temporarily acquired intranet IP address; whenever a VPN account successfully dials into the company's intranet, the second mapping service platform automatically records the VPN account and the corresponding currently acquired temporary IP address.

5. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 4 is characterized in that: The mapping service constructed in step S2 has the following characteristics: The mapping service is also deeply integrated with the existing VPN service to ensure that when the VPN account dials into the intranet, the logic of the temporary IP mapping service is automatically triggered, the corresponding temporary IP address is generated and recorded, and the entire process is fully automated.

6. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 5 is characterized in that: In step S3, the DDNS service is used to automatically update the corresponding domain name resolution record when the intranet IP address changes, ensuring that the domain name always points to a valid IP address.

7. The VPN optimization and enhancement method in a multi-node remote collaboration environment according to claim 6 is characterized in that: Step S4 includes the following steps: S41, combining the information of the first mapping service platform and the second mapping service platform, the system obtains the temporary IP address of a VPN account that has dialed into the intranet and the corresponding internal domain name; S42, by calling the deployed DDNS service, the system establishes a binding relationship between the internal domain name and the temporary IP address, and updates the DNS resolution record in real time to ensure that the domain name always points to the latest IP address.

8. A VPN optimization and enhancement system in a multi-node remote collaboration environment, used to implement the VPN optimization and enhancement method in a multi-node remote collaboration environment according to any one of claims 1 to 7, characterized in that: The VPN optimization and enhancement system in a multi-node remote collaboration environment includes: A first mapping service building module is used to build a mapping service between a VPN account and an internal domain name; The second mapping service building module is used to build a mapping service between a VPN account and a temporary IP; Deployment module, used to deploy DDNS service in the company's internal network; The binding module is used to combine the mapping service information constructed by the first mapping service construction module and the second mapping service construction module, and realize the binding between the internal domain name and the temporary IP address by calling the DDNS service deployed by the deployment module.

Images