Communication method and device, communication equipment, storage medium and computer program product

Abstract

The invention relates to a communication method and device, communication equipment, a storage medium and a computer program product. The method comprises the following steps: receiving a tunnel establishment request sent by a remote terminal; the tunnel establishment request comprises a user datagram protocol port of the security gateway; determining a server instance key corresponding to a user datagram protocol port of the security gateway, and generating a request response message according to the server instance key; sending a request response message to the far-end terminal, and establishing a secure communication tunnel with the far-end terminal; and the secure communication tunnel is used for transmitting an uplink ciphertext encrypted based on a server instance key shared by the internet equipment and the remote terminal. By adopting the method, the security of the communication method can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of wireless communication and terminal, and particularly relates to a communication method and device, a communication equipment, a storage medium and a computer program product. BACKGROUND

[0002] At present, a multi-hop networking technology based on a Wi-Fi Direct (Wireless Fidelity) protocol realizes D2D (Device-to-Device Communication) multi-hop online and data transmission from a terminal to the Internet by proxying data at an application layer.

[0003] In the prior art, a remote terminal encrypts an original Internet Protocol (IP) message to obtain uplink ciphertext, and transmits the uplink ciphertext to a relay terminal. The relay terminal decrypts the uplink ciphertext and processes the parsed original IP message. Then, the relay terminal encrypts the processed original IP message and sends the encrypted uplink ciphertext to the Internet, thereby realizing data transmission from the remote terminal to the Internet.

[0004] However, in the prior art, since the relay terminal can decrypt the uplink ciphertext, the network access behavior and privacy-sensitive data of a user in the original IP message can be snooped. Therefore, the security of the current communication method is low. SUMMARY

[0005] Embodiments of the present application provide a communication method, device, equipment, storage medium and computer program product, which improve the security of the communication method.

[0006] A communication method, applied to an Internet equipment, comprises the following steps.

[0007] Receiving a tunnel establishment request sent by a remote terminal, wherein the tunnel establishment request contains a user datagram protocol (UDP) port of a security gateway;

[0008] Determining a server instance key corresponding to the UDP port of the security gateway, and generating a request response message according to the server instance key;

[0009] Sending the request response message to the remote terminal, and establishing a secure communication tunnel with the remote terminal, wherein the secure communication tunnel is used to transmit uplink ciphertext encrypted based on a server instance key shared by the Internet equipment and the remote terminal.

[0010] In one embodiment, the determination of the server instance key corresponding to the UDP port of the security gateway comprises the following steps.

[0011] decrypting the tunnel establishment request according to the preset public key to obtain the user datagram protocol port of the security gateway;

[0012] In the case where the tunnel establishment request is verified, determining the simulated virtual private network (VPN) server instance corresponding to the user datagram protocol port of the security gateway and the server instance key corresponding to the simulated VPN server instance.

[0013] In one embodiment, the tunnel establishment request includes a source Internet protocol address and a source user datagram protocol port, and the decrypting the tunnel establishment request according to the preset public key to obtain the user datagram protocol port of the security gateway includes:

[0014] According to the source Internet protocol address and the source user datagram protocol port, determining whether the security communication tunnel corresponding to the remote terminal has been registered;

[0015] In the case where the security communication tunnel is not registered, parsing the second ciphertext in the tunnel establishment request according to the preset public key to obtain the user datagram protocol port of the security gateway.

[0016] In one embodiment, the tunnel establishment request further includes a first ciphertext, a tunnel identifier and a user identifier, and after the decrypting the tunnel establishment request according to the preset public key to obtain the user datagram protocol port of the security gateway, the method further includes:

[0017] According to the user identifier, obtaining a user-level key, and decrypting the first ciphertext according to the user-level key to obtain a message type and a tunnel identifier;

[0018] According to the message type and the tunnel identifier, verifying the legality of the tunnel establishment request to obtain a verification result.

[0019] In one embodiment, after the decrypting the tunnel establishment request according to the preset public key to obtain the user datagram protocol port of the security gateway, the method further includes:

[0020] In the case where the verification result is a verification failure, constructing a request response message according to a message type, a tunnel identifier, failure reason information and a public key of a tunnel establishment failure response;

[0021] Based on the source Internet protocol address and the source user datagram protocol port, determining a relay terminal;

[0022] The relay terminal returns the request response message to the remote terminal, and deletes the association relationship of the tunnel identifier, the source Internet protocol address and the source user datagram protocol port.

[0023] In one of the embodiments, the generating the request response message according to the server instance key comprises:

[0024] constructing a success message according to the message type of the tunnel establishment success response, the tunnel identifier, the server instance key and the user datagram protocol port of the security gateway;

[0025] encrypting the success message according to the user level key to obtain success ciphertext;

[0026] generating the request response message according to the message type of the tunnel establishment success response, the tunnel identifier and the success ciphertext.

[0027] In one of the embodiments, the sending the request response message to the remote terminal comprises:

[0028] determining a relay terminal forwarding the tunnel establishment request, and starting an emulated VPN server instance and an emulated VPN client instance according to the user datagram protocol port of the security gateway;

[0029] establishing a mapping relationship of an Internet protocol address of the relay terminal, a user datagram protocol port of the relay terminal, the emulated VPN server instance and the emulated VPN client instance, and sending a request response message to the remote terminal through the relay terminal.

[0030] In one of the embodiments, after the establishing the secure communication tunnel with the remote terminal, the method further comprises:

[0031] receiving uplink ciphertext sent by the remote terminal; the uplink ciphertext carries a source Internet protocol address and a source user datagram protocol port of a relay terminal;

[0032] determining an emulated VPN server instance and a server instance key corresponding to the emulated VPN server instance based on the source Internet protocol address and the source user datagram protocol port;

[0033] decrypting the uplink ciphertext through the emulated VPN server instance and the server instance key to obtain an original Internet protocol message.

[0034] In one of the embodiments, after the decrypting the uplink ciphertext through the emulated VPN server instance and the server instance key to obtain an original Internet protocol message, the method further comprises:

[0035] determining a return Internet protocol address message corresponding to the original Internet protocol message, and encrypting the return Internet protocol address message through the simulated VPN server instance and the server instance key to obtain a downlink ciphertext;

[0036] determining a relay terminal according to the source Internet protocol address and the source user datagram protocol port, and returning the downlink ciphertext to the remote terminal through the relay terminal.

[0037] A communication method, applied to a remote terminal, the method comprising:

[0038] constructing a tunnel establishment request according to a user datagram protocol port of a security gateway, and sending the tunnel establishment request to an Internet device;

[0039] receiving a request response message corresponding to the tunnel establishment request;

[0040] if the request response message carries a server instance key, encrypting an original Internet protocol message according to the server instance key to obtain an uplink ciphertext, and sending the uplink ciphertext to the Internet device.

[0041] In one embodiment, the step of constructing a tunnel establishment request according to a user datagram protocol port of a security gateway comprises:

[0042] constructing a tunnel identifier of a secure communication tunnel according to a message type of the establishment request, a security gateway domain name, a user datagram protocol port of the security gateway, a user identifier, a user-level key and a timestamp, and splicing the tunnel identifier and the message type to obtain a first spliced message;

[0043] encrypting the first spliced message based on the user-level key to obtain a first ciphertext;

[0044] splicing the user identifier, the first ciphertext, the tunnel identifier, the security gateway domain name, a user datagram protocol authentication port of the security gateway and an identifier of the remote terminal to obtain a second message, and encrypting the second message based on a public key to obtain a second ciphertext;

[0045] constructing a tunnel establishment request of a secure communication tunnel based on the second ciphertext and the message type.

[0046] In one embodiment, the request response message contains a message type, and after receiving the request response message corresponding to the tunnel establishment request, the method further comprises:

[0047] If the message type is a tunnel establishment success response, the request response message is decrypted according to a user-level key to obtain a message type of a tunnel establishment success response, a tunnel identifier, a server instance key, and a user datagram protocol port of a security gateway;

[0048] The virtual private network client is started, and a secure communication tunnel with the Internet device is established according to the server instance key;

[0049] If the message type is a tunnel establishment failure response, the request response message is decrypted according to a public key to obtain a message type of a tunnel establishment failure response, a tunnel identifier, and failure cause information.

[0050] A communication device, the device is applied to an Internet device, and the device comprises:

[0051] A first receiving module is configured to receive a tunnel establishment request sent by a remote terminal, wherein the tunnel establishment request comprises a user datagram protocol port of a security gateway;

[0052] A determining module is configured to determine a server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message according to the server instance key;

[0053] A sending module is configured to send the request response message to the remote terminal, and establish a secure communication tunnel with the remote terminal, wherein the secure communication tunnel is used to transmit uplink ciphertext encrypted based on a server instance key shared by the Internet device and the remote terminal.

[0054] A communication device, the device is applied to a remote terminal, and the device comprises:

[0055] A constructing module is configured to construct a tunnel establishment request according to a user datagram protocol port of a security gateway, and send the tunnel establishment request to an Internet device;

[0056] A second receiving module is configured to receive a request response message corresponding to the tunnel establishment request;

[0057] An encrypting module is configured to, if the request response message carries a server instance key, encrypt an original Internet protocol message according to the server instance key to obtain uplink ciphertext, and send the uplink ciphertext to the Internet device.

[0058] A communication system, the system comprises:

[0059] A remote terminal is configured to construct a tunnel establishment request, and send the tunnel establishment request to an Internet device;

[0060] The Internet device is configured to receive the tunnel establishment request sent by the remote terminal; the tunnel establishment request includes the User Datagram Protocol (UDP) port of the security gateway; determine the server instance key corresponding to the UDP port of the security gateway, and generate a request-response message based on the server instance key; send the request-response message to the remote terminal, and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared by the Internet device and the remote terminal.

[0061] In one embodiment, the system further includes a relay terminal, which is used to receive a tunnel establishment request sent by the remote terminal, and parse the tunnel establishment request according to a public key to obtain a tunnel identifier, a security gateway domain name, and the user datagram protocol port of the security gateway; the tunnel establishment request includes a source Internet Protocol address and a source user datagram protocol port;

[0062] The tunnel establishment request is forwarded to the Internet device according to the security gateway domain name and the security gateway's UDP port, and the association between the tunnel identifier, the source Internet Protocol address, and the source UDP port is recorded.

[0063] In one embodiment, the relay terminal is further configured to receive a request-response message; the request-response message includes a message type and a tunnel identifier;

[0064] If the message type is a tunnel successful establishment response, then based on the tunnel identifier, the source Internet Protocol address and source User Datagram Protocol (UDP) port are determined, and the request response message is forwarded to the remote terminal through the source Internet Protocol address and the source UDP port.

[0065] If the message type is a tunnel failure establishment response, then the source Internet Protocol address and source User Datagram Protocol (UDP) port are determined according to the tunnel identifier, and the request response message is forwarded to the remote terminal through the source Internet Protocol address and source UDP port.

[0066] Delete the mapping relationship between the source Internet Protocol address, the source User Datagram Protocol port, and the tunnel identifier.

[0067] A communication device includes a transmitter, a processor, and a receiver;

[0068] The receiver is used to receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway;

[0069] The processor is configured to determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key;

[0070] The transmitter is used to send the request-response message to the remote terminal and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

[0071] A communication device includes a transmitter, a processor, and a receiver;

[0072] The transmitter is configured to construct a tunnel establishment request based on the user data packet protocol port of the security gateway, and send the tunnel establishment request to the Internet device.

[0073] The receiver is used to receive the request response message corresponding to the tunnel establishment request;

[0074] The processor is configured to, if the request-response message carries a server instance key, encrypt the original Internet Protocol message according to the server instance key to obtain uplink ciphertext, and send the uplink ciphertext to the Internet device.

[0075] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0076] Receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway;

[0077] Determine the server instance key corresponding to the User Datagram Protocol (UDP) port of the security gateway, and generate a request-response message based on the server instance key;

[0078] The request-response message is sent to the remote terminal, and a secure communication tunnel is established with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

[0079] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0080] Based on the user data packet protocol port of the security gateway, construct a tunnel establishment request and send the tunnel establishment request to the Internet device;

[0081] Receive the request response message corresponding to the tunnel establishment request;

[0082] If the request-response message carries a server instance key, the original Internet Protocol (IP) message is encrypted using the server instance key to obtain uplink ciphertext, and then the uplink ciphertext is sent to the Internet device.

[0083] A computer program product includes a computer program that, when executed by a processor, implements the communication method provided in the embodiments of this application. The method may be:

[0084] Receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway;

[0085] Determine the server instance key corresponding to the User Datagram Protocol (UDP) port of the security gateway, and generate a request-response message based on the server instance key;

[0086] The request-response message is sent to the remote terminal, and a secure communication tunnel is established with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

[0087] A computer program product includes a computer program that, when executed by a processor, implements the communication method provided in the embodiments of this application. The method may be:

[0088] Based on the user data packet protocol port of the security gateway, construct a tunnel establishment request and send the tunnel establishment request to the Internet device;

[0089] Receive the request response message corresponding to the tunnel establishment request;

[0090] If the request-response message carries a server instance key, the original Internet Protocol (IP) message is encrypted using the server instance key to obtain uplink ciphertext, and then the uplink ciphertext is sent to the Internet device.

[0091] The aforementioned communication method, apparatus, communication device, storage medium, and computer program product receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes a User Datagram Protocol (UDP) port of a secure gateway; determine the server instance key corresponding to the UDP port of the secure gateway, and generate a request-response message based on the server instance key; send the request-response message to the remote terminal, and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on a server instance key shared between the Internet device and the remote terminal. By establishing a secure communication tunnel and transmitting uplink ciphertext encrypted only between the remote terminal and the Internet device using the secure communication tunnel, the relay terminal cannot decrypt the encrypted uplink ciphertext, ensuring that the original Internet Protocol (IP) message in the uplink ciphertext is not leaked, thus improving the security of the communication method. Attached Figure Description

[0092] Figure 1 This is a diagram illustrating the application environment of a communication method in one embodiment;

[0093] Figure 2 This is a schematic diagram of data transmission in a conventional technique according to an exemplary embodiment;

[0094] Figure 3 This is a flowchart illustrating a communication method in one embodiment;

[0095] Figure 4 This is a schematic diagram of the process for determining the server instance key in one embodiment;

[0096] Figure 5 This is a flowchart illustrating the process of determining the UDP port of a security gateway in one embodiment;

[0097] Figure 6 This is a flowchart illustrating the process of verifying a tunnel establishment request in one embodiment;

[0098] Figure 7 This is a flowchart illustrating the process of returning a request-response message when the verification fails in one embodiment.

[0099] Figure 8 This is a flowchart illustrating the steps for generating a request-response message in one embodiment, assuming the verification passes.

[0100] Figure 9 This is a flowchart illustrating the steps of sending a request-response message in one embodiment;

[0101] Figure 10 This is a schematic diagram of the process of receiving uplink ciphertext in one embodiment;

[0102] Figure 11This is a flowchart illustrating the process of returning downlink ciphertext in one embodiment;

[0103] Figure 12 This is a flowchart illustrating the communication method in another embodiment;

[0104] Figure 13 This is a schematic diagram of the process of generating a tunnel establishment request in one embodiment;

[0105] Figure 14 This is a flowchart illustrating the process of receiving a response request message in one embodiment;

[0106] Figure 15 Here is a system architecture diagram of a communication system in one embodiment;

[0107] Figure 16 This is a signaling diagram for establishing a secure communication tunnel in one embodiment;

[0108] Figure 17 This is a signaling diagram for communication based on a secure communication tunnel in one embodiment;

[0109] Figure 18 This is a structural block diagram of a communication device in one embodiment;

[0110] Figure 19 This is a structural block diagram of the communication device in another embodiment;

[0111] Figure 20 This is an internal structure diagram of a communication device in one embodiment. Detailed Implementation

[0112] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0113] Figure 1 This is a schematic diagram illustrating an application scenario of a communication method provided in an embodiment of this application. The application scenario for this communication method is a communication system 100. For example... Figure 1 As shown, the communication system 100 includes a remote terminal 110, a relay terminal 120, and an internet device 130. The relay terminal 120 includes a multi-level relay terminal 121 and a single-level relay terminal 122. The internet device 130 is a device connected to the internet, including a security gateway 131 and a D2D (Device-to-Device Communication) management backend 132. The remote terminal 110 and the relay terminal 120 transmit data via the network, and the relay terminal 120 and the internet device 130 also transmit data via the network.

[0114] Remote terminal 110 and relay terminal 120 can be wireless terminals. A wireless terminal can be a device providing voice and / or other service data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core networks via a Radio Access Network (RAN). The wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) or a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device. They exchange voice and / or data with the radio access network. The wireless terminal can also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile, remote station, remote terminal, access terminal, user terminal, user agent, user device, or user equipment (IoT), without limitation herein.

[0115] Currently, multi-hop networking technology based on the Wi-Fi Direct (Wireless Fidelity) protocol enables D2D (Device-to-Device Communication) multi-hop Internet access by proxying data at the application layer, thereby realizing data transmission from the terminal to the Internet.

[0116] In traditional technology, the remote terminal encrypts the original Internet Protocol (IP) address (IP) packet to obtain uplink ciphertext, and transmits the uplink ciphertext to the relay terminal. The relay terminal decrypts the uplink ciphertext and processes the parsed original IP packet. Then, the relay terminal encrypts the processed original IP packet and sends the encrypted uplink ciphertext to the Internet, thus realizing data transmission from the remote terminal to the Internet.

[0117] Specifically, Figure 2 This is a schematic diagram illustrating data transmission in a conventional technique according to an exemplary embodiment. For example... Figure 2 As shown, the remote terminal, multi-level relay terminal, and single-level relay terminal all have D2D APP (Application) installed. D2D APP is used to proxy and forward Internet data at the application layer.

[0118] The D2D app controls remote terminals to wirelessly connect to the multi-level relay terminals' Wi-FiDirect modules in AP mode via the STA (Station, client mode) mode of the local Wi-Fi (Wireless Fidelity) module. The multi-level relay terminals connect wirelessly to the primary relay terminal's Wi-Fi Direct module in AP mode via the STA mode of the local Wi-Fi module. The primary relay terminal connects to internet devices via its own cellular module or Wi-Fi module, thus forming a D2D multi-hop network.

[0119] The D2D APP includes a VPN (Virtual Private Network) client and a VPN server. The local VPN client connects to the upstream VPN server, and the local VPN server connects to the downstream VPN client.

[0120] The D2D app creates a VPN virtual network interface card (NIC) through the operating system's VPN service. The VPN virtual NIC is used to receive traffic from other apps and forward traffic to other apps. Then, the VPN virtual NIC hands over the flowing data to the VPN client for proxy protocol processing and encryption / decryption.

[0121] Traffic from other apps on the remote terminal is routed by the operating system into the VPN virtual network interface card (NIC), which then forwards the traffic to the VPN client. The VPN client performs proxy TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) header replacement on the traffic and encrypts the data content. The processed proxy traffic then enters the local (here, the remote terminal) ordinary Wi-Fi module (STA mode) and is then transmitted wirelessly to the VPN server in the next-hop multi-level relay phone (the VPN server in the multi-level relay phone listens on a TCP or UDP port).

[0122] After the Wi-Fi Direct module (AP mode) of the multi-level relay terminal receives the proxy traffic from the remote terminal, the proxy traffic enters the VPN server in the D2D APP of the local machine (here, the local machine is the multi-level relay terminal). The VPN server decrypts the proxy traffic and replaces the Proxy protocol header to restore the original traffic (original IP packets) of the APP in the remote terminal. The original traffic enters the VPN virtual network card (at this time, privacy and sensitive data have been leaked, such as which websites were visited, when they were visited, and the frequency of visits. Attackers can obtain the above information by capturing and analyzing the data packets of the virtual network card). Then it enters the VPN client and goes through the same processing process as the remote terminal. After the VPN client processes the traffic, it continues to be sent to the next-hop VPN server. At this time, the traffic of other APPs in the relay terminal is processed and sent to the next-hop VPN server (i.e., the VPN server in the first-level relay terminal).

[0123] After receiving proxy traffic from multiple relay terminals, the Wi-Fi Direct module (AP mode) of the primary relay terminal processes the traffic similarly to that of the multiple relay terminals, reconstructing the original traffic of the app. This original traffic then enters the internet device via a cellular module or a regular Wi-Fi module (at this point, hidden data is leaked again, and attackers can analyze the data packets captured by the cellular or regular Wi-Fi network card). Other app traffic from the primary relay terminal itself does not enter the virtual network card but directly enters the internet device via the cellular or regular Wi-Fi module.

[0124] However, in traditional technologies, because relay terminals can decrypt uplink ciphertext, users' network access behavior and privacy-sensitive data in the original Internet Protocol (IP) messages can be spied on. Therefore, current communication methods have relatively low security.

[0125] Furthermore, after receiving the uplink ciphertext from each remote terminal, the internet device allocates virtual IP addresses according to manually set IP address allocation rules to process the uplink ciphertext. However, since manually set IP address allocation rules are fixed, address conflicts are prone to occur, resulting in low processing efficiency of uplink ciphertext and consequently low efficiency of the communication method.

[0126] It should be noted that the beneficial effects or technical problems solved by the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0127] Before introducing specific embodiments of the present invention, the technical terms involved in the present invention will be explained:

[0128] 4G: Fourth Generation Mobile Communication System.

[0129] 5G: 5th Generation Mobile Communication Technology.

[0130] AP: Access Point, wireless access point.

[0131] APP: Application.

[0132] ATG: Air To Ground.

[0133] Base64: An encoding method that uses 64 printable characters to represent binary data.

[0134] CPE: Customer premises equipment.

[0135] D2D: Device-to-Device Communication.

[0136] ID: Identification, identification number.

[0137] IP: Internet Protocol.

[0138] IP Tables: IP Tables is a packet filtering tool in Linux systems used to configure and manage network firewall rules.

[0139] IPv4: Internet Protocol version 4.

[0140] MD5: Message Digest Algorithm 5.

[0141] Socket: A socket is a mechanism for network communication between computers. It provides a standardized interface that allows applications to exchange data over a network.

[0142] SSID: Service Set Identifier (The Service Set Identifier (SSID) is the name used to identify a specific wireless network in a wireless local area network (WLAN).)

[0143] STA: Station, Client Mode. In this mode, the device acts as a client of the wireless network, connecting to an existing Wi-Fi access point (AP).

[0144] TCP: Transmission Control Protocol.

[0145] UDP: User Datagram Protocol.

[0146] VPN: Virtual Private Network.

[0147] Wi-Fi: Wireless Fidelity.

[0148] The technical solutions of this application and how they solve the aforementioned technical problems will be described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0149] In one embodiment, such as Figure 3 As shown, a communication method is provided, which is applied to Figure 1 Taking Internet device 130 (hereinafter referred to as Internet device) as an example, the explanation includes the following steps:

[0150] Step 302: Receive the tunnel establishment request sent by the remote terminal.

[0151] The tunnel establishment request includes the User Datagram Protocol (UDP) port of the security gateway.

[0152] In practice, when a remote terminal needs to transmit data to an internet device, a secure communication tunnel needs to be established between the remote terminal and the internet device to ensure data transmission security. Therefore, the remote terminal sends a tunnel establishment request to the internet device through a relay terminal. The internet device receives the tunnel establishment request sent by the remote terminal.

[0153] Specifically, the internet device contains a security gateway. The security gateway contains instances of virtual VPN servers and instances of virtual VPN clients. Each virtual VPN server instance corresponds to one virtual VPN client instance, and each virtual VPN server instance has a corresponding UDP port (User Datagram Protocol port) and a server instance key. This server instance key exists only within the virtual VPN server instance. The security gateway contains various User Datagram Protocol ports, and each User Datagram Protocol port corresponds to one virtual VPN server instance.

[0154] The remote terminal constructs a tunnel establishment request based on the UDP port of the security gateway. This tunnel establishment request is used to establish a secure communication tunnel between the remote terminal and the internet device. The remote terminal sends the tunnel establishment request to the relay terminal. The relay terminal forwards the tunnel establishment request to the internet device. The internet device receives the tunnel establishment request, decrypts it, and obtains the UDP port of the security gateway.

[0155] Optionally, not only can the remote terminal send a tunnel establishment request to the internet device, but multiple relay terminals within the relay terminal can also send tunnel establishment requests to the internet device. This establishes a secure communication tunnel between the multiple relay terminals and the internet device.

[0156] Step 304: Determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key.

[0157] In practice, the internet device decrypts the tunnel establishment request using the public key to obtain the UDP port of the security gateway. If the tunnel establishment request passes verification, the internet device determines the server instance key based on the UDP port of the security gateway and generates a request-response message for the remote terminal based on the server instance key.

[0158] Specifically, the internet device decrypts the tunnel establishment request using the public key, obtaining the server instance key and user identifier. Then, the internet device verifies the tunnel establishment request using the user identifier. If the tunnel establishment request verification passes, the internet device determines the virtual VPN server instance corresponding to the security gateway's UDP port, and determines the server instance key corresponding to that virtual VPN server instance. The internet device then constructs a request-response message based on the successful tunnel establishment response message, the tunnel identifier, the server instance key, and the security gateway's UDP port.

[0159] Step 306: Send a request-response message to the remote terminal and establish a secure communication tunnel with the remote terminal.

[0160] The secure communication tunnel is used to transmit uplink ciphertext encrypted with a server instance key shared between the Internet device and the remote terminal.

[0161] In practice, the internet device identifies the relay terminal to forward the tunnel establishment request. Then, the internet device sends a request-response message to the remote terminal through the relay terminal and establishes a secure communication tunnel with the remote terminal through the relay terminal.

[0162] Specifically, the internet device determines and starts the simulated VPN server and client instances based on the UDP port of the security gateway. The internet device then identifies the relay terminal to forward the tunnel establishment request, based on the relay terminal's IP address (Internet Protocol address), UDP port, and the mapping relationship between the simulated VPN server and client instances. Next, the internet device sends a request-response message to the remote terminal through the relay terminal, establishing a secure communication tunnel with the remote terminal. After establishing the secure communication tunnel, the remote terminal can encrypt the original IP packet (original Internet Protocol packet) to be sent using the server instance key, obtaining the uplink ciphertext, and then send this uplink ciphertext to the internet device through the secure communication tunnel.

[0163] In the above communication method, by establishing a secure communication tunnel and transmitting uplink ciphertext encrypted only by the server instance key of the remote terminal and the Internet device, the relay terminal cannot decrypt the encrypted uplink ciphertext, thus ensuring that the original Internet Protocol message in the uplink ciphertext is not leaked and improving the security of the communication method.

[0164] In one embodiment, such as Figure 4 As shown, the specific process of determining the server instance key corresponding to the User Datagram Protocol (UDP) port of the security gateway in step 304 may include:

[0165] Step 402: Decrypt the tunnel establishment request using the preset public key to obtain the user datagram protocol port of the security gateway.

[0166] In practice, the Internet device decrypts the tunnel key using a preset public key to obtain the UDP port of the security gateway.

[0167] Specifically, the tunnel establishment request includes the source IP address and source UDP port of the remote terminal. The Internet device uses the source IP address and source UDP port to determine whether the secure communication tunnel corresponding to the current remote terminal has been registered. If the secure communication tunnel is not registered, the Internet device uses its preset public key to decrypt the second ciphertext in the tunnel establishment request to obtain the UDP port and user identifier of the security gateway.

[0168] In an optional embodiment, after obtaining the user identifier, the internet device acquires a user-level key based on the user identifier, and then decrypts the tunnel establishment request again using the user-level key to obtain the tunnel identifier and message type. The internet device then verifies the tunnel establishment request based on the tunnel identifier and message type.

[0169] Step 404: If the tunnel establishment request verification passes, determine the simulated Virtual Private Network (VPN) server instance corresponding to the user datagram protocol port of the security gateway and the server instance key corresponding to the simulated VPN server instance.

[0170] In implementation, upon successful tunnel establishment request verification, the internet device determines the simulated VPN server instance and simulated VPN client instance corresponding to the UDP port of the security gateway. Then, the internet device determines the server instance key corresponding to the simulated VPN server instance.

[0171] In this embodiment, the tunnel establishment request is decrypted using a public key, and if the tunnel establishment request passes verification, the server instance key is determined based on the UDP port of the security gateway, thus obtaining the server instance key used for subsequent message encryption, which is convenient for subsequent message encryption.

[0172] In one embodiment, the tunnel establishment request includes the source Internet Protocol address and the source User Datagram Protocol (UDP) port, such as... Figure 5 As shown, the specific processing steps of step 402 may include:

[0173] Step 502: Determine whether the secure communication tunnel corresponding to the remote terminal has been registered based on the source Internet Protocol address and the source User Datagram Protocol port.

[0174] During implementation, the internet device queries the database to check if there is a record of the association between the source IP address and source UDP port of the remote terminal. If the database contains such a record, the internet device determines that the secure communication tunnel of the remote terminal has been registered. If the database does not contain such a record, the internet device determines that the secure communication tunnel of the remote terminal has not been registered.

[0175] In an optional embodiment, if the secure communication tunnel has been registered, the Internet terminal determines that the secure communication tunnel between the remote terminal and the Internet terminal has been established, and performs the following step 1002, which is described in detail below.

[0176] Step 504: If the secure communication tunnel is not registered, the user datagram protocol port of the secure gateway is obtained by resolving the second ciphertext in the tunnel establishment request using the preset public key.

[0177] In practice, if the secure communication tunnel is not registered, the Internet terminal determines that the secure communication tunnel between the remote terminal and the Internet terminal has not yet been established, and obtains the UDP port of the secure gateway by decrypting the second ciphertext in the tunnel establishment request using the public key.

[0178] Specifically, the internet terminal has a pre-configured public key. The tunnel establishment request includes the remote terminal's source IP address, source UDP port, and second ciphertext. If the secure communication tunnel is not registered, the internet terminal determines that a secure communication tunnel with the remote terminal has not yet been established. The internet terminal decrypts the second ciphertext using the public key to obtain the first ciphertext, the secure gateway's UDP port, the tunnel identifier, the user identifier, and the secure gateway's domain name. Then, the internet device establishes the association between the tunnel identifier, source IP address, and source UDP port.

[0179] Optionally, the user identifier can also be replaced with the identifier of the remote terminal, but this application embodiment does not limit this.

[0180] In this embodiment, the source IP address and source UDP port are used to determine whether the remote terminal has established a secure communication tunnel. If the secure communication tunnel has not been established, the UDP port of the security gateway is then determined. This can prevent remote terminals that have already established a secure communication tunnel from establishing duplicate secure communication tunnels, thereby improving the efficiency of establishing secure communication tunnels.

[0181] In one embodiment, after obtaining the user datagram protocol port of the security gateway, it is also necessary to verify the legitimacy of the tunnel establishment request. The tunnel establishment request also includes a first ciphertext, a tunnel identifier, and a user identifier, such as... Figure 6 As shown, after step 402 is executed, the specific processing procedure of this communication method may further include:

[0182] Step 602: Obtain the user-level key based on the user identifier, and decrypt the first ciphertext based on the user-level key to obtain the message type and tunnel identifier.

[0183] In practice, the internet device obtains the user-level key based on the user identifier. Then, the internet device decrypts the first ciphertext using the user-level key to obtain the message type and tunnel identifier.

[0184] Specifically, the internet device includes a security gateway and a D2D management backend. The security gateway's distribution module queries the D2D management backend for the user-level key corresponding to the user identifier. The D2D management backend returns the user-level key to the security gateway's distribution module. The security gateway's distribution module decrypts the first ciphertext using the user-level key to obtain the tunnel identifier and message type. Here, the user identifier is the user ID, the tunnel identifier is the tunnel ID, and the message type is an establishment request.

[0185] In an optional embodiment, the user identifier can also be the identifier of the remote terminal. That is, the Internet terminal obtains the user-level key through the identifier of the remote terminal.

[0186] Step 604: Verify the legality of the tunnel establishment request based on the message type and tunnel identifier, and obtain the verification result.

[0187] In implementation, the Internet device verifies the legitimacy of the tunnel establishment request based on the message type and tunnel identifier, and obtains the verification result of the tunnel establishment request. If the verification result is successful, the Internet device executes step 404 above. If the verification result is unsuccessful, the Internet device executes step 702 below.

[0188] Specifically, the internet device generates a verification tunnel identifier based on the message type, security gateway domain name, security gateway UDP port, user identifier, user-level key, and timestamp. Then, the internet device determines the verification result by comparing the verification tunnel identifier with the tunnel identifier. If the verification tunnel identifier and the tunnel identifier are the same, the internet device determines the verification result as successful. If the verification tunnel identifier and the tunnel identifier are different, the internet device determines the verification result as unsuccessful.

[0189] In this embodiment, the legitimacy of the tunnel establishment request is verified by the message type and tunnel identifier, and the server instance key is determined if the verification passes, thereby improving the security of the secure tunnel establishment process.

[0190] In one embodiment, even if the verification fails, a request-response message still needs to be sent to the remote terminal. The tunnel establishment request also includes a first ciphertext, a tunnel identifier, and a user identifier, such as... Figure 7 As shown, after step 402 is executed, the specific processing procedure of this communication method may further include:

[0191] Step 702: If the verification result is that the verification fails, construct a request response message based on the message type of the tunnel establishment failure response, the tunnel identifier, the failure reason information and the public key.

[0192] The failure reason information describes the reasons for the failure to establish a secure communication tunnel.

[0193] In implementation, the verification result verifies the legitimacy of the tunnel establishment request. A verification failure also indicates a failed tunnel establishment request. In the event of a verification failure, the internet device constructs a failure message based on the message type, tunnel identifier, and failure reason of the tunnel establishment failure response. Then, the internet device encrypts this failure message using the public key to obtain the failure ciphertext, and constructs a request response message based on the failure ciphertext, the message type of the tunnel establishment failure response, and the tunnel identifier. Therefore, the message structure of the request response message is: Message Type (Establishment Failure Response) + Tunnel ID + Ciphertext encrypted using the public key [Message Type (Establishment Failure Response) + Tunnel ID + Failure Reason Description (Failure Reason)]. This request response message is a "Tunnel Establishment Failure Response" message.

[0194] Step 704: Determine the relay terminal based on the source Internet Protocol address and the source User Datagram Protocol port.

[0195] In practice, internet devices determine the relay terminal based on the association between the tunnel identifier, the source IP address of the tunnel establishment request, and the source UDP port.

[0196] Specifically, the internet device includes a security gateway. The distribution module of the security gateway determines the primary relay terminal based on the association between the tunnel identifier, the source IP address of the tunnel establishment request, and the source UDP port.

[0197] Step 706: Return a request-response message to the remote terminal through the relay terminal, and delete the association between the tunnel identifier, the source Internet Protocol address, and the source User Datagram Protocol port.

[0198] In practice, the internet device sends a request-response message to the relay terminal. The relay terminal forwards the request-response message to the remote terminal. Then, the internet device removes the association between the tunnel identifier, source IP address, and source UDP port.

[0199] Specifically, the security gateway's distribution module sends a request-response message to the relay terminal via the original path. The relay terminal then sends a request-response message to the remote terminal. The relay terminal deletes the mapping (association) between the source IP address, source UDP port, and tunnel identifier. Finally, the security gateway's distribution module deletes the mapping (association) between the source IP address, source UDP port, and tunnel identifier.

[0200] In this embodiment, if the verification result is that the verification fails, a request response message is constructed based on the failure reason information, message type, tunnel identifier, and public key, and the request response message is returned to the remote terminal through the relay terminal. This enables the remote terminal to clearly understand the reason for the failure of the secure communication tunnel suggestion, and thus enables the remote terminal to resend the tunnel establishment request based on the failure reason information, thereby improving the success rate of the tunnel establishment request.

[0201] In one embodiment, such as Figure 8 As shown, the specific processing steps for generating the request-response message based on the server instance key in step 304 may include:

[0202] Step 802: Construct a success message based on the message type of the successful tunnel establishment response, the tunnel identifier, the server instance key, and the user datagram protocol port of the security gateway.

[0203] The UDP port of the security gateway is the UDP port of the server instance.

[0204] In practice, the Internet device splices the tunnel to establish a successful response message, which includes the message type, tunnel identifier, server instance key, and UDP port of the security gateway.

[0205] Step 804: Encrypt the success message using the user-level key to obtain the success ciphertext.

[0206] In practice, internet devices encrypt successful messages using user-level keys to obtain successful ciphertext.

[0207] Step 806: Generate a request response message based on the message type, tunnel identifier, and success ciphertext of the tunnel establishment success response.

[0208] In implementation, internet devices concatenate the message type, tunnel identifier, and success ciphertext of the successful tunnel establishment response to obtain a request response message. Therefore, the message structure of the request response message is: Message Type (successful establishment response) + Tunnel ID (tunnel identifier) ​​+ ciphertext encrypted using the remote or relay user-level key [Message Type (successful establishment response) + Tunnel ID + VPN server instance key (server instance key) + VPN server instance UDP port (security gateway UDP port)]. This request response message is a "tunnel establishment failure response" message.

[0209] In this embodiment, the request-response message is constructed by encrypting it with a user-level key, which improves the security of the request-response message. Then, the request-response message is transmitted to establish a secure communication tunnel, which improves the security of establishing a secure communication tunnel.

[0210] In one embodiment, such as Figure 9As shown, the specific processing procedure for sending a request-response message to the remote terminal in step 306 may include:

[0211] Step 902: Determine the relay terminal that forwards the tunnel establishment request, and start the simulated VPN server instance and simulated VPN client instance according to the user datagram protocol port of the security gateway.

[0212] In implementation, the internet device determines the relay terminal to forward the tunnel establishment request. This relay terminal includes primary relay terminals and multi-level relay terminals. The internet device is configured with various simulated VPN server instances and simulated VPN client instances. Within each simulated VPN client instance, the internet device determines the simulated VPN client instance corresponding to the UDP port of the security gateway and starts that simulated VPN client instance. Then, within each simulated VPN server instance, the internet device determines the simulated VPN server instance corresponding to the UDP port of the security gateway and starts that simulated VPN server instance.

[0213] Step 904: Establish the mapping relationship between the relay terminal's Internet Protocol address, the relay terminal's User Datagram Protocol port, the simulated VPN server instance, and the simulated VPN client instance, and send request and response messages to the remote terminal through the relay terminal.

[0214] The relay terminal includes a primary relay terminal and a multi-level relay terminal.

[0215] In implementation, the internet device establishes a mapping relationship between the relay terminal's IP address, UDP port, simulated VPN server instance, and simulated VPN client instance. This allows the downstream encrypted data, processed by the simulated VPN server instance, to be directly transmitted to the relay terminal during subsequent application data transmission, thus sending the downstream encrypted data to the remote terminal. Then, the internet device sends request / response messages to the remote terminal through the relay terminal.

[0216] Specifically, the internet device establishes a mapping relationship between the IP address of the primary relay terminal, the UDP port of the primary relay terminal, the simulated VPN server instance, and the simulated VPN client instance. Then, the internet device sends a request-response message to the primary relay terminal. If the message type of the request-response message is a tunnel establishment success response, the primary relay terminal, based on the previously recorded relationship between the tunnel ID (tunnel identifier) ​​and the source IP + source UDP port, returns a request-response message along the same path to the multi-level relay terminals or the remote terminal.

[0217] In this embodiment, by starting a simulated VPN server instance and a simulated VPN client instance, it is convenient to forward the uplink packets of the remote terminal to the Internet through the simulated VPN server instance and the simulated VPN client instance. Furthermore, by establishing a mapping relationship between the relay terminal's IP address, the relay terminal's UDP port, the simulated VPN server instance, and the simulated VPN client instance, it is possible to verify whether a secure communication tunnel has been established when sending feedback request and response packets and confirming that a secure communication tunnel has been established for the remote terminal.

[0218] In one embodiment, after establishing a secure communication tunnel, it becomes possible to receive and process uplink ciphertext sent by a remote terminal. For example... Figure 10 As shown, after step 306 is executed, the specific processing procedure of this communication method may further include:

[0219] Step 1002: Receive the uplink ciphertext sent by the remote terminal.

[0220] The uplink ciphertext carries the source Internet Protocol address and source User Datagram Protocol port of the relay terminal.

[0221] In implementation, after establishing a secure communication tunnel, the remote terminal can encrypt the original IP packet using the server instance key and send the encrypted uplink ciphertext to the internet device through the secure communication tunnel. The internet device receives the uplink ciphertext sent by the remote terminal. This uplink ciphertext contains the source IP and source UDP port of the relay terminal. Based on this source IP and source UDP port, the simulated VPN server instance processing the uplink ciphertext can be identified, and the corresponding downlink ciphertext can be returned.

[0222] Specifically, after establishing a secure communication tunnel, the remote terminal encrypts the original IP packet containing application data using the server instance key, obtaining the uplink ciphertext. The remote terminal then sends the uplink ciphertext to the relay terminal. The relay terminal receives the uplink ciphertext, adds its source IP address and source UDP port to it, and transmits the updated uplink ciphertext to the internet terminal. The internet device receives the updated uplink ciphertext. Therefore, the uplink ciphertext carries the relay terminal's source IP address and source UDP port.

[0223] In one exemplary embodiment, the Internet device includes a security gateway. After establishing a secure communication tunnel, the remote terminal encrypts the original IP packet containing upper-layer application data according to the server instance, obtaining uplink ciphertext. Then, the VPN client in the remote terminal sends the uplink ciphertext to its local forwarding module (simulating a VPN server), i.e., to the same port of the VPN server instance, thereby sending the uplink ciphertext to the multi-level relay terminals. The multi-level relay terminals forward the uplink ciphertext to the first-level relay terminal using the source IP and / or source UDP port used when the secure communication tunnel was created. The first-level relay terminal receives the uplink ciphertext and adds its source IP and source UDP port to it. The forwarding module of the first-level relay terminal then sends the updated uplink ciphertext to the distribution module of the security gateway using the source IP and source port used when the secure communication tunnel was created. The security gateway receives the uplink ciphertext.

[0224] Step 1004: Based on the source Internet Protocol address and source User Datagram Protocol port, determine the simulated VPN server instance and the server instance key corresponding to the simulated VPN server instance.

[0225] In implementation, the internet device contains associations between source IP addresses, source UDP ports, and simulated VPN server instances. Based on the source IP addresses and source UDP ports in the packets, the internet device determines the associated simulated VPN server instance. Then, the internet device determines the server instance key corresponding to the simulated VPN server instance.

[0226] Specifically, the internet device includes a security gateway. The security gateway contains the source IP address and source UDP port of each relay terminal, as well as the relationships between each simulated VPN server instance and each simulated VPN client instance. Based on these relationships, the distribution module in the security gateway determines the source Internet Protocol address and source User Datagram Protocol (UDP) port, identifies the simulated VPN server instance that processes the uplink ciphertext, and determines the server instance key corresponding to that simulated VPN server instance.

[0227] Step 1006: Decrypt the uplink ciphertext using a simulated VPN server instance and the server instance key to obtain the original Internet Protocol (IP) message.

[0228] In practice, the simulated VPN server instance in the Internet device decrypts the uplink ciphertext using the server instance key to obtain the original IP packet.

[0229] Specifically, the internet device includes a security gateway. The security gateway's distribution module, based on the source IP and source UDP port of the primary relay terminal registered during the creation of the secure communication tunnel, determines the corresponding simulated VPN client instance and VPN server instance. Then, the security gateway's distribution module uses the simulated VPN client's port to send uplink ciphertext to the simulated VPN server instance on its local machine. The simulated VPN server instance uses a key to decrypt the uplink ciphertext, obtaining the original IP packet. The simulated VPN server instance then routes the original IP packet to the internet.

[0230] In this embodiment, the uplink ciphertext sent by the remote terminal is decrypted using a server key shared only between the Internet device and the remote terminal, and the decrypted original IP packet is transmitted to the Internet, thereby completing the secure transmission of the original IP packet, ensuring that the original IP packet in the uplink ciphertext is not leaked, and improving the security of the communication method.

[0231] In one embodiment, after processing the uplink ciphertext, it is also necessary to return the downlink ciphertext to the remote terminal. For example... Figure 11 As shown, after step 1006 is executed, the specific processing procedure of this communication method may further include:

[0232] Step 1102: Determine the return Internet Protocol address message corresponding to the original Internet Protocol message, and encrypt the return Internet Protocol address message using a simulated VPN server instance and server instance key to obtain the downlink ciphertext.

[0233] In practice, the internet device processes the original IP address packet accordingly to obtain a return IP packet. Then, the internet device encrypts the return IP packet using a simulated VPN server instance and the server instance key to obtain the downlink ciphertext.

[0234] Step 1104: Determine the relay terminal based on the source Internet Protocol address and the source User Datagram Protocol port, and return the downlink ciphertext to the remote terminal through the relay terminal.

[0235] In practice, the internet device identifies the relay terminal based on the source IP address and source UDP port, and sends the downlink ciphertext to the relay terminal. The relay terminal then receives the downlink ciphertext and forwards it to the remote terminal.

[0236] Specifically, internet devices include security gateways. A simulated VPN server instance encrypts the returned IP packets using its own server instance key, forming downlink ciphertext, and sends it to a simulated VPN client instance. The security gateway's distribution module forwards the downlink ciphertext to the registered primary relay terminal based on the source IP and source port. The primary relay terminal's forwarding module forwards the downlink ciphertext to the forwarding modules of multi-level relay terminals or remote terminals based on the registered source IP and source port. The forwarding modules of multi-level relay terminals or remote terminals forward the downlink ciphertext to the VPN client through the simulated VPN server port on their local machine. The VPN client on the remote terminal uses the key to decrypt the packets, obtains the original IP packets, and sends the data back to the upper-layer application through the VPN virtual network interface card.

[0237] In this embodiment, the returned IP packet is encrypted using a server key shared only between the internet device and the remote terminal, and the encrypted downlink ciphertext is transmitted to the remote terminal. This avoids the relay terminal decrypting the downlink ciphertext, thus preventing the leakage of the returned IP packet. Furthermore, secure data interaction between the remote terminal and the internet device is achieved, improving the security of the communication method.

[0238] In one embodiment, such as Figure 12 As shown, a communication method is provided, which is applied to Figure 1 Taking a remote terminal (hereinafter referred to as the remote terminal) as an example, the following steps are included:

[0239] Step 1202: Based on the user data packet protocol port of the security gateway, construct a tunnel establishment request and send the tunnel establishment request to the Internet device.

[0240] In implementation, the remote terminal constructs a tunnel establishment request based on the UDP port of the security gateway. This tunnel establishment request is used to establish a secure communication tunnel between the remote terminal and the internet device. Then, the remote terminal sends the tunnel establishment request to the internet device through a relay terminal.

[0241] Specifically, the remote terminal constructs a first concatenated message based on the UDP port of the security gateway, and encrypts the first concatenated message using a user-level key to obtain the first ciphertext. Then, the remote terminal constructs a tunnel establishment request based on the first ciphertext and sends the tunnel establishment request to the relay terminal, thereby transmitting the ciphertext downlink to the Internet device through the relay terminal.

[0242] In an exemplary embodiment, the remote terminal constructs a tunnel identifier for a secure communication tunnel based on the message type of the establishment request, the security gateway domain name, the user datagram protocol port of the security gateway, the user identifier, the user-level key, and the timestamp. Then, the remote terminal concatenates the tunnel identifier and the message type to obtain a first concatenated message, and encrypts the first concatenated message based on the user-level key to obtain a first ciphertext. The remote terminal concatenates the user identifier, the first ciphertext, the tunnel identifier, the security gateway domain name, the user datagram protocol authentication port of the security gateway, and the remote terminal's identifier to obtain a second message. Then, the remote terminal encrypts the second message based on the public key to obtain a second ciphertext, and constructs a tunnel establishment request for the secure communication tunnel based on the second ciphertext and the message type. Then, the forwarding module of the remote terminal sends the tunnel establishment request to the UDP authentication port listened to by the forwarding module of the first-level relay terminal. The forwarding module of the first-level relay terminal decrypts the message using the public key, extracts the tunnel ID (tunnel identifier), the security gateway domain name, and the UDP port, and forwards the request to the distribution module of the security gateway with that domain name and port. At the same time, the terminal records the relationship between the tunnel ID and the source IP + source UDP port of the tunnel establishment request, which is used for subsequent return packets.

[0243] Step 1204: Receive the request response message corresponding to the tunnel establishment request.

[0244] In implementation, after receiving a tunnel establishment request, the internet device sends a request-response message to the remote terminal, thus informing the remote terminal whether a secure communication tunnel can be successfully established. Therefore, the remote terminal receives the request-response message corresponding to the tunnel establishment request sent by the internet device. Specifically, the remote terminal receives the request-response message through a relay terminal.

[0245] Step 1206: If the request response message carries the server instance key, encrypt the original Internet Protocol message according to the server instance key to obtain the uplink ciphertext, and send the uplink ciphertext to the Internet device.

[0246] In implementation, the remote terminal decrypts the request-response message according to the message type in the request-response message to obtain the decryption result. If the decryption result contains the server instance key, the remote terminal encrypts the original IP message using the server instance key to obtain the uplink ciphertext. Then, the remote terminal sends the uplink ciphertext to the Internet device through the relay terminal, thereby achieving secure transmission of application data.

[0247] In this embodiment, by sending a tunnel establishment request to the Internet device, and upon successful establishment, encrypting the original IP packet based on the server instance key in the request response message, and transmitting the encrypted uplink ciphertext to the Internet device, the original Internet Protocol (IP) packet in the uplink ciphertext is not leaked, thus improving the security of the communication method.

[0248] In one embodiment, such as Figure 13 As shown, the specific processing procedure for constructing a tunnel establishment request based on the user data packet protocol port of the security gateway in step 1102 may include:

[0249] Step 1302: Based on the message type of the establishment request, the security gateway domain name, the user datagram protocol port of the security gateway, the user identifier, the user-level key and the timestamp, construct the tunnel identifier of the secure communication tunnel, and concatenate the tunnel identifier and the message type to obtain the first concatenated message.

[0250] In implementation, the remote terminal has a user-level key configured thereon. The remote terminal concatenates the message type of the establishment request, the security gateway domain name, the security gateway's UDP port, the user identifier, the user-level key, and the timestamp to obtain an initial tunnel identifier concatenated message. Then, the remote terminal encrypts the initial tunnel identifier concatenated message according to a preset message format and encryption algorithm to obtain the tunnel identifier of the secure communication tunnel. This tunnel identifier is the tunnel ID. Finally, the remote terminal concatenates the tunnel identifier and the message type together to obtain the first concatenated message. At this point, the user-level key only exists in the internet device and the remote terminal.

[0251] Specifically, the remote terminal contains the user-level key of the remote terminal. The message format is Base64 (a method of representing binary data based on 64 printable characters), and the encryption algorithm is MD5 (MD5 message digest algorithm, a widely used cryptographic hash function). The remote terminal concatenates the message type of the establishment request, the security gateway domain name, the UDP port of the security gateway, the user identifier, the user-level key, and the timestamp to obtain the initial tunnel identifier concatenated message. Then, the remote terminal encrypts the initial tunnel identifier concatenated message according to the MD5 algorithm and processes the encrypted initial tunnel identifier concatenated message according to the Base64 format to obtain the tunnel identifier. This tunnel identifier can be represented as Tunnel ID = Base64{MD5[Message type (establishment request) + security gateway domain name + UDP port + remote or relay user ID + remote or relay user-level key + timestamp (precision in minutes)]}. The total length of this tunnel identifier is 24 bytes. Then, the remote terminal concatenates the tunnel identifier and the message type together to obtain the first concatenated message.

[0252] In an optional embodiment, the relay terminal includes a primary relay terminal and multiple relay terminals. The multiple relay terminals can also establish secure communication tunnels with internet devices. Specifically, the multiple relay terminals are pre-configured with user-level keys. The multiple relay terminals concatenate the message type of the establishment request, the secure gateway domain name, the secure gateway's UDP port, the user identifier or the terminal identifier of the multiple relay terminals, the user-level key, and a timestamp to obtain an initial tunnel identifier concatenated message. Then, the multiple relay terminals encrypt the initial tunnel identifier concatenated message according to a preset message format and encryption algorithm to obtain the tunnel identifier of the secure communication tunnel. This tunnel identifier is the tunnel ID. Then, the multiple relay terminals concatenate the tunnel identifier and the message type together to obtain the first concatenated message. At this point, the user-level key only exists in the internet device and the multiple relay terminals.

[0253] Optionally, the user identifier can be replaced with the terminal identifier of the remote terminal.

[0254] Step 1304: Encrypt the first concatenated message based on the user-level key to obtain the first ciphertext.

[0255] In practice, the remote terminal encrypts the first concatenated message using the user-level key to obtain the first ciphertext.

[0256] Step 1306: Concatenate the user identifier, the first ciphertext, the tunnel identifier, the security gateway domain name, the user data packet protocol authentication port of the security gateway, and the identifier of the remote terminal to obtain the second message, and encrypt the second message based on the public key to obtain the second ciphertext.

[0257] In practice, the remote terminal obtains a second message from the user identifier, the first ciphertext, the tunnel identifier, the security gateway ciphertext, the UDP port of the security gateway, and the identifier of the remote terminal. Then, the remote terminal encrypts the second message using the public key to obtain the second ciphertext.

[0258] Step 1308: Construct a tunnel establishment request for a secure communication tunnel based on the second ciphertext and message type.

[0259] In implementation, the remote terminal concatenates the second ciphertext and the message type of the establishment message to obtain a tunnel establishment request for secure communication tunnel. This tunnel establishment request is used to establish a secure communication tunnel between the remote terminal and the internet device. The message structure of this tunnel establishment request can be represented as: Message type (establishment request / ) + ciphertext encrypted using a public key [Tunnel ID (tunnel identifier) ​​+ security gateway domain name + security gateway UDP port + remote terminal or relay terminal user ID (user identifier) ​​+ ciphertext encrypted using the remote terminal or relay terminal's user-level key (message type + tunnel ID)].

[0260] In this embodiment, the first concatenated message is encrypted with a user-level key to obtain the first ciphertext. The second concatenated message formed based on the first ciphertext is then encrypted again based on the user identifier to obtain the tunnel establishment request. This improves the security of the tunnel establishment request and thus enhances the security of establishing a secure communication tunnel.

[0261] In one embodiment, after receiving a request-response message, it is necessary to process the request-response message according to its message type. For example... Figure 14 As shown, after step 1204 is executed, the specific processing procedure of this communication method may include:

[0262] Step 1402: If the message type is a tunnel establishment success response, then decrypt the request response message according to the user-level key to obtain the message type, tunnel identifier, server instance key, and user datagram protocol port of the security gateway for the tunnel establishment success response.

[0263] In implementation, if the message type is a tunnel establishment success response, the remote terminal decrypts the request response message using the user-level key to obtain the message type, tunnel identifier (tunnel ID), server instance key, and UDP port of the security gateway for the tunnel establishment success response. The decrypted message type, tunnel identifier (tunnel ID), server instance key, and UDP port of the security gateway constitute the response result.

[0264] Step 1404: Start the Virtual Private Network client and establish a secure communication tunnel with the Internet device based on the server instance key.

[0265] During implementation, the remote terminal verifies the response result. If the verification result is successful, the remote terminal starts the VPN client and establishes a secure communication tunnel with the internet device based on the server instance key.

[0266] Specifically, the remote terminal verifies whether the tunnel identifier and the UDP port of the security gateway in the verification response are correct, and obtains the verification result. If the verification result is successful, the remote terminal starts the VPN client and, based on the server instance, determines that the secure communication tunnel between the remote terminal and the Internet device has been successfully established.

[0267] Step 1406: If the message type is a tunnel establishment failure response, then decrypt the request response message according to the public key to obtain the message type, tunnel identifier and failure reason information of the tunnel establishment failure response.

[0268] In practice, if the message type is a tunnel establishment failure response, the remote terminal decrypts the request response message using the public key to obtain the message type, tunnel identifier, and failure reason information of the tunnel establishment failure response.

[0269] In an optional embodiment, the remote terminal reconstructs the tunnel establishment request based on the failure reason information and sends the tunnel establishment request to the Internet device, thereby re-attempting to establish a secure communication tunnel with the Internet device.

[0270] In this embodiment, the message type in the request response message can determine whether the secure communication tunnel has been successfully established. In the event of failure, the tunnel establishment request can be resubmitted based on the failure reason information, thereby improving the success rate of establishing a secure communication tunnel.

[0271] In one embodiment, a communication system 100 is provided, comprising: a remote terminal 110, configured to construct a tunnel establishment request and send the tunnel establishment request to an Internet device 130; the Internet device 130, configured to receive the tunnel establishment request sent by the remote terminal 110; the tunnel establishment request includes a User Datagram Protocol (UDP) port of a security gateway; determining a server instance key corresponding to the UDP port of the security gateway and generating a request-response message based on the server instance key; sending the request-response message to the remote terminal and establishing a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on a server instance key shared by the Internet device 130 and the remote terminal 110.

[0272] In implementation, the process of constructing and sending a tunnel establishment request by the remote terminal 110 has been described in detail in step 1202 above, and will not be repeated here in this embodiment. Furthermore, the specific processing procedure of the Internet device 130 has been described in detail in steps 302 to 306 above, and will not be repeated here in this embodiment.

[0273] In this embodiment, the remote terminal sends a tunnel establishment request to the Internet device and establishes a secure communication tunnel with the Internet device based on the tunnel establishment request. Then, according to the secure communication tunnel, uplink ciphertext encrypted only by the server instance key between the remote terminal and the Internet device is transmitted, preventing the relay terminal from decrypting the encrypted uplink ciphertext, ensuring that the original Internet Protocol (IP) messages in the uplink ciphertext are not leaked, and improving the security of the communication method.

[0274] In one embodiment, the communication system 100 further includes a relay terminal 120, which is used to receive a tunnel establishment request sent by a remote terminal 110, and parse the tunnel establishment request according to a public key to obtain a tunnel identifier, a security gateway domain name, and a security gateway user datagram protocol port; forward the tunnel establishment request to the Internet device according to the security gateway domain name and the security gateway user datagram protocol port, and record the association between the tunnel identifier, the source Internet Protocol address, and the source user datagram protocol port.

[0275] The tunnel establishment request includes the source Internet Protocol address and the source User Datagram Protocol port.

[0276] In implementation, Internet device 130 includes a security gateway. The security gateway contains a distribution module, instances of virtual VPN clients, and instances of virtual VPN servers. Relay terminal 120 receives a tunnel establishment request from remote terminal 110 and decrypts the request using a public key to obtain the tunnel identifier, security gateway domain name, and UDP port of the security gateway. Furthermore, the tunnel establishment request includes a source IP address and a source UDP address, which are the source IP and source UDP addresses of remote terminal 110. To transmit the request-response message corresponding to the tunnel establishment request, relay terminal 120 needs to record the source of the tunnel establishment request. Therefore, relay terminal 120 records the association between the tunnel identifier, source IP address, and source UDP port based on the security gateway domain name and UDP port. Relay terminal 120 also adds its own source IP and source UDP port to the tunnel establishment request and forwards the updated tunnel establishment request to the security gateway.

[0277] Specifically, relay terminal 120 includes multi-level relay terminals 121 and a primary relay terminal 122. Primary relay terminal 122 receives a tunnel establishment request sent by remote terminal 110 and decrypts the request using a public key to obtain the tunnel identifier, security gateway domain name, and security gateway UDP port. Furthermore, the tunnel establishment request contains a source IP address and a source UDP address, which are the source IP and source UDP addresses of remote terminal 110. To transmit the request-response message corresponding to the tunnel establishment request, primary relay terminal 122 needs to record the source of the tunnel establishment request. Therefore, primary relay terminal 122 records the association between the tunnel identifier, source IP address, and source UDP port based on the security gateway domain name and security gateway UDP port. Furthermore, primary relay terminal 122 adds its own source IP and source UDP port to the tunnel establishment request and forwards the updated tunnel establishment request to the security gateway.

[0278] In an optional embodiment, the multi-level relay terminal 121 can also establish a secure communication connection with the Internet device 130. The primary relay terminal 122 receives the tunnel establishment request sent by the multi-level relay terminal 121 and decrypts the request based on a public key to obtain the tunnel identifier, security gateway domain name, and security gateway UDP port from the tunnel establishment request. Furthermore, the tunnel establishment request includes a source IP address and a source UDP address, which are the source IP and source UDP addresses of the multi-level relay terminal 121. To transmit the request-response message corresponding to the tunnel establishment request, the primary relay terminal 122 needs to record the source of the tunnel establishment request. Therefore, the primary relay terminal 122 records the association between the tunnel identifier, source IP address, and source UDP port based on the security gateway domain name and the security gateway UDP port. Furthermore, the primary relay terminal 122 adds its own source IP and source UDP port to the tunnel establishment request and forwards the updated tunnel establishment request to the security gateway.

[0279] In this embodiment, the relay terminal obtains the tunnel identifier, security gateway domain name, and security gateway UDP port by parsing the tunnel establishment request, and records the association between the tunnel identifier, source IP, and source UDP, which facilitates the subsequent return of request response messages to the remote terminal.

[0280] In one embodiment, relay terminal 120 is further configured to receive request-response messages; if the message type is a tunnel establishment success response, the source Internet Protocol address and source User Datagram Protocol (UDP) port are determined according to the tunnel identifier, and the request-response message is forwarded to remote terminal 110 through the source Internet Protocol address and source UDP port; if the message type is a tunnel establishment failure response, the source Internet Protocol address and source UDP port are determined according to the tunnel identifier, and the request-response message is forwarded to remote terminal 110 through the source Internet Protocol address and source UDP port; and the mapping relationship between the source Internet Protocol address, source UDP, and tunnel identifier is deleted.

[0281] The request-response message includes the message type and tunnel identifier.

[0282] In implementation, relay terminal 120 includes primary relay terminal 122. Primary relay terminal 122 receives request-response messages sent by Internet device 130. These request-response messages contain message type and tunnel identifier. If the message type is a tunnel establishment success response, it indicates that the secure communication tunnel has been successfully established. Primary relay terminal 122 needs to send the request-response message back to relay terminal 120, allowing relay terminal 120 to obtain the server instance key from the request-response message. Therefore, primary relay terminal 122 determines the source IP address and source UDP port corresponding to the tunnel identifier based on the tunnel identifier, and forwards the request-response message to remote terminal 110 based on the source IP address and source UDP port.

[0283] If the message type is a tunnel establishment failure response, it indicates that the secure communication tunnel establishment has failed. The primary relay terminal 122 determines the source IP address and source UDP port of the remote terminal 110 based on the tunnel identifier, and forwards the request response message to the remote terminal 110 using the source IP address and source UDP port. Then, the primary relay terminal 122 deletes the pre-recorded mapping relationship between the IP address, UDP port, and tunnel identifier. This mapping relationship is also an association relationship.

[0284] In this embodiment, when the message type of the request response message is a tunnel failure establishment response, deleting the mapping relationship between the source IP address, source UDP port, and tunnel identifier can save the storage space of the relay terminal and improve resource utilization.

[0285] In one exemplary embodiment, Figure 15 This is a system architecture diagram of a communication system in one embodiment. For example... Figure 15 As shown, this communication system includes mobile terminals as remote terminals, relay terminals as multi-level relay terminals, mobile terminals as single-level relay terminals, and internet devices. The internet devices include a cloud security gateway (referred to as the security gateway), a management backend, and the internet. This internet contains servers for various applications. Each mobile terminal consists of an application layer, an operating system, a VPN virtual network card, and a baseband chip. The application layer includes a D2D app, a forwarding module (containing a simulated VPN server), VPN clients, and other apps. The operating system contains routing tables and IP tables (tools used in the operating system to manage firewall rules). The baseband chip includes a WiFi module and a cellular module; the WiFi module includes a WiFi-Direct module (AP mode) and a regular WiFi module (STA mode). The security gateway includes a distribution module, instances of simulated VPN clients, and instances of simulated VPN servers.

[0286] Compared to existing technologies, this application replaces the original VPN server in the terminal-side D2D APP of the mobile terminal with a forwarding module, responsible for creating a secure tunnel and forwarding the encrypted ciphertext from the VPN client to the next-hop terminal. A new security gateway is built on the cloud side (internet device side), containing a simulated VPN server, forming an end-to-end encryption / decryption closed loop with the VPN client on the terminal side. The original traffic of the terminal-side APP is only decrypted and released at the cloud-side security gateway, and is not decrypted and released on the terminal side, thus ensuring that privacy-sensitive data is not leaked on the terminal side.

[0287] Traffic from other apps on the remote terminal is routed by the operating system into the VPN virtual network interface. The virtual network interface then forwards the traffic to the VPN client. The VPN client encrypts the traffic and adds a UDP header for a secure tunnel. The destination IP of the ciphertext points to a UDP port on the local machine (127.0.0.1, the same port that the cloud-side VPN server listens on). The forwarding module listens on this UDP port, simulating a VPN server to receive ciphertext data packets (uplink ciphertext) generated by the VPN client. The forwarding module then transmits these ciphertext data packets via the wireless link to the forwarding module in the next-hop multi-level relay phone.

[0288] After receiving the encrypted data packet from the remote terminal, the Wi-Fi Direct module (AP mode) of the multi-level relay terminal forwards it to the next-hop forwarding module (i.e., the forwarding module of the first-level relay terminal). At this time, the traffic of other apps in the multi-level intermediate terminals is also encrypted and sent to the next-hop forwarding module (the forwarding module of the first-level relay terminal) in a similar process to that of the remote terminal sending uplink encrypted data.

[0289] After receiving the encrypted data packets (uplink encrypted) from the multi-level relay terminals, the Wi-Fi Direct module (AP mode) of the first-level relay terminal continues to forward them to the distribution UDP port listened to by the distribution module of the cloud-side security gateway.

[0290] After receiving the encrypted data packet, the distribution module of the security gateway distributes the packet to the corresponding simulated VPN client instance based on the tunnel ID (tunnel identifier) ​​in the uplink encrypted packet. The simulated client instance forwards these uplink encrypted packets to the UDP port listened to by the real VPN server instance at 127.0.0.1 (local address). The VPN server instance decrypts the data packet, releasing the original APP traffic (application data) to the Internet to complete access to various Internet applications. The returned data packet enters the VPN server instance, is encrypted, and is returned to other APPs on the client side, thus completing the entire process of end-to-end secure communication.

[0291] In one exemplary embodiment, Figure 16This is a signaling diagram for establishing a secure communication tunnel in one embodiment. For example... Figure 16 As shown, the process of establishing a secure communication tunnel includes:

[0292] Step 1601: Users of primary relay terminals, multi-level relay terminals, and remote terminals use the D2D APP to log in and authenticate, obtaining the public key, their own user-level key, the security gateway access domain name, and the security gateway's UDP port from the D2D management backend.

[0293] Step 1602: The forwarding module in the D2D APP of the multi-level relay terminal or remote terminal constructs a "tunnel establishment request". The "tunnel establishment request" message structure is: Message type (establishment request) + ciphertext encrypted with a public key [tunnel ID + security gateway domain name + UDP port + remote or relay user ID + ciphertext encrypted with the user-level keys of the multi-level relay terminal and remote terminal (message type + tunnel ID)]. The tunnel ID is Base64{MD5[message type (establishment request) + security gateway domain name + UDP port (one per instance) + user ID of the multi-level relay terminal and remote terminal + user-level key of the multi-level relay terminal and remote terminal + timestamp (accuracy in minutes)]}, with a total length of 24 bytes.

[0294] Step 1603: The forwarding module of the multi-level relay terminal or remote terminal sends a "tunnel establishment request" to the UDP authentication port listened to by the forwarding module of the first-level relay terminal.

[0295] In step 1604, the forwarding module of the primary relay terminal uses the public key to decrypt the packet, extract the tunnel ID, security gateway domain name, and UDP port, and forwards the request to the distribution module of the security gateway with that domain name and port. Simultaneously, the primary relay terminal records the relationship between the tunnel ID and the packet's source IP and source UDP port for subsequent response packets. At this point, the packet's source IP and source UDP port are the source IP and source UDP port of the multi-level relay terminal or the remote terminal.

[0296] Step 1605: The distribution module of the security gateway checks whether the source IP and source UDP port of the packet have been registered. If they have been registered, it means that a secure communication tunnel has been created, and the tunnel forwarding process begins; if not registered, the public key is used to decrypt and extract the tunnel ID and user ID from the packet. Simultaneously, the relationship between the tunnel ID and the source IP + source UDP port of the packet is recorded for subsequent return packets. At this point, the source IP + source UDP port of the packet is the source IP + source UDP port of the first-level relay terminal.

[0297] Step 1606: The distribution module of the security gateway queries the D2D management backend for the user-level key corresponding to the user ID.

[0298] Step 1607: The D2D management backend returns the user-level key to the distribution module of the security gateway.

[0299] Step 1608: The distribution module of the security gateway continues to decrypt the message using the user-level key, verifying the legitimacy of the request message based on the message type and tunnel ID. If the verification passes, a "tunnel establishment successful response" is constructed; otherwise, a "tunnel establishment failed response" is constructed. The "tunnel establishment successful response" and "tunnel establishment failed response" are two different types of request and response messages. The "tunnel establishment successful response" message structure = message type (successful response) + tunnel ID + ciphertext encrypted using the user-level key of the multi-level relay terminal or remote terminal [message type (successful response) + tunnel ID + virtual VPN server instance key + virtual VPN server instance UDP port]. The "tunnel establishment failed response" message structure = message type (failed response) + tunnel ID + ciphertext encrypted using the public key [message type (failed response) + tunnel ID + failure reason description].

[0300] Step 1609: Based on the previously recorded relationship between the tunnel ID and the source IP + source UDP port of the primary relay terminal, the distribution module of the security gateway returns a "tunnel establishment successful response" or a "tunnel establishment failed response" to the primary relay terminal along the same path. If the verification is successful, the simulated VPN client instance and virtual VPN server instance corresponding to the user are started, and the source IP + source port relationship of the primary relay terminal is bound. If the verification fails, the mapping relationship between the tunnel ID and the source IP + source UDP port of the primary relay terminal is deleted.

[0301] Step 1610: Based on the previously recorded relationship between the tunnel ID and the source IP + source UDP port of the packet, the primary relay terminal forwards the "tunnel establishment successful response" or "tunnel establishment failed response" to the relay or remote terminal along the original path. If it is a failure response, the mapping relationship between the tunnel ID and the source IP + source UDP port of the packet is deleted. At this time, the source IP and source UDP port of the packet are the source IP and source UDP port of the remote terminal or the multi-level relay terminal.

[0302] Step 1611: If the message type is a tunnel establishment success response, the multi-level relay terminal or remote terminal uses its own user-level key to decrypt the message and verify the response result; if the message type is a tunnel establishment failure response, the public key is used to decrypt the message, obtain the reason for the failure, and terminate the process.

[0303] Step 1612: If the message type is a tunnel establishment success response, the multi-level relay terminal or remote terminal starts the VPN client for subsequent secure tunnel communication.

[0304] In one exemplary embodiment, Figure 17This is a signaling diagram for communication based on a secure communication tunnel in one embodiment. For example... Figure 17 As shown, the process of communication based on a secure communication tunnel includes:

[0305] Step 1701: The VPN client in the D2D APP of the multi-level relay terminal or remote terminal uses the server instance key of the simulated VPN server instance obtained after the tunnel is successfully created to encrypt the original IP packets of other APPs.

[0306] Step 1702: The VPN client in the D2D APP of the multi-level relay terminal or remote terminal sends ciphertext to the forwarding module (simulating VPN server) of the local machine, that is, sends ciphertext to the same port of 127.0.0.1:VPN server instance.

[0307] Step 1703: The forwarding module in the multi-level relay terminal or remote terminal uses the source IP and source port when the tunnel was created to forward the uplink ciphertext to the first-level relay terminal (first-level relay mobile phone).

[0308] Step 1704: The forwarding module of the primary relay phone uses the source IP and source port used during tunnel creation to send uplink ciphertext to the distribution module of the security gateway.

[0309] Step 1705: The distribution module of the security gateway finds the corresponding simulated VPN client instance and simulated VPN server instance based on the source IP and source port of the primary relay registered during tunnel creation. Using the port of the simulated VPN client, it sends uplink ciphertext to the simulated VPN server instance on the local machine, that is, forwards uplink ciphertext to the port of 127.0.0.1:VPN server instance.

[0310] Step 1706: The VPN server instance uses the key to decrypt the uplink ciphertext and obtain the original IP packet.

[0311] Step 1707: The VPN server instance routes the raw IP packets to the Internet.

[0312] Step 1708: The Internet returns an IP packet to the VPN server instance.

[0313] Step 1709: The simulated VPN server instance uses a key to encrypt the returned IP packet, forming a downlink ciphertext, and sends it to the simulated VPN client instance.

[0314] Step 1710: The security gateway distribution module forwards the downlink ciphertext to the primary relay terminal based on the registered source IP and source port.

[0315] Step 1711: The forwarding module of the first-level trunk forwards the downlink ciphertext to the forwarding module of the trunk or remote end according to the registered source IP and source port.

[0316] Step 1712: The forwarding module in the multi-level relay terminal or remote terminal forwards the downlink ciphertext to the VPN client through the simulated VPN server port on the local machine.

[0317] Step 1713: The VPN client in the multi-level relay terminal or remote terminal uses the key to decrypt and obtain the original IP packet. Then, through the VPN virtual network card, it sends the data back to other apps (such as WeChat, Douyin, etc.).

[0318] It should be understood that, although Figures 3-17 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 3-17 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0319] In one embodiment, such as Figure 18 As shown, a communication device 1800 is provided, which is applied to Internet devices, and includes: a first receiving module 1801, a determining module 1802, and a transmitting module 1803, wherein:

[0320] The first receiving module 1801 is used to receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request contains the user datagram protocol port of the security gateway.

[0321] The determination module 1802 is used to determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key.

[0322] The sending module 1803 is used to send request and response messages to the remote terminal and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted with the server instance key shared between the Internet device and the remote terminal.

[0323] In an exemplary embodiment, the determining module 1802 includes a first determining submodule and a first generating submodule. The first determining submodule includes:

[0324] The first decryption submodule is used to decrypt the tunnel establishment request based on the preset public key and obtain the user datagram protocol port of the security gateway.

[0325] The second determination submodule is used to determine the simulated Virtual Private Network (VPN) server instance corresponding to the user datagram protocol port of the security gateway and the server instance key corresponding to the simulated VPN server instance when the tunnel establishment request verification passes.

[0326] In one exemplary embodiment, the tunnel establishment request includes the source Internet Protocol address and the source User Datagram Protocol port, and the first decryption submodule includes:

[0327] The first judgment submodule is used to determine whether the secure communication tunnel corresponding to the remote terminal has been registered based on the source Internet Protocol address and the source User Datagram Protocol port.

[0328] The second decryption submodule is used to obtain the user datagram protocol port of the security gateway by resolving the second ciphertext in the tunnel establishment request based on the preset public key when the secure communication tunnel is not registered.

[0329] In one exemplary embodiment, the tunnel establishment request further includes a first ciphertext, a tunnel identifier, and a user identifier, and the communication device 1800 further includes:

[0330] The first decryption module is used to obtain the user-level key based on the user identifier, and decrypt the first ciphertext based on the user-level key to obtain the message type and tunnel identifier.

[0331] The first verification module is used to verify the legality of the tunnel establishment request based on the message type and tunnel identifier, and obtain the verification result.

[0332] In one exemplary embodiment, the communication device 1800 further includes:

[0333] The second construction module is used to construct a request response message based on the message type, tunnel identifier, failure reason information, and public key of the tunnel establishment failure response if the verification result is a failure.

[0334] The second determination module is used to determine the relay terminal based on the source Internet Protocol address and the source User Datagram Protocol port.

[0335] The deletion module is used to return a request-response message to a remote terminal via a relay terminal, and to delete the association between the tunnel identifier, the source Internet Protocol address, and the source User Datagram Protocol port.

[0336] In one exemplary embodiment, the first generation submodule includes:

[0337] The first construction submodule is used to construct a success message based on the message type of the tunnel establishment success response, the tunnel identifier, the server instance key, and the user datagram protocol port of the security gateway.

[0338] The first encryption submodule is used to encrypt the success message based on the user-level key to obtain the success ciphertext.

[0339] The second generation submodule is used to generate a request response message based on the message type, tunnel identifier, and success ciphertext of the tunnel establishment success response.

[0340] In an exemplary embodiment, the sending module 1803 includes a first sending submodule and a first establishing submodule. The first sending submodule includes:

[0341] The third determination submodule is used to determine the relay terminal that forwards the tunnel establishment request, and to start the simulated VPN server instance and the simulated VPN client instance according to the user datagram protocol port of the security gateway.

[0342] The second submodule is used to establish the mapping relationship between the relay terminal's Internet Protocol address, the relay terminal's User Datagram Protocol port, the simulated VPN server instance, and the simulated VPN client instance, and to send request and response messages to the remote terminal through the relay terminal.

[0343] In one exemplary embodiment, the communication device 1800 further includes:

[0344] The third receiving module is used to receive uplink ciphertext sent by the remote terminal; the uplink ciphertext carries the source Internet Protocol address and source User Datagram Protocol port of the relay terminal.

[0345] The third determination module is used to determine the simulated VPN server instance and the server instance key corresponding to the simulated VPN server instance based on the source Internet Protocol address and the source User Datagram Protocol port.

[0346] The second decryption module is used to decrypt the uplink ciphertext by simulating a VPN server instance and the server instance key to obtain the original Internet Protocol (IP) message.

[0347] In one exemplary embodiment, the communication device 1800 further includes:

[0348] The fourth determination module is used to determine the return Internet Protocol address message corresponding to the original Internet Protocol message, and encrypt the return Internet Protocol address message by simulating a VPN server instance and the server instance key to obtain the downlink ciphertext.

[0349] The fifth determination module is used to determine the relay terminal based on the source Internet Protocol address and the source User Datagram Protocol port, and then return the downlink ciphertext to the remote terminal through the relay terminal.

[0350] In one embodiment, such as Figure 19As shown, a communication device 1900 is provided. This communication device 1800 is applied to a remote terminal and includes: a construction module 1901, a second receiving module 1902, and an encryption module 1903, wherein:

[0351] Module 1901 is used to construct a tunnel establishment request based on the user data packet protocol port of the security gateway and send the tunnel establishment request to the Internet device.

[0352] The second receiving module 1902 is used to receive the request response message corresponding to the tunnel establishment request.

[0353] Encryption module 1903 is used to encrypt the original Internet Protocol (IP) message according to the server instance key if the request response message carries the server instance key, obtain the uplink ciphertext, and send the uplink ciphertext to the Internet device.

[0354] In one exemplary embodiment, the construction module 1901 includes a second construction submodule and a second sending submodule, wherein the second construction submodule includes:

[0355] The third construction submodule is used to construct the tunnel identifier of the secure communication tunnel based on the message type of the establishment request, the security gateway domain name, the user datagram protocol port of the security gateway, the user identifier, the user-level key and the timestamp, and to concatenate the tunnel identifier and the message type to obtain the first concatenated message.

[0356] The second encryption submodule is used to encrypt the first concatenated message based on the user-level key to obtain the first ciphertext.

[0357] The first splicing submodule is used to splice the user identifier, the first ciphertext, the tunnel identifier, the security gateway domain name, the user data packet protocol authentication port of the security gateway, and the identifier of the remote terminal to obtain the second message, and encrypt the second message based on the public key to obtain the second ciphertext.

[0358] The fourth construction submodule is used to construct a tunnel establishment request for a secure communication tunnel based on the second ciphertext and the message type.

[0359] In one exemplary embodiment, the communication device 1900 further includes:

[0360] The third decryption module is used to decrypt the request response message according to the user-level key if the message type is a tunnel establishment success response, to obtain the message type, tunnel identifier, server instance key, and user datagram protocol port of the security gateway for the tunnel establishment success response.

[0361] The module is used to launch the virtual private network client and establish a secure communication tunnel with the Internet device based on the server instance key.

[0362] The fourth decryption module is used to decrypt the request response message according to the public key if the message type is a tunnel establishment failure response, and obtain the message type, tunnel identifier and failure reason information of the tunnel establishment failure response.

[0363] Specific limitations regarding the communication device can be found in the limitations regarding the communication method above, and will not be repeated here. Each module in the aforementioned communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0364] In one embodiment, a communication device is provided, see [link to previous document]. Figure 20 . Figure 20 This is a schematic diagram of the structure of the terminal device provided in an embodiment of the present invention. Figure 20 The terminal device 2000 shown includes at least one processor 2001, a memory 2002, at least one network interface 2004, and a user interface 2003. The various components in the terminal device 2000 are coupled together via a bus system 2005. It is understood that the bus system 2005 is used to implement communication between these components. In addition to a data bus, the bus system 2005 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 1 Various buses are labeled as Bus System 2005. Additionally, embodiments of the present invention also include a transceiver 2006, which may consist of multiple elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium.

[0365] The user interface 2003 may include a display, keyboard, or clicking device (e.g., mouse, trackball, touchpad, or touchscreen).

[0366] It is understood that the memory 2002 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 2002 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0367] In some implementations, memory 2002 stores elements, executable modules or data structures, or subsets thereof, or extended sets thereof: operating system 20021 and application program 20022.

[0368] Operating system 20021 includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. Application program 20022 includes various applications, such as media player and browser, used to implement various application functions. The program implementing the method of the embodiments of the present invention can be included in application program 20022.

[0369] In this embodiment of the invention, by calling the program or instructions stored in memory 2002, specifically the program or instructions stored in application program 20022, the receiver is used to receive a tunnel establishment request sent by the remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway; the processor is used to determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key; the transmitter is used to send the request response message to the remote terminal and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

[0370] The methods disclosed in the above embodiments of the present invention, in part or in all of them, can also be applied to, implemented by, or cooperated with other components (e.g., a transceiver) in the processor 2001. The processor 2001 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by the integrated logic circuitry in the hardware of the processor 2001 or by instructions in software form. The processor 2001 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 2002. Processor 2001 reads the information in memory 2002 and, in conjunction with its hardware, completes the steps of the above method.

[0371] It is understood that the embodiments described in this invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in this application, or combinations thereof.

[0372] For software implementation, the technology described in the embodiments of the present invention can be implemented by modules (e.g., procedures, functions, etc.) that perform the functions described in the embodiments of the present invention. The software code can be stored in memory and executed by processor 2001. The memory can be implemented in processor 2001 or external to processor 2001.

[0373] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0374] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0375] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0376] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0377] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A communication method, characterized in that, The method is applied to an Internet device, and the method includes: Receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway; Determine the server instance key corresponding to the User Datagram Protocol (UDP) port of the security gateway, and generate a request-response message based on the server instance key; The request-response message is sent to the remote terminal, and a secure communication tunnel is established with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

2. The method according to claim 1, characterized in that, The step of determining the server instance key corresponding to the User Datagram Protocol (UDP) port of the security gateway includes: The tunnel establishment request is decrypted using a preset public key to obtain the user datagram protocol port of the security gateway; If the tunnel establishment request verification passes, determine the simulated Virtual Private Network (VPN) server instance corresponding to the User Datagram Protocol (UDP) port of the security gateway and the server instance key corresponding to the simulated VPN server instance.

3. The method according to claim 2, characterized in that, The tunnel establishment request includes a source Internet Protocol (IP) address and a source User Datagram Protocol (UDP) port. The step of decrypting the tunnel establishment request using a preset public key to obtain the UDP port of the security gateway includes: Based on the source Internet Protocol address and the source User Datagram Protocol port, determine whether the secure communication tunnel corresponding to the remote terminal has been registered; If the secure communication tunnel is not registered, the second ciphertext in the tunnel establishment request is parsed using a preset public key to obtain the user datagram protocol port of the secure gateway.

4. The method according to claim 2, characterized in that, The tunnel establishment request also includes a first ciphertext, a tunnel identifier, and a user identifier. After decrypting the tunnel establishment request using a preset public key to obtain the user datagram protocol port of the security gateway, the method further includes: The user-level key is obtained based on the user identifier, and the first ciphertext is decrypted based on the user-level key to obtain the message type and tunnel identifier; The validity of the tunnel establishment request is verified based on the message type and the tunnel identifier, and the verification result is obtained.

5. The method according to claim 2, characterized in that, After decrypting the tunnel establishment request using a preset public key to obtain the user datagram protocol port of the security gateway, the method further includes: If the verification result is that the verification fails, construct a request response message based on the message type of the tunnel establishment failure response, the tunnel identifier, the failure reason information and the public key; The relay terminal is determined based on the source Internet Protocol address and the source User Datagram Protocol port. The relay terminal returns the request response message to the remote terminal and deletes the association between the tunnel identifier, the source Internet Protocol address, and the source User Datagram Protocol port.

6. The method according to claim 1, characterized in that, The step of generating a request-response message based on the server instance key includes: Construct a success message based on the message type of the successful tunnel establishment response, the tunnel identifier, the server instance key, and the user datagram protocol port of the security gateway; The success message is encrypted using the user-level key to obtain the success ciphertext; A request response message is generated based on the message type of the successful tunnel establishment response, the tunnel identifier, and the success ciphertext.

7. The method according to claim 1, characterized in that, Sending the request-response message to the remote terminal includes: Identify the relay terminal that forwards the tunnel establishment request, and start the simulated VPN server instance and simulated VPN client instance according to the User Datagram Protocol port of the security gateway; Establish a mapping relationship between the Internet Protocol address of the relay terminal, the User Datagram Protocol port of the relay terminal, the simulated VPN server instance, and the simulated VPN client instance, and send request-response messages to the remote terminal through the relay terminal.

8. The method according to claim 1, characterized in that, After establishing a secure communication tunnel with the remote terminal, the method further includes: Receive uplink ciphertext sent by the remote terminal; the uplink ciphertext carries the source Internet Protocol address and source User Datagram Protocol port of the relay terminal; Based on the source Internet Protocol address and source User Datagram Protocol port, determine the simulated VPN server instance and the server instance key corresponding to the simulated VPN server instance; The original Internet Protocol (IP) message is obtained by decrypting the uplink ciphertext using the simulated VPN server instance and the server instance key.

9. The method according to claim 8, characterized in that, After decrypting the uplink ciphertext using the simulated VPN server instance and the server instance key to obtain the original Internet Protocol (IP) message, the method further includes: Determine the return Internet Protocol address (IPA) message corresponding to the original Internet Protocol (IP) message, and encrypt the IPA message using the simulated VPN server instance and the server instance key to obtain the downlink ciphertext; Based on the source Internet Protocol address and source User Datagram Protocol port, a relay terminal is determined, and the downlink ciphertext is returned to the remote terminal through the relay terminal.

10. A communication method, characterized in that, The method is applied to a remote terminal, and the method includes: Based on the user data packet protocol port of the security gateway, construct a tunnel establishment request and send the tunnel establishment request to the Internet device; Receive the request response message corresponding to the tunnel establishment request; If the request-response message carries a server instance key, the original Internet Protocol (IP) message is encrypted using the server instance key to obtain uplink ciphertext, and then the uplink ciphertext is sent to the Internet device.

11. The method according to claim 10, characterized in that, The step of constructing a tunnel establishment request based on the user data packet protocol port of the security gateway includes: Based on the message type of the establishment request, the security gateway domain name, the user datagram protocol port of the security gateway, the user identifier, the user-level key and the timestamp, a tunnel identifier for the secure communication tunnel is constructed, and the tunnel identifier and the message type are concatenated to obtain the first concatenated message; The first concatenated message is encrypted using the user-level key to obtain the first ciphertext. The user identifier, the first ciphertext, the tunnel identifier, the security gateway domain name, the user data packet protocol authentication port of the security gateway, and the identifier of the remote terminal are concatenated to obtain the second message, and the second message is encrypted based on the public key to obtain the second ciphertext; A tunnel establishment request is made to construct a secure communication tunnel based on the second ciphertext and the message type.

12. The method according to claim 10, characterized in that, The request-response message includes a message type. After receiving the request-response message corresponding to the tunnel establishment request, the method further includes: If the message type is a tunnel establishment success response, then the request response message is decrypted according to the user-level key to obtain the message type, tunnel identifier, server instance key, and user datagram protocol port of the security gateway for the tunnel establishment success response. Start the virtual private network client and establish a secure communication tunnel with the Internet device based on the server instance key; If the message type is a tunnel establishment failure response, then the request response message is decrypted using the public key to obtain the message type, tunnel identifier, and failure reason information of the tunnel establishment failure response.

13. A communication device, characterized in that, The device is used in Internet devices, and the device includes: The first receiving module is used to receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway; The determination module is used to determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key; The sending module is used to send the request-response message to the remote terminal and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared between the Internet device and the remote terminal.

14. A communication device, characterized in that, The device is used in a remote terminal, and the device includes: The construction module is used to construct a tunnel establishment request based on the user data packet protocol port of the security gateway, and send the tunnel establishment request to the Internet device; The second receiving module is used to receive the request response message corresponding to the tunnel establishment request; An encryption module is used to encrypt the original Internet Protocol (IP) message according to the server instance key if the request-response message carries a server instance key, to obtain uplink ciphertext, and to send the uplink ciphertext to the Internet device.

15. A communication system, characterized in that, The system includes: The remote terminal is used to construct a tunnel establishment request and send the tunnel establishment request to the Internet device. The Internet device is configured to receive the tunnel establishment request sent by the remote terminal; the tunnel establishment request includes the User Datagram Protocol (UDP) port of the security gateway; determine the server instance key corresponding to the UDP port of the security gateway, and generate a request-response message based on the server instance key; send the request-response message to the remote terminal, and establish a secure communication tunnel with the remote terminal; the secure communication tunnel is used to transmit uplink ciphertext encrypted based on the server instance key shared by the Internet device and the remote terminal.

16. The system according to claim 15, characterized in that, The system also includes a relay terminal, which is used to receive a tunnel establishment request sent by the remote terminal, and parse the tunnel establishment request according to the public key to obtain the tunnel identifier, the security gateway domain name, and the user datagram protocol port of the security gateway. The tunnel establishment request includes the source Internet Protocol address and the source User Datagram Protocol port; The tunnel establishment request is forwarded to the Internet device according to the security gateway domain name and the security gateway's UDP port, and the association between the tunnel identifier, the source Internet Protocol address, and the source UDP port is recorded.

17. The system according to claim 16, characterized in that, The relay terminal is also used to receive request-response messages; the request-response message includes a message type and a tunnel identifier; If the message type is a tunnel successful establishment response, then based on the tunnel identifier, the source Internet Protocol address and source User Datagram Protocol (UDP) port are determined, and the request response message is forwarded to the remote terminal through the source Internet Protocol address and the source UDP port. If the message type is a tunnel failure establishment response, then the source Internet Protocol address and source User Datagram Protocol (UDP) port are determined according to the tunnel identifier, and the request response message is forwarded to the remote terminal through the source Internet Protocol address and source UDP port. Delete the mapping relationship between the source Internet Protocol address, the source User Datagram Protocol port, and the tunnel identifier.

18. A communication device, characterized in that, Includes a transmitter, processor, and receiver; The receiver is used to receive a tunnel establishment request sent by a remote terminal; the tunnel establishment request includes the user datagram protocol port of the security gateway; The processor is configured to determine the server instance key corresponding to the user datagram protocol port of the security gateway, and generate a request response message based on the server instance key; The transmitter is used to send the request-response message to the remote terminal and establish a secure communication tunnel with the remote terminal. The secure communication tunnel is used to transmit uplink ciphertext encrypted using a server instance key shared between the Internet device and the remote terminal.

19. A communication device, characterized in that, Includes a transmitter, processor, and receiver; The transmitter is configured to construct a tunnel establishment request based on the user data packet protocol port of the security gateway, and send the tunnel establishment request to the Internet device. The receiver is used to receive the request response message corresponding to the tunnel establishment request; The processor is configured to, if the request-response message carries a server instance key, encrypt the original Internet Protocol message according to the server instance key to obtain uplink ciphertext, and send the uplink ciphertext to the Internet device.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9 or 10 to 12.

21. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 9 or 10 to 12.

Images