A device and method for extending 4G / 5G gateways to Layer 3 and Layer 2 remote networking based on red-black isolation.

Abstract

The application belongs to the technical field of network communication, and relates to a 4G / 5G gateway three-layer extension two-layer remote networking device and method based on red-black isolation. The device is based on a red-black isolation technology route, and a red edge is connected with a double-network port main control board. A special VPDN private network is constructed relying on an operator 4G / 5G basic network. NAT address conversion and MAC-in-UDP encapsulation virtual two-layer tunnel technology are combined. In a network that has established an end-to-end transmission scene, an application server does not need to be deployed in a public network, two-layer transparent encryption transmission of remote business equipment in the same network segment can be realized, broadcast, multicast and unicast data packets can be transparently transmitted without difference, and the device is suitable for business demand users who need remote two-layer networking, replace optical cables and wired network cables for long-distance wireless transparent encryption transmission. The application has high networking flexibility, safe data transmission and low deployment cost, and does not need to modify local area network IP configurations in original systems of business equipment and usage habits of application software, so that remote networking can be realized without awareness.

Description

Technical Field

[0001] This invention belongs to the field of network communication technology and relates to a 4G / 5G gateway three-layer extended two-layer remote networking device and method based on red-black isolation. Background Technology

[0002] Currently, in industries with extremely high requirements for data transmission security and transparency, such as power, energy, transportation, and water conservancy, a large number of remote business devices (such as remote control terminals, unattended sites, and linkage control units) need to rely on communication networks to achieve collaborative operation. Traditional solutions mostly rely on fiber optic leased lines for networking to ensure the normal exchange of Layer 2 protocol messages such as broadcast and multicast within the local area network, thereby supporting the stable operation of upper-layer applications such as remote control and equipment linkage. With the maturity of 4G / 5G wireless communication technology, the industry has begun to try to replace wired optical cables with wireless links to reduce laying costs and improve deployment flexibility. However, commercially available conventional 4G / 5G industrial gateways are all Layer 3 network devices. Their original design is for large-scale routing and forwarding across network segments and subnets, and they naturally have broadcast isolation and multicast filtering mechanisms, which cannot achieve transparent communication between remote devices within the same Layer 2 broadcast domain. If such gateways are directly used for wireless networking, the original protocols of the business system that rely on broadcast discovery and multicast subscription (such as ARP, DHCP, mDNS, PTP, etc.) will become invalid due to message dropping, causing existing application software to malfunction.

[0003] To address the aforementioned issues, existing technologies have proposed deploying dedicated application servers or centralized management platforms over the public internet. These servers receive, deseal, relay, and repackage Layer 2 data packets between different locations, simulating the effect of Layer 2 interconnection. However, this solution has significant shortcomings: Firstly, it requires additional server resources and incurs ongoing maintenance costs, and all business data must traverse public internet nodes, significantly increasing transmission latency and impacting remote control applications with high real-time requirements. Secondly, data relay via public internet servers expands the attack surface, increasing the risk of data theft and traffic hijacking, and is particularly difficult to meet the rigid requirements of classified organizations for data not leaving the domain and for independent control of the link. Furthermore, existing Layer 2 networking technologies often employ standard VXLAN or composite encapsulation protocols combining VXLAN and IPSec, resulting in high encapsulation overhead, complex interaction processes, and incompatibility with the red-black isolation (i.e., physical or logical isolation between security domains and transport domains) mandatory in some industries, making it difficult to implement such networking solutions. In addition, some existing Layer 2 networking solutions require reconfiguration or even customized development of the IP addresses, routing tables or application software of service devices. This not only has a long implementation cycle, but also easily interferes with the normal operation of existing network services, and cannot meet the requirements of seamless networking.

[0004] In view of this, the present invention is hereby proposed. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a 4G / 5G gateway three-layer extension two-layer remote networking device and method based on red-black isolation.

[0006] To achieve the above objectives, the present invention provides the following technical solution: On one hand, the present invention provides a 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation, comprising multiple networking units with identical structures, each of which consists of a 4G / 5G Layer 3 encrypted gateway body and a dual-port main control expansion board; the 4G / 5G Layer 3 encrypted gateway body adopts a red-black isolation architecture, and the dual-port main control expansion board is cascaded on the red side of the 4G / 5G Layer 3 encrypted gateway body and physically isolated from the black side.

[0007] Specifically, the dual-port main control expansion board is equipped with a first physical network card and a second physical network card that are independent of each other.

[0008] Preferably, both the first physical network card and the second physical network card are gigabit-level independent network cards; the first physical network card is connected to the internal network port of the 4G / 5G three-layer encryption gateway body to realize data interaction between the dual-port main control expansion board and the 4G / 5G three-layer encryption gateway body; the second physical network card is used to connect to the service equipment of the remote network to realize physical isolation between the data flow of the networking device and the local area network data flow of the service equipment, avoid data interaction interference, and improve the stability of network transmission.

[0009] Specifically, the 4G / 5G three-layer encryption gateway body is equipped with, The black-border NAT translation module is used to realize SNAT source address translation and DNAT destination address translation in the encrypted network layer, thereby enabling the black-border interface of the 4G / 5G three-layer encrypted gateway to communicate with the external network, providing a foundation for remote network transmission; The VPDN private network construction module relies on the operator's 4G / 5G basic network and uses the VPDN private network SIM card to build a dedicated encrypted VPDN private network, enabling secure interconnection of remote networking devices. The encryption / decryption module is used to encrypt or decrypt the encapsulated Layer 2 data frames. The red-edge NAT translation module is used to realize plaintext network layer SNAT source address translation and DNAT destination address translation, thereby realizing the address mapping between the dual-port main control expansion board and the red-edge side of the 4G / 5G three-layer encryption gateway, providing a foundation for three-layer network transmission.

[0010] Specifically, the dual-port main control expansion board is equipped with, The tunnel encapsulation / decapsulation module is used to encapsulate the original Layer 2 data frames in MAC-in-UDP mode, encapsulate Layer 2 Ethernet frames into Layer 3 routable data packets, and at the same time perform reverse decapsulation / decryption operations. The network virtualization encapsulation module, based on a three-layer network infrastructure, constructs a virtual two-layer network on the existing 4G / 5G three-layer network. By encapsulating the original two-layer data into a virtual tunnel and forwarding it to the red-edge side of the 4G / 5G three-layer encrypted gateway, it achieves network virtualization mapping of the same network segment in different locations.

[0011] Furthermore, this invention also provides a method for remote networking of 4G / 5G gateways with Layer 3 extension to Layer 2 based on red-black isolation. Based on the above-described 4G / 5G gateway Layer 3 extension to Layer 2 remote networking device with red-black isolation, a VPDN private network is constructed by cascading a dual-port main control expansion board on the red side and relying on the operator's 4G / 5G basic network. The virtual Layer 2 tunnel technology of NAT address translation and MAC-in-UDP encapsulation is integrated to realize Layer 2 transparent encrypted transmission of service devices in the same network segment in different locations.

[0012] Specifically, see Figure 2 The above networking method includes the following steps: Step 1: Private network setup and network parameter configuration. Complete the network parameter matching and network initialization of all network devices in the remote location. All network devices include network device A and network device B. Define network device A as the source network device and network device B as the destination network device. The source network device is connected to the source service device and the destination network device is connected to the destination service device. Step 2: Establish a dedicated virtual Layer 2 communication tunnel between each network device in a different location. The communication of the virtual Layer 2 communication tunnel adopts the standard UDP 4789 port. Assign a unique 24-bit NetworkIdentifier to each virtual Layer 2 network to identify the dedicated virtual Layer 2 network and realize the isolation of multiple virtual networks. Step 3: Source data encapsulation and transmission; Step 4: Decapsulation and forwarding of data at the destination; Step 5, Two-way transparent communication: When the destination service device sends data to the source service device, repeat steps 3 and 4 to achieve two-way transparent encrypted data transmission between remote service devices.

[0013] In general, after the network is completed, the core process of data transmission in a remote network is as follows: receiving raw data frames → MAC-in-UDP encapsulation → SNAT conversion → private network encrypted transmission → DNAT conversion → identifier verification → decapsulation → forwarding of raw frames.

[0014] Furthermore, step 1 specifically includes: The VPDN private network construction module relies on the operator's 4G / 5G basic network to build a dedicated VPDN encrypted private network between at least two networking devices in different locations; it enables the NAT mode of the 4G / 5G three-layer encryption gateway of each networking device, configures the internal network interconnection address of the two physical network cards of the dual-port main control expansion board, and completes the network parameter matching and network initialization of all networking devices in different locations.

[0015] Furthermore, step 3 specifically includes: When the source service device sends the original Layer 2 data frame to the destination service device, the dual-port main control expansion board of the source network device receives the original Layer 2 data frame through its second physical network card. The tunnel encapsulation and decapsulation module encapsulates the original Layer 2 data frame using MAC-in-UDP to form a Layer 3 routable data packet. Then, the red-edge NAT conversion module performs SNAT to convert the internal IP address of the first physical network card of the dual-port main control expansion board to the public IP address of the 4G / 5G Layer 3 encrypted gateway. The encapsulated Layer 3 routable data packet is encrypted by the encryption / decryption module. Finally, the black-edge NAT conversion module performs SNAT to forward the packet to the VPDN encrypted private network and then transmits it to the destination network device.

[0016] Combination Figure 3 The MAC-in-UDP encapsulation structure, from the outside to the inside, consists of an outer MAC header, an outer IP header, a UDP header, a 24-bit Network Identifier tunnel header, and an inner original Layer 2 Ethernet frame. Specifically: the source MAC address in the outer MAC header is the physical MAC address of the source gateway, and the destination MAC address is the physical MAC address or multicast MAC address of the next-hop gateway; the source IP address in the outer IP header is the public IP address after SNAT translation by the gateway, and the destination IP address is the public IP address of the destination gateway; the destination port in the UDP header is 4789.

[0017] It should be noted that the original Layer 2 data frames include broadcast data packets, multicast data packets, and unicast data packets. The tunnel encapsulation and decapsulation module adopts a unified MAC-in-UDP encapsulation method for the three types of data packets, and all encapsulation and transmission processes are completed within a dedicated VPDN encrypted private network. There is no need to deploy an application server on the public network for data packet forwarding, conversion, or relay, or to customize the application software when using it remotely on the public network. This enables seamless migration and use of the original system's LAN software.

[0018] Furthermore, step 4 specifically includes: The destination networking device receives Layer 3 routable data packets through a dedicated VPDN encrypted private network. First, the black-edge NAT conversion module performs DNAT conversion on the destination public IP address of the data packet and then forwards it to the encryption / decryption module for decryption. Then, the red-edge NAT conversion module forwards it to the internal IP address of the first physical network card of the dual-port main control expansion board in the destination networking device. The tunnel encapsulation and decapsulation module then verifies whether the 24-bit Network Identifier of the data packet matches the identifier of the local virtual Layer 2 network. If the match is successful, the outer MAC header, outer IP header, UDP header, and tunnel header are stripped in sequence to recover the original Layer 2 Ethernet frame. If the match fails, the received Layer 3 routable data packet is directly discarded, thereby achieving physical isolation and data protection between different virtual Layer 2 networks. Finally, the dual-port main control expansion board forwards the restored original Layer 2 Ethernet frames to the destination service device through the second physical network card, completing a data transmission.

[0019] Specifically, the 24-bit Network Identifier supports the unique identification of up to 16 million logical virtual Layer 2 networks, enabling independent networking and data isolation of multiple groups of remote service devices, with no data interaction interference between the virtual Layer 2 networks.

[0020] Specifically, based on the availability of a dedicated VPDN encrypted private network routing IP, there is no need to deploy an application server on the public network. All NAT address translation, packet encapsulation, and packet decapsulation operations are completed locally on the remote networking device. Data transmission is handled only by this device, avoiding the security risks associated with public network transmission.

[0021] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects: 1) Adopting a red-black isolation technology architecture, the network security is high: The present invention uses a red-edge cascaded dual-port main control expansion board of the 4G / 5G three-layer encryption gateway body, which is physically isolated from the black-edge network. It is suitable for the red-black isolation networking requirements of various enterprises and institutions with high requirements for data transmission security and transparency. Moreover, all data processing is completed on the red edge, avoiding the security risks brought by the black-edge network. 2) Achieve transparent transmission of Layer 2 network on Layer 3 network and support transparent transmission of multiple types of data packets: Integrate NAT address translation and MAC-in-UDP encapsulation technology to build a virtual Layer 2 communication tunnel on 4G / 5G Layer 3 network, realize transparent transmission of Layer 2 of service devices in different locations on the same network segment, and adopt a unified encapsulation method for broadcast, multicast and unicast data packets, which solves the pain point of traditional Layer 3 gateway routers isolating broadcasts; 3) No need to set up an additional public network server, LAN application software can be seamlessly migrated to the public network for use, with low deployment costs and more secure transmission: Relying on the operator's 4G / 5G basic network, a dedicated VPDN encrypted private network is built. All NAT conversion, encapsulation and decapsulation operations are completed locally on the networking device. There is no need to deploy application servers on the public network, and the original LAN software can be directly and seamlessly migrated without re-customizing it into a central server relay business software architecture. This reduces the network deployment and maintenance costs and avoids the security risks such as data leakage and hijacking brought by public network servers. 4) Seamless networking without interfering with existing business systems: No modification is required to the hardware, software, or IP configuration of the business equipment. The business equipment can achieve remote networking communication while maintaining its original network segment and operating status. The operation is simple and will not cause any interference to the original business system. 5) Supports multiple independent networks with high networking flexibility: The 24-bit Network Identifier enables the unique identification of up to 16 million logical virtual Layer 2 networks. Limited by the CPU resource forwarding limitations of the main control unit and gateway, it can also meet the independent networking needs of multiple remote business devices. Moreover, the data between each virtual network is isolated and there is no interactive interference, which is suitable for small-scale, multi-scenario remote networking needs. 6) Good protocol compatibility and high transmission stability: The tunnel communication adopts the standard UDP 4789 port, which is compatible with existing network communication protocols and does not require modification of the existing 4G / 5G network; the dual-port main control expansion board adopts gigabit independent dual network cards to realize physical isolation between the data flow of the networking device and the local area network data flow of the service equipment, avoid data interaction interference, and improve the stability of network transmission.

[0022] In summary, the Layer 3 extended Layer 2 remote networking device based on a 4G / 5G gateway provided by this invention enables transparent Layer 2 transmission between remote devices on the same network segment without relying on public network servers or changing the configuration of existing business equipment. It fully transmits broadcast and multicast protocol messages and is compatible with red-black isolation technology architecture, thereby effectively reducing networking costs, shortening transmission latency, and eliminating security risks caused by third-party data relay. At the same time, it ensures that the original LAN application software can be directly migrated and used in the public wireless environment without any modifications, meeting the dual requirements of high-security industries for convenient and reliable remote networking. Attached Figure Description

[0023] The accompanying drawings are incorporated in and form part of this specification, and together with the description serve to explain the principles of the invention.

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0025] Figure 1 A hardware connection diagram of the 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation provided by the present invention; Figure 2 A flowchart of the 4G / 5G gateway Layer 3 extended Layer 2 remote networking method based on red-black isolation provided by the present invention; Figure 3 This is a schematic diagram of the MAC-in-UDP packet encapsulation structure provided by the present invention. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples consistent with some aspects of the invention as detailed in the appended claims.

[0027] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Example

[0028] See Figure 1 As shown, this embodiment provides a 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation. Here, we take the implementation of a Layer 2 transparent encrypted network for two remote service devices using two networking devices as an example. This includes two identical networking units, namely source networking device A and destination networking device B. Each networking unit consists of a 4G / 5G Layer 3 encrypted gateway body and a dual-port main control expansion board. For ease of description below, the following definitions are used: 1. The two 4G / 5G three-layer encryption gateways are referred to as gateway A (source end) and gateway B (destination end) respectively. Both adopt the red-black isolation technology architecture. The public IP address of gateway A is IP-A and the public IP address of gateway B is IP-B. 2. Two dual-port main control expansion boards are designated as expansion board A (source end) and expansion board B (destination end), respectively. Both are cascaded to the red edge side of the corresponding gateway and are physically isolated from the black edge network. 3. Expansion board A is configured with gigabit physical network cards A1 (first physical network card) and A2 (second physical network card). Network card A1 is connected to the internal network port of gateway A via a gigabit network cable, and network card A2 is connected to the source service device via a gigabit network cable. The internal network IP address of network card A1 is configured as 1.1.1.5, and the dial-up IP address of gateway A is configured as 10.1.1.1. 4. Expansion board B is configured with gigabit physical network cards B1 (first physical network card) and B2 (second physical network card). Network card B1 is connected to the internal network port of gateway B via a gigabit network cable, and network card B2 is connected to the destination service device via a gigabit network cable. Configure the internal network IP address of network card B1 as 1.1.2.5, and the dial-up IP address of gateway B as 10.1.1.2. 5. The source and destination service devices are on the same network segment (192.168.1.0 / 24). The IP address of the source service device is 192.168.1.10, and the IP address of the destination service device is 192.168.1.20. The service systems connected to both devices maintain their original hardware, software, and IP configurations without any modifications.

[0029] Gateways A and B each have a built-in black-edge NAT conversion module, VPDN private network construction module, encryption / decryption module, and red-edge NAT conversion module. Expansion boards A and B each have a built-in tunnel encapsulation / decapsulation module and network virtualization encapsulation module. All modules are functioning normally and are pre-configured with a unified private IP multicast address of 239.1.1.1, which corresponds to a standard multicast MAC address of 01-00-5E-01-01-01.

[0030] After completing the network setup according to the above process, the specific steps for establishing a remote, transparent, encrypted Layer 2 network between the source and destination service devices are as follows: Step 1: Private Network Setup and Network Parameter Configuration: Gateway A and Gateway B, relying on the operator's 4G / 5G basic network, build a dedicated VPDN encrypted private network between themselves through their respective VPDN private network construction modules to achieve end-to-end secure interconnection; enable NAT mode (host-only mode) for both Gateway A and Gateway B, confirm that the internal network interconnection address configuration of the physical network cards of expansion board A and expansion board B is correct, and complete the network parameter matching and network initialization of the two networking devices.

[0031] Step 2: Establish a virtual Layer 2 tunnel: Establish a dedicated virtual Layer 2 communication tunnel between gateway A and gateway B. The tunnel communication uses the UDP 4789 standard port. Assign a unique 24-bit Network Identifier of 0x123456 to this virtual Layer 2 network as the unique identifier of this network.

[0032] Step 3, Source Data Encapsulation and Transmission: If the source service device (192.168.1.10) sends a broadcast data packet (raw Layer 2 Ethernet frame) to the destination service device (192.168.1.20), expansion board A receives the raw broadcast data frame through network card A2; the tunnel encapsulation / decapsulation module of expansion board A encapsulates the frame using MAC-in-UDP, see [link to relevant documentation]. Figure 3 Its encapsulation structure is as follows: outer MAC header (source MAC is the physical MAC of expansion board A, destination MAC is the pre-configured standard multicast MAC 01-00-5E-01-01-01), outer IP header (source IP is the A1 address of expansion board A, destination IP is the pre-configured private IP multicast address 239.1.1.1), UDP header (port 4789), tunnel header (0x123456), and inner raw broadcast Ethernet frame; after encapsulation, the Layer 2 broadcast is mapped to a Layer 3 IP multicast packet, and the encapsulated Layer 3 IP multicast packet is encrypted by the encryption / decryption module; then, the black-border NAT conversion module performs SNAT forwarding to the VPDN encrypted private network and transmits it to gateway B; If the source service device sends a unicast data packet, the encapsulation structure is adjusted as follows: outer MAC header (source MAC is the physical MAC of expansion board A, destination MAC is the physical unicast MAC of the next-hop gateway A body with red edge), outer IP header (source IP is the A1 address of expansion board A, destination IP is the public IP-B of gateway B), and the rest of the encapsulation structure remains unchanged. After encapsulation, a three-layer IP unicast packet is formed and transmitted through a dedicated VPDN encrypted private network.

[0033] Step 4: Decapsulation and forwarding of destination data: Gateway B receives Layer 3 IP multicast packets through a dedicated VPDN encrypted private network. First, the black-edge NAT conversion module performs DNAT conversion on the destination public IP address of the Layer 3 IP multicast packet and then forwards it to the encryption / decryption module for decryption. Then, the red-edge NAT conversion module performs DNAT conversion on the destination IP address and converts it to the internal IP address 1.1.2.5 of the network card B1 of expansion board B. The tunnel encapsulation and decapsulation module then verifies that the tunnel header identifier of the data packet is 0x123456, which matches the identifier of the local virtual Layer 2 network. Subsequently, all outer unicast / multicast encapsulations are stripped off in sequence to accurately recover the original broadcast Ethernet frame. If the match fails, the received Layer 3 routable data packet is directly discarded to achieve physical isolation and data protection between different virtual Layer 2 networks. Finally, expansion board B forwards the original frame to the destination service device via network card B2. If the received packet is a Layer 3 IP unicast packet, the red-edge NAT conversion module converts the destination public network unicast IP-B to 1.1.2.5 using DNAT. The subsequent verification, decapsulation and forwarding processes remain consistent.

[0034] Step 5, Bidirectional Transparent Communication: When the destination service device (192.168.1.20) sends unicast data packets to the source service device (192.168.1.10), the encapsulation, transmission, decapsulation, and forwarding process of steps 3 and 4 is repeated: Gateway B completes SNAT address translation and MAC-in-UDP encapsulation, mapping the unicast frame to a Layer 3 IP unicast packet. The data packet is transmitted to Gateway A through a dedicated VPDN encrypted private network. Gateway A completes DNAT address translation and identifier verification, decapsulates and restores the original unicast Ethernet frame, and forwards it to the source service device, realizing bidirectional Layer 2 transparent encrypted data transmission.

[0035] It should be noted that if the destination service device sends broadcast / multicast data packets, the encapsulation and transmission process of the broadcast frame described above will be followed to achieve transparent transmission of bidirectional multi-type data packets.

[0036] As can be seen from the above analysis, in this embodiment, the source service device and the destination service device maintain their original IP configuration and operating status without any modifications. This enables the transparent transmission of broadcast, multicast, and unicast data packets across different locations on the same network segment. All data processing is completed locally on the networking device, eliminating the need to assume a public network server for the service system. The entire transmission process is encrypted, completely replacing the wired transmission effect of traditional optical cables. Furthermore, it is compatible with red-black isolation technology, meeting the networking requirements for a high level of security.

[0037] In summary, the 4G / 5G gateway Layer 3 extension to Layer 2 remote networking device based on red-black isolation provided by this invention achieves the following technical innovations: 1. Hardware architecture innovation: Unlike the existing general gateway networking architecture, it is the first to cascade a dual-port main control expansion board with the red edge of the red-black isolation gateway, realizing the hardware extension of the Layer 3 gateway to Layer 2 networking, and is physically isolated from the black edge, suitable for remote networking needs of various user units with high requirements for data transmission security and transparency; 2. Encapsulation method innovation: It adopts a dedicated MAC-in-UDP Layer 2 data frame encapsulation method, replacing the traditional VXLAN+IPSec method. 3. Innovative Networking Mode: Unlike existing remote networking technologies that rely on public network servers / management platforms, this technology eliminates the need to set up application servers on the public network or redesign existing LAN software to a central server relay business software architecture. It allows for seamless migration, reducing deployment and maintenance costs and avoiding security risks such as data leakage and hijacking associated with public network servers. All data processing operations are completed locally on the networking device, achieving end-to-end secure transmission. 4. Innovative Technology Integration: This technology deeply integrates NAT address translation, network virtualization, MAC-in-UDP encapsulation, and VPDN private networks, enabling seamless expansion from Layer 3 to Layer 2 networks. It also supports the indiscriminate transmission of broadcast / multicast packets, solving the broadcast isolation pain point of traditional Layer 3 gateways and achieving seamless networking.

[0038] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention.

[0039] It should be understood that the present invention is not limited to the content already described above, and various modifications and changes can be made without departing from its scope. The scope of the present invention is limited only by the appended claims.

Claims

1. A 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation, characterized in that, It includes multiple network units with the same structure. Each network unit consists of a 4G / 5G three-layer encryption gateway body and a dual-port main control expansion board. The 4G / 5G three-layer encryption gateway body adopts a red-black isolation architecture. The dual-port main control expansion board is cascaded on the red side of the 4G / 5G three-layer encryption gateway body and is physically isolated from the black side.

2. The 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation according to claim 1, characterized in that, The dual-port main control expansion board is equipped with an independent first physical network card and a second physical network card. The first physical network card is connected to the internal network port of the 4G / 5G three-layer encryption gateway body to realize data interaction between the dual-port main control expansion board and the 4G / 5G three-layer encryption gateway body; the second physical network card is used to connect to the service equipment of the remote network to realize physical isolation between the data flow of the networking device and the local area network data flow of the service equipment, so as to avoid data interaction interference.

3. The 4G / 5G gateway Layer 3 extended Layer 2 remote networking device based on red-black isolation according to claim 1, characterized in that, The 4G / 5G three-layer encryption gateway body is equipped with, The black-border NAT translation module is used to realize SNAT source address translation and DNAT destination address translation in the encrypted network layer, thereby enabling the black-border interface of the 4G / 5G three-layer encrypted gateway to communicate with the external network, providing a foundation for remote network transmission; The VPDN private network construction module relies on the operator's 4G / 5G basic network and uses the VPDN private network SIM card to build a dedicated encrypted VPDN private network, enabling secure interconnection of remote networking devices. The encryption / decryption module is used to encrypt or decrypt the encapsulated Layer 2 data frames. The red-edge NAT translation module is used to realize plaintext network layer SNAT source address translation and DNAT destination address translation, thereby realizing the address mapping between the dual-port main control expansion board and the red-edge side of the 4G / 5G three-layer encryption gateway, providing a foundation for three-layer network transmission.

4. The 4G / 5G gateway three-layer extended two-layer remote networking device based on red-black isolation according to claim 3, characterized in that, The dual-port main control expansion board is equipped with... The tunnel encapsulation / decapsulation module is used to encapsulate the original Layer 2 data frames in MAC-in-UDP mode, encapsulate Layer 2 Ethernet frames into Layer 3 routable data packets, and at the same time perform reverse decapsulation / decryption operations. The network virtualization encapsulation module, based on a three-layer network infrastructure, constructs a virtual two-layer network on the existing 4G / 5G three-layer network. By encapsulating the original two-layer data into a virtual tunnel and forwarding it to the red-edge side of the 4G / 5G three-layer encrypted gateway, it achieves network virtualization mapping of the same network segment in different locations.

5. A method for extending a 4G / 5G gateway to a Layer 3 network based on red-black isolation in a geographically dispersed manner, characterized in that... Based on the 4G / 5G gateway three-layer extended two-layer remote networking device based on red-black isolation as described in any one of claims 1 to 4, a VPDN private network is constructed by cascading dual-port main control expansion boards on the red side and relying on the operator's 4G / 5G basic network. The virtual two-layer tunnel technology of NAT address translation and MAC-in-UDP encapsulation is integrated to realize the two-layer transparent encrypted transmission of service devices in the same network segment in different locations.

6. The method for extending Layer 3 to Layer 2 remote networking of 4G / 5G gateways based on red-black isolation according to claim 5, characterized in that, Specifically, the steps include the following: Step 1: Private network setup and network parameter configuration. Complete the network parameter matching and network initialization of all network devices in the remote location. All network devices include network device A and network device B. Define network device A as the source network device and network device B as the destination network device. The source network device is connected to the source service device and the destination network device is connected to the destination service device. Step 2: Establish a dedicated virtual Layer 2 communication tunnel between each network device in a different location. The communication of the virtual Layer 2 communication tunnel adopts the standard UDP 4789 port. Assign a unique 24-bit Network Identifier to each virtual Layer 2 network to identify the dedicated virtual Layer 2 network and realize the isolation of multiple virtual networks. Step 3: Source data encapsulation and transmission; Step 4: Decapsulation and forwarding of data at the destination; Step 5, Two-way transparent communication: When the destination service device sends data to the source service device, repeat steps 3 and 4 to achieve two-way transparent encrypted data transmission between remote service devices.

7. The method for extending Layer 3 to Layer 2 remote networking of 4G / 5G gateways based on red-black isolation according to claim 6, characterized in that, Step 1 specifically includes: The VPDN private network construction module relies on the operator's 4G / 5G basic network to build a dedicated VPDN encrypted private network between at least two networking devices in different locations; it enables the NAT mode of the 4G / 5G three-layer encryption gateway of each networking device, configures the internal network interconnection address of the two physical network cards of the dual-port main control expansion board, and completes the network parameter matching and network initialization of all networking devices in different locations.

8. The method for extending Layer 3 to Layer 2 remote networking of 4G / 5G gateways based on red-black isolation according to claim 6, characterized in that, Step 3 specifically includes: When the source service device sends the original Layer 2 data frame to the destination service device, the dual-port main control expansion board of the source network device receives the original Layer 2 data frame through its second physical network card. The tunnel encapsulation and decapsulation module encapsulates the original Layer 2 data frame using MAC-in-UDP to form a Layer 3 routable data packet. Then, the red-edge NAT conversion module performs SNAT to convert the internal IP address of the first physical network card of the dual-port main control expansion board to the public IP address of the 4G / 5G Layer 3 encrypted gateway. The encapsulated Layer 3 routable data packet is encrypted by the encryption / decryption module. Finally, the black-edge NAT conversion module performs SNAT to forward the packet to the VPDN encrypted private network and then transmits it to the destination network device.

9. The method for extending Layer 3 to Layer 2 remote networking of 4G / 5G gateways based on red-black isolation according to claim 6, characterized in that, Step 4 specifically includes: The destination networking device receives Layer 3 routable data packets through a dedicated VPDN encrypted private network. First, the black-edge NAT conversion module performs DNAT conversion on the destination public IP address of the data packet and then forwards it to the encryption / decryption module for decryption. Then, the red-edge NAT conversion module forwards it to the internal IP address of the first physical network card of the dual-port main control expansion board in the destination networking device. The tunnel encapsulation and decapsulation module then verifies whether the 24-bit Network Identifier of the data packet matches the identifier of the local virtual Layer 2 network. If the match is successful, the outer MAC header, outer IP header, UDP header, and tunnel header are stripped in sequence to recover the original Layer 2 Ethernet frame. If the match fails, the received Layer 3 routable data packet is directly discarded, thereby achieving physical isolation and data protection between different virtual Layer 2 networks. Finally, the dual-port main control expansion board forwards the original Layer 2 Ethernet frames to the destination service device through the second physical network card.

Images