VPN network communication method, apparatus, device and program product

Abstract

The invention relates to the field of communication, in particular to a VPN network communication method and device, equipment and a program product. The method comprises the following steps: acquiring flow characteristics of tenants in a VPN network; calculating a service sensitivity type corresponding to the traffic feature through a first network model; according to the corresponding relationship between the service sensitivity type and the encryption level, determining the encryption level matched with the service sensitivity type corresponding to the flow characteristic, and encrypting the communication data according to the encryption level; and obtaining tunnel features based on the encryption level, predicting a tunnel health score corresponding to the tunnel features through a preset second network model, and adjusting the tunnel and / or the encryption level through the tunnel health score. The encryption level matched with the service sensitivity type is adopted for encryption, the data safety can be effectively improved, the tunnel and the encryption level are adjusted through the tunnel health score, the possibility of transverse penetration attack can be effectively reduced, and the system communication safety is improved.

Description

Technical Field

[0001] This application relates to the field of communications, and in particular to a VPN network communication method, apparatus, device, and program product. Background Technology

[0002] A VPN (Virtual Private Network) is an encrypted virtual connection established over a public network (such as the Internet) that enables remote users or branch offices to securely access internal network resources or establish secure communication channels between different locations.

[0003] To restrict direct communication between different departments, users, or devices and reduce the risk of lateral movement attacks, tenants in a VPN network need to be isolated. Currently, a common isolation method is to reuse VRF (Virtual Routing and Forwarding) technology to create an independent routing instance for each tenant, implement tunnel isolation through MPLS (Multiprotocol Label Switching) or VXLAN (Virtual Extensible LAN), and employ specific encryption methods to ensure that routing information is not leaked. However, this isolation method is not conducive to protecting the security of critical data; lateral movement can still occur after attacks on devices within a tenant's premises, affecting communication security. Summary of the Invention

[0004] In view of this, embodiments of this application provide a VPN network communication method, apparatus, device, and program product to solve the problem that the security of the isolation method in the prior art is not high, and that lateral penetration may still occur after the tenant's internal device is attacked, affecting communication security.

[0005] A first aspect of this application provides a VPN network communication method, the method comprising: Obtain the traffic characteristics of tenants in the VPN network; The service sensitivity type corresponding to the traffic characteristics is calculated using a preset first network model; Based on the pre-defined correspondence between service sensitivity types and encryption levels, the encryption level matching the service sensitivity type corresponding to the traffic characteristics is determined, and the communication data is encrypted according to the encryption level. Obtain tunnel features based on the encryption level, predict the tunnel health score corresponding to the tunnel features using a preset second network model, and adjust the tunnel and / or encryption level based on the tunnel health score.

[0006] In conjunction with the first aspect, in a first possible implementation of the first aspect, path and / or encryption level adjustment is performed through the tunnel health score, including: When the tunnel health score is greater than or equal to a predetermined security threshold, the current encryption level is maintained; When the tunnel health score is less than the security threshold and greater than or equal to a predetermined danger threshold, the encryption level is reduced. When the tunnel health score is less than the danger threshold, traffic is switched to a different tunnel through dynamic routing. Wherein, the safety threshold is greater than the danger threshold.

[0007] In conjunction with the first aspect, in a second possible implementation of the first aspect, the business sensitivity type includes a first business type, a second business type, and a third business type, wherein the sensitivity of the first business type is higher than that of the second business type, and the sensitivity of the second business type is higher than that of the third business type. Based on a pre-defined correspondence between service sensitivity types and encryption levels, the encryption level matching the service sensitivity type corresponding to the traffic characteristic is determined, including: When the business sensitivity type is the first business type, it is determined that the business sensitivity type corresponding to the traffic feature matches the first encryption level; When the business sensitivity type is the second business type, it is determined that the business sensitivity type corresponding to the traffic feature matches the second encryption level; When the business sensitivity type is the third business type, it is determined that the business sensitivity type corresponding to the traffic feature matches the third encryption level; The first encryption level is more secure than the second encryption level, and the second encryption level is more secure than the third encryption level.

[0008] In conjunction with the first aspect, in a third possible implementation of the first aspect, obtaining tunnel features based on the encryption level and predicting the tunnel health score corresponding to the tunnel features using a preset second network model includes: Obtain at least one of the following parameters for data transmission based on the encryption level: latency, packet loss rate, and bandwidth utilization. Normalize at least one of the latency parameter, packet loss rate, and bandwidth utilization to obtain normalized data; Normalized data is input into the pre-trained second network model to predict and output the tunnel health score corresponding to the tunnel features.

[0009] In conjunction with the first aspect, in a fourth possible implementation of the first aspect, the method further includes, prior to adjusting the tunnel and / or encryption level via the tunnel health score: Extract the tenant ID, which includes the VLAN tag and / or IP prefix; Based on the preset correspondence between tenant IDs and independent transmission tunnels, an independent transmission tunnel is allocated to the traffic of the tenant ID.

[0010] In conjunction with the fourth possible implementation of the first aspect, in the fifth possible implementation of the first aspect, after allocating an independent transmission tunnel for the traffic of the tenant ID, the method further includes: Permissions of tenants accessing the VPN network are verified through device certificate verification and two-way authentication. Once the permission verification is successful, the tenant is allowed to access the VPN network.

[0011] In conjunction with the fifth possible implementation of the first aspect, in the sixth possible implementation of the first aspect, after allowing the tenant to access the VPN network, the method further includes: Obtain basic traffic behavior data of the tenant, wherein the basic traffic behavior data includes at least one of traffic bandwidth, protocol distribution and access timing; Obtain the tenant's real-time traffic, compare the real-time traffic with the traffic behavior basic data, and determine whether there are any anomalies in the real-time traffic; When the real-time traffic is abnormal, the tenant's traffic is blocked or the transmission tunnel for communication with the tenant is rebuilt.

[0012] A second aspect of this application provides a VPN network communication device, the device comprising: Traffic feature acquisition unit, used to acquire traffic features of tenants in the VPN network; A service sensitivity type determination unit is used to calculate the service sensitivity type corresponding to the traffic characteristics through a preset first network model; The encryption unit is used to determine the encryption level matching the business sensitivity type corresponding to the traffic feature according to the pre-defined correspondence between business sensitivity type and encryption level, and to encrypt the communication data according to the encryption level. An adjustment unit is used to acquire tunnel features based on the encryption level, predict the tunnel health score corresponding to the tunnel features through a preset second network model, and adjust the tunnel and / or encryption level based on the tunnel health score.

[0013] A third aspect of this application provides a VPN network communication device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the VPN network communication device causes the VPN network communication device to implement the method as described in any of the first aspects.

[0014] A fourth aspect of this application provides a computer program product that, when run on a computer, causes the computer to execute the methods described in the first aspect or its various implementations.

[0015] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method as described in any of the first aspects.

[0016] A sixth aspect of this application provides a chip for implementing the methods in the various implementations of the first aspect described above. Specifically, the chip includes a processor for calling and running a computer program from a memory, causing a device equipped with the chip to perform the methods as described in the first aspect or its various implementations.

[0017] The beneficial effects of this application embodiment compared with the prior art are as follows: This application embodiment obtains the traffic characteristics of tenants in the VPN network, determines the service sensitivity type based on the traffic characteristics, and encrypts the communication data using an encryption level that matches the service sensitivity type. This can effectively improve the security of data with high service sensitivity. Furthermore, based on the encryption level, the tunnel characteristics during encrypted transmission are determined, and the tunnel health score determined by the tunnel characteristics is used to adjust the tunnel and / or encryption level. This timely detection of abnormal tunnel health scores caused by lateral penetration can effectively reduce the possibility of lateral penetration attacks and improve the system communication security. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram illustrating an implementation scenario of a VPN network communication method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the implementation process of a VPN network communication method provided in an embodiment of this application; Figure 3This is a schematic diagram illustrating the implementation process of an isolation and adjustment method provided in an embodiment of this application; Figure 4 This is a schematic diagram illustrating the implementation process of a tunnel initialization method provided in an embodiment of this application; Figure 5 This is a schematic diagram of a VPN network communication device provided in an embodiment of this application; Figure 6 This is a schematic diagram of a VPN network communication device provided in an embodiment of this application. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0022] VPN (Virtual Private Network) is an encrypted virtual channel technology built on a public network (such as the Internet). It can ensure that remote office users or corporate branches can securely access internal network resources or establish trusted communication links between nodes across regions.

[0023] To prevent unauthorized access between different departments, users, or terminal devices and reduce the risk of lateral movement attacks, strict isolation of tenants in a VPN network is necessary. The current mainstream solution reuses VRF (Virtual Routing and Forwarding) technology, assigning an independent routing instance to each tenant and constructing a tunnel isolation layer using MPLS (Multiprotocol Label Switching) or VXLAN (Virtual Extensible LAN), while combining this with specific encryption algorithms to ensure the security of routing information. However, this isolation model has significant limitations: because it relies solely on network layer isolation mechanisms, once a tenant's internal terminal devices are compromised (e.g., infected with malware), attackers may use their acquired privileges to laterally penetrate the tenant's network, leading to data leaks or service interruptions, making it difficult to fundamentally prevent the spread of the attack chain.

[0024] To address the aforementioned problems, this application proposes a VPN network communication method. Figure 1This diagram illustrates the implementation scenario of this method. In this scenario, tenant 1 and SD-WAN (Software-defined networking in a wide area network) server 2 are involved. Tenant 1 can carry a device certificate, such as an X.509 device certificate, and send a VPN access request to SD-WAN server 2. SD-WAN server 2 verifies the device certificate, completing two-way identity verification. After successful authentication, SD-WAN server 2 allocates a VxLAN tunnel to tenant 1 and issues an initial encryption policy, such as an AES-256 encryption algorithm. Tenant 1 sends data through the VxLAN tunnel. SD-WAN server 2 analyzes the service sensitivity type of the data using AI and other models, and dynamically adjusts the encryption algorithm to encrypt the data according to the encryption level corresponding to the service sensitivity type. Traffic from each tenant is isolated through the VxLAN tunnel to prevent lateral movement. SD-WAN Server 2 monitors the tunnel status in real time, including characteristic parameters such as tunnel data latency and data packet loss rate. If an anomaly is detected, such as congestion, the encryption strategy is dynamically switched or the tunnel is switched to achieve a dynamic balance between data communication reliability and security.

[0025] Figure 2 This is a schematic diagram illustrating the implementation process of a VPN network communication method provided in an embodiment of this application. The execution subject of this method can be an SD-WAN server, and the method is described in detail below: In S201, the traffic characteristics of the tenants in the VPN network are obtained.

[0026] The VPN network in this application embodiment, also known as a Virtual Private Network, is an encrypted virtual connection established through a public network (such as the Internet) that enables remote users or branch offices to securely access internal network resources of an enterprise or establish secure communication channels between different locations.

[0027] Traffic can be captured through SD-WAN edge devices, such as routers or network probes, and deep packet inspection technology can be used to analyze the traffic content and extract structured features, including at least one of the following features: protocol type, packet size distribution, transmission timing, and payload content features.

[0028] The transport layer or application layer protocol used by traffic can include protocols such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), HTTP (Hypertext Transfer Protocol), and QUIC (Quick UDP Internet Connections). Different services typically rely on specific protocol types. For example, video conferencing usually uses the UDP protocol, while file downloading usually uses the HTTP or TCP protocol.

[0029] Packet size distribution refers to the range and proportion of packet sizes in traffic. For example, a high proportion of small packets may correspond to control-related services, while large packets may correspond to media streaming or file transfer services.

[0030] Transmission timing refers to the regularity of the time intervals in which data packets are sent, including periodic or bursty time intervals, and is used to indicate the time sensitivity of service types.

[0031] Payload content characteristics include data type, encoding format, and entropy value. For encrypted traffic, because it is close to random data, the content cannot be directly parsed, resulting in a high entropy value. For HTTP text traffic, the payload contains plaintext strings, resulting in a low entropy value.

[0032] In S202, the service sensitivity type corresponding to the traffic characteristics is calculated using a preset first network model.

[0033] The collected traffic features are input into a pre-trained first network model, such as an LSTM (Long Short Term Memory) model or a random forest model. This first network model can learn the characteristic patterns of different service traffic based on historical data and output the service sensitivity type to which the traffic belongs, including a first sensitivity type, a second sensitivity type, and a third sensitivity type. The first sensitivity type can be a high sensitivity type, the second sensitivity type can be a medium sensitivity type, and the third sensitivity type can be a low sensitivity type.

[0034] When training the first network model, traffic data with calibrated sensitivity types can be pre-labeled. This includes sample data labeled with traffic characteristics and service sensitivity types. At least one of the traffic characteristics from the sample data, such as protocol type, packet size distribution, transmission timing, and payload content characteristics, is input into the parameter-initialized first network model. The sensitivity type is calculated based on the traffic characteristics. The parameters in the first network model are adjusted according to the difference between the calculated service sensitivity type and the calibrated service sensitivity type. This process continues until the output service sensitivity type matches the calibrated service sensitivity type after all sample data has been input into the first network model, thus completing the training of the first network model. Based on the trained first network model, the traffic characteristics of tenants in the current VPN network are input into the first network model, and the accurate service sensitivity type is output.

[0035] In S203, based on the pre-defined correspondence between service sensitivity types and encryption levels, the encryption level matching the service sensitivity type corresponding to the traffic characteristics is determined, and the communication data is encrypted according to the encryption level.

[0036] Different business sensitivity types have different data security requirements. This application embodiment can pre-define a mapping relationship between business sensitivity types and encryption levels. This mapping relationship can include a first business type, a second business type, and a third business type, wherein the sensitivity of the first business type is higher than that of the second business type, and the sensitivity of the second business type is higher than that of the third business type. The first business type maps to the first encryption level, the second business type maps to the second encryption level, and the third business type maps to the third encryption level.

[0037] In other words, when the business sensitivity type is the first business type, the business sensitivity type corresponding to the traffic characteristics is determined to match the first encryption level; when the business sensitivity type is the second business type, the business sensitivity type corresponding to the traffic characteristics is determined to match the second encryption level; when the business sensitivity type is the third business type, the business sensitivity type corresponding to the traffic characteristics is determined to match the third encryption level; wherein, the first encryption level is more secure than the second encryption level, and the second encryption level is more secure than the third encryption level.

[0038] The first encryption level can use the AES-256 encryption algorithm, which has a 256-bit key strength. It involves a large number of computation rounds, making it suitable for high-security scenarios and providing very high confidentiality. The second encryption level can use the SM4 encryption algorithm, and the third encryption level can use the AES-128 encryption algorithm. Compared to AES-128, the SM4 encryption algorithm involves more computation rounds; therefore, SM4 is more secure than AES-128.

[0039] By assigning different security levels of encryption algorithms to traffic of different business sensitivity types, traffic of more sensitive business types can be encrypted using more secure encryption algorithms, thus more reliably ensuring the security of traffic of that business sensitivity type. For traffic of less sensitive business types, less secure encryption algorithms can be used for encryption, which can effectively improve data processing efficiency and data transmission efficiency.

[0040] In S204, tunnel features based on the encryption level are obtained, a tunnel health score corresponding to the tunnel features is predicted by a preset second network model, and the tunnel and / or encryption level are adjusted based on the tunnel health score.

[0041] This application embodiment can dynamically allocate independent tunnels to tenants based on virtualization technology and bind tenant IDs with tunnel IDs to achieve physical traffic reuse and logical isolation. The tunnel characteristics include at least one of the following: latency parameters, data packet loss rate, and bandwidth utilization.

[0042] Latency refers to the time it takes for a data packet to travel from the sender to the receiver through a VxLAN tunnel. Latency is a key indicator of network response speed and directly impacts the experience of real-time services (such as video conferencing and online gaming). Packet loss rate refers to the proportion of data packets lost during transmission out of the total number sent, usually expressed as a percentage (%). Packet loss can lead to data retransmission, service interruption, or quality degradation. Bandwidth utilization refers to the proportion of bandwidth actually used by the network to its theoretical maximum bandwidth, usually expressed as a percentage (%). It is a key indicator for evaluating whether network resources are being used efficiently.

[0043] The specific steps for adjusting tunnel and / or encryption levels based on tunnel health scores determined by tunnel characteristics can be as follows: Figure 3 As shown, it includes: In S301, at least one of the following parameters for data transmission based on the encryption level is obtained: latency parameter, packet loss rate, and bandwidth utilization rate.

[0044] Based on the determined encryption level, including the traffic determined by encryption algorithms such as AES-256, SM4, or AES-128, the traffic transmission parameters are statistically analyzed. This is because different encryption levels have different computational complexities, which may lead to anomalies in metrics such as latency and packet loss.

[0045] In S302, at least one of the latency parameter, packet loss rate, and bandwidth utilization rate is normalized to obtain normalized data.

[0046] To eliminate the dimensional differences between different indicators, the raw data is converted into standardized values ​​within a uniform range, thus facilitating model input.

[0047] Normalization methods can include minimum-maximum normalization and Z-score normalization. If we collect three metrics: latency, packet loss rate, and bandwidth utilization, and normalize the original latency of 200ms to 0.6, the original packet loss rate of 3% to 0.7, and the bandwidth utilization of 58% to 0.4, then a set of normalized values ​​would be [0.6, 0.7, 0.4].

[0048] In S303, normalized data is input into the pre-trained second network model to predict and output the tunnel health score corresponding to the tunnel features.

[0049] The second network model can include neural network models such as LTSM, or it can be an AI model. Inputting normalized data into the pre-trained second network model can predict the tunnel health score corresponding to the tunnel feature. This tunnel health score can be the tunnel health score at the current moment or the tunnel health score for a predetermined future time period, thus enabling more timely adjustments to abnormal communication states.

[0050] In S304, isolation adjustments are made based on the tunnel health score.

[0051] When adjusting isolation based on tunnel health scores, it may include encryption level adjustments and / or tunnel switching adjustments.

[0052] For example, when adjusting the encryption level, the current encryption level can be maintained when the tunnel health score is greater than or equal to a predetermined security threshold; the encryption level can be reduced when the tunnel health score is less than the security threshold but greater than or equal to a predetermined danger threshold; and the tunnel can be switched to a different tunnel for traffic through dynamic routing when the tunnel health score is less than the danger threshold. The security threshold is greater than the danger threshold.

[0053] For example, when the tunnel health score is greater than or equal to a security threshold, such as 80, the current encryption level and tunnel configuration are maintained without intervention. When the tunnel health score is less than the security threshold of 80 but greater than or equal to the danger threshold of 69, mild adjustments are triggered, such as lowering the encryption level to reduce computational overhead. When the tunnel health score is less than the danger threshold of 69, emergency measures are triggered, such as switching to a backup tunnel or temporarily blocking traffic. Through these methods, the system can effectively adapt to different abnormal situations, and by using different handling methods corresponding to different tunnel health scores, the tunnel can make tiered decisions to balance security and availability, achieving tunnel self-healing.

[0054] In addition, the tunnel features in this application embodiment may also include traffic bandwidth, protocol distribution and access timing. The network model, including a first network model or a second network model, or a pre-set third network model, is used to detect whether there are any abnormalities in the data. When there are abnormalities in the data, tunnel reconstruction or traffic blocking can be triggered to prevent malicious traffic infiltration and ensure tunnel security.

[0055] In addition, the embodiments of this application may include a tenant tunnel initialization process before traffic monitoring, such as... Figure 4 As shown, the process includes: In S401, the tenant ID is extracted, which includes the VLAN tag and / or IP prefix.

[0056] Information identifying tenants can be extracted from tenant traffic, including VLAN tags (Virtual Local Area Network identifiers) or IP prefixes (IP address ranges). Tenant identification can be quickly achieved through VLAN tags or IP ranges, providing a basis for subsequent isolation and resource allocation.

[0057] In S402, an independent transmission tunnel is allocated to the traffic of the tenant ID according to the preset correspondence between the tenant ID and the independent transmission tunnel.

[0058] Based on the preset tenant ID and tunnel mapping relationship, allocate an independent VXLAN tunnel (or other virtual channel) to the tenant. Ensure that the traffic of different tenants is logically completely isolated to avoid mutual interference or attacks.

[0059] After allocating an independent transmission tunnel to the tenant ID, this embodiment of the application can further perform permission verification and execute a verification method of never trusting and continuous verification to improve the security of data transmission.

[0060] In S403, permission verification is performed on tenants accessing the VPN network through device certificate verification and two-way authentication.

[0061] It can verify the X.509 digital certificate of the tenant device (including verifying the validity of the certificate and whether it was issued by a trusted CA). It can achieve two-way authentication between the tenant device and the VPN server through the EAP-TLS protocol (the tenant device verifies the server, and the server also verifies the tenant device), effectively preventing unauthorized devices from accessing the VPN network and ensuring the trustworthiness of both communicating parties.

[0062] In S404, after the permission verification is passed, the tenant is allowed to access the VPN network.

[0063] Tenant devices are only allowed to access the VPN network after both the certificate and two-way authentication are passed, following the "zero trust" principle, where only verified tenants can access resources.

[0064] After allowing the tenant to access the VPN network, the method may further include the following steps for traffic anomaly detection, in order to detect traffic anomalies in a timely manner and reduce the risk of tenant devices being subjected to lateral movement.

[0065] In S405, the basic traffic behavior data of the tenant is obtained, which includes at least one of traffic bandwidth, protocol distribution and access timing.

[0066] Collect historical traffic data from tenants, including bandwidth (traffic volume), protocol distribution (such as HTTP, video stream share), and access timing (request frequency, time pattern), to establish basic data on normal tenant behavior for subsequent anomaly detection.

[0067] In S406, the real-time traffic of the tenant is obtained, and the real-time traffic is compared with the traffic behavior basic data to determine whether there is any abnormality in the real-time traffic.

[0068] Compare current traffic with baseline data to detect deviations from normal patterns (such as sudden bandwidth surges or access outside of working hours) in order to identify potential attacks (such as DDoS attacks) or internal violations.

[0069] In S407, when the real-time traffic is abnormal, the tenant's traffic is blocked or the reconstruction of the transmission tunnel for communication with the tenant is triggered.

[0070] Traffic blocking can directly sever abnormal connections and prevent the spread of attacks; tunnel reconstruction includes switching to a backup tunnel to avoid contamination of the main tunnel, enabling rapid response to anomalies and ensuring network security and business continuity.

[0071] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0072] Figure 5 This is a schematic diagram of a VPN network communication device provided in an embodiment of this application. The device includes: Traffic feature acquisition unit 501 is used to acquire the traffic features of tenants in the VPN network.

[0073] The business sensitivity type determination unit 502 is used to calculate the business sensitivity type corresponding to the traffic characteristics through a preset first network model.

[0074] The encryption unit 503 is used to determine the encryption level matching the business sensitivity type corresponding to the traffic feature according to the pre-set correspondence between business sensitivity type and encryption level, and to encrypt the communication data according to the encryption level.

[0075] The adjustment unit 504 is used to acquire tunnel features based on the encryption level, predict the tunnel health score corresponding to the tunnel features through a preset second network model, and adjust the tunnel and / or encryption level through the tunnel health score.

[0076] Figure 5 The VPN network communication device shown is related to... Figure 2 The VPN network communication method shown corresponds to this.

[0077] Figure 6 This is a schematic diagram of a VPN network communication device provided in an embodiment of this application. Figure 6 As shown, the VPN network communication device 6 of this embodiment includes: a processor 60, a memory 61, and a computer program 62, such as a VPN network communication program, stored in the memory 61 and executable on the processor 60. When the processor 60 executes the computer program 62, it implements the steps in the various VPN network communication method embodiments described above. Alternatively, when the processor 60 executes the computer program 62, it implements the functions of each module / unit in the various device embodiments described above.

[0078] For example, the computer program 62 may be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 62 in the VPN network communication device 6.

[0079] The VPN network communication device 6 can be a desktop computer, laptop, handheld computer, or cloud server, etc. The VPN network communication device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will understand that... Figure 6 This is merely an example of a VPN network communication device 6 and does not constitute a limitation on the VPN network communication device 6. It may include more or fewer components than shown, or combine certain components, or different components. For example, the VPN network communication device may also include input / output devices, network access devices, buses, etc.

[0080] The processor 60 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0081] The memory 61 can be an internal storage unit of the VPN network communication device 6, such as a hard drive or memory of the VPN network communication device 6. The memory 61 can also be an external storage device of the VPN network communication device 6, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the VPN network communication device 6. Furthermore, the memory 61 can include both internal and external storage units of the VPN network communication device 6. The memory 61 is used to store the computer program and other programs and data required by the VPN network communication device. The memory 61 can also be used to temporarily store data that has been output or will be output.

[0082] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0083] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0084] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0085] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0086] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0088] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by hardware related to computer program instructions. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0089] In addition, this application also provides a computer program product that, when run on a computer, causes the computer to execute the methods in the above-described implementations.

[0090] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method of communicating in a VPN network, characterized by, The method comprises: acquiring traffic characteristics of tenants in the VPN network; calculating the service sensitivity type corresponding to the traffic characteristics through a preset first network model; determining the encryption level matched with the service sensitivity type corresponding to the traffic characteristics according to the preset correspondence between the service sensitivity type and the encryption level, and encrypting the communication data according to the encryption level; acquiring tunnel characteristics based on the encryption level, predicting the tunnel health score corresponding to the tunnel characteristics through a preset second network model, and adjusting the tunnel and / or encryption level through the tunnel health score.

2. The method of claim 1, wherein, Adjusting the path and / or encryption level through the tunnel health score comprises: maintaining the current encryption level when the tunnel health score is greater than or equal to a predetermined safety threshold; decreasing the encryption level when the tunnel health score is less than the safety threshold and greater than or equal to a predetermined danger threshold; switching the traffic through dynamic routing when the tunnel health score is less than the danger threshold; wherein the safety threshold is greater than the danger threshold.

3. The method of claim 1, wherein, The service sensitivity type comprises a first service type, a second service type and a third service type, the sensitivity of the first service type is higher than that of the second service type, and the sensitivity of the second service type is higher than that of the third service type; determining the encryption level matched with the service sensitivity type corresponding to the traffic characteristics according to the preset correspondence between the service sensitivity type and the encryption level comprises: determining that the first encryption level is matched with the service sensitivity type corresponding to the traffic characteristics when the service sensitivity type is the first service type; determining that the second encryption level is matched with the service sensitivity type corresponding to the traffic characteristics when the service sensitivity type is the second service type; determining that the third encryption level is matched with the service sensitivity type corresponding to the traffic characteristics when the service sensitivity type is the third service type; wherein the security of the first encryption level is higher than that of the second encryption level, and the security of the second encryption level is higher than that of the third encryption level.

4. The method of claim 1, wherein, Acquiring tunnel characteristics based on the encryption level, predicting the tunnel health score corresponding to the tunnel characteristics through a preset second network model comprises: acquiring at least one of the delay parameter, the packet loss rate and the bandwidth utilization rate of data transmission based on the encryption level; normalizing at least one of the delay parameter, the packet loss rate and the bandwidth utilization rate to obtain normalized data; inputting the normalized data into the second network model which has been pre-trained to predict and output the tunnel health score corresponding to the tunnel characteristics.

5. The method of claim 1, wherein, Before adjusting the tunnel and / or encryption level through the tunnel health score, the method further comprises: extracting a tenant ID, the tenant ID comprising a VLAN label and / or an IP prefix; allocating an independent transmission tunnel for the traffic of the tenant ID according to the preset correspondence between the tenant ID and the independent transmission tunnel.

6. The method of claim 5, wherein, After allocating the independent transmission tunnel for the traffic of the tenant ID, the method further comprises: The tenant accessing the VPN network is checked for permission through device certificate verification and two-way authentication; After the permission check is passed, the tenant is allowed to access the VPN network.

7. The method of claim 6, wherein, After allowing the tenant to access the VPN network, the method further comprises: Obtaining traffic behavior basic data of the tenant, the traffic behavior basic data including at least one of traffic bandwidth, protocol distribution, and access timing; Obtaining real-time traffic of the tenant, comparing the real-time traffic with the traffic behavior basic data, and determining whether the real-time traffic is abnormal; When the real-time traffic is abnormal, blocking the traffic of the tenant or triggering the reconstruction of a transmission tunnel for communication with the tenant.

8. A VPN network communication device, characterized by, The device comprises: a traffic feature acquisition unit configured to acquire traffic features of a tenant in the VPN network; a service sensitivity type determination unit configured to calculate a service sensitivity type corresponding to the traffic features through a preset first network model; an encryption unit configured to determine an encryption level matched with the service sensitivity type corresponding to the traffic features according to a preset correspondence between service sensitivity types and encryption levels, and encrypt communication data according to the encryption level; an adjustment unit configured to acquire tunnel features based on the encryption level, predict a tunnel health score corresponding to the tunnel features through a preset second network model, and adjust the tunnel and / or the encryption level according to the tunnel health score.

9. A VPN network communication device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program, so that the VPN network communication device implements the method of any one of claims 1-7.

10. A computer program product comprising computer program instructions, characterised in that, The computer program is run, so that the method of any one of claims 1-7 is executed.

Images