Electronic device for communicating through virtual private network connection and storage medium thereof

Abstract

An electronic device for communicating through a virtual private network (VPN) connection and a storage medium thereof are disclosed. The electronic device may comprise: a memory for storing instructions; a communication circuit; and at least one processor operatively connected to the communication circuit. The instructions may cause the electronic device to: establish a VPN connection based on an IP address of the electronic device with a VPN server through a relay server; determine whether the IP address is changed; determine, on the basis of a change of the IP address to a new IP address, whether the electronic device stores valid connection information related to the VPN server; transmit an IP change request including the new IP address to the relay server on the basis that the electronic device stores valid connection information related to the VPN server; and communicate with the VPN server on the VPN connection through the relay server on the basis of the new IP address.

Description

Electronic devices and their storage media communicating via virtual private network connections

[0001] Embodiments of the present disclosure relate to an electronic device and its storage medium that communicate via a virtual private network connection.

[0002] The variety of services and additional features offered through user terminals, such as smartphones, is steadily increasing. To enhance the utility of these electronic devices and satisfy the diverse needs of users, telecommunications service providers and electronic device manufacturers are competitively developing electronic devices offering a variety of functions. Consequently, the various functions offered through these devices are also becoming increasingly sophisticated.

[0003] Electronic devices can communicate with network entities (e.g., servers) through a virtual private network (VPN) for security purposes. A VPN provides a point-to-point tunnel, where the tunnel can represent a secure connection (security association (SA)) between two devices (e.g., an electronic device and a server). A VPN creates a virtual private network connection between two devices over the Internet. A VPN masks the IP address within an Internet Protocol (IP) packet transmitted by a user (e.g., an electronic device) and encrypts the data within the IP packet, preventing unauthorized recipients from reading the IP packet.

[0004] The above information may be provided as background art to aid in understanding the present disclosure. No claim or determination is made as to whether any of the above is applicable as prior art related to the present disclosure.

[0005] Embodiments of the present disclosure may provide an electronic device and its storage medium configured to maintain communication without creating a new connection when an IP address of the electronic device changes in a virtual private network.

[0006] Embodiments of the present disclosure may provide an electronic device and a storage medium thereof configured to notify a relay server of a change in an IP address when the electronic device communicates with a virtual private network server through the relay server.

[0007] The technical problems to be achieved in the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned can be clearly understood by a person having ordinary skill in the technical field to which the present invention belongs from the description below.

[0008] An electronic device according to one embodiment of the present disclosure may include a memory storing instructions, a communication circuit, and at least one processor operatively connected to the memory and the communication circuit. The instructions, when executed by the at least one processor, may cause the electronic device to establish a VPN connection with a virtual private network (VPN) server through a relay server using the communication circuit, based on an IP address of the electronic device. The instructions, when executed by the at least one processor, may cause the electronic device to determine whether the IP address of the electronic device has changed. The instructions, when executed by the at least one processor, may cause the electronic device to determine whether the electronic device stores valid connection information related to the VPN server based on a change in the IP address of the electronic device to a new IP address. The instructions, when executed by the at least one processor, may cause the electronic device to transmit an IP change request including the new IP address to the relay server based on a determination that the electronic device stores valid connection information related to the VPN server. The above instructions, when executed by the at least one processor, may cause the electronic device to communicate with the VPN server through the VPN connection via the relay server based on the new IP address.

[0009] A method according to one embodiment of the present disclosure may include establishing a VPN connection based on an IP address of an electronic device and a virtual private network (VPN) server through a relay server. The method may include determining whether the IP address of the electronic device has changed. The method may include determining whether the electronic device stores valid connection information related to the VPN server based on the change of the IP address of the electronic device to a new IP address. The method may include transmitting an IP change request including the new IP address to the relay server based on the electronic device storing valid connection information related to the VPN server. The method may include communicating with the VPN server through the VPN connection through the relay server based on the new IP address.

[0010] A non-transitory computer-readable storage medium storing one or more programs according to one embodiment of the present disclosure may include instructions configured to cause the electronic device, when executed by at least one processor of the electronic device, to: establish a VPN connection with a virtual private network (VPN) server through a relay server based on an IP address of the electronic device; determine whether the IP address of the electronic device has changed; determine whether the electronic device stores valid connection information related to the VPN server based on the IP address of the electronic device being changed to a new IP address; transmit an IP change request including the new IP address to the relay server based on the electronic device storing valid connection information related to the VPN server; and communicate with the VPN server through the VPN connection through the relay server based on the new IP address.

[0011] FIG. 1 is a block diagram of an electronic device within a network environment according to various embodiments.

[0012] FIG. 2 is a diagram illustrating a configuration of an electronic device communicating via VPN according to one embodiment of the present disclosure.

[0013] FIG. 3 is a diagram for explaining a communication method using a VPN according to one embodiment.

[0014] FIG. 4 is a diagram for explaining a communication method using a relay VPN according to one embodiment of the present disclosure.

[0015] FIG. 5a is a diagram for explaining a system structure that provides a communication service through a relay VPN connection according to one embodiment of the present disclosure.

[0016] FIG. 5b is a diagram illustrating an example of a mapping table for managing IP changes according to one embodiment of the present disclosure.

[0017] FIG. 6 is a flowchart illustrating the operation of an electronic device according to one embodiment of the present disclosure.

[0018] FIG. 7 is a diagram illustrating a mapping table for a VPN connection according to one embodiment of the present disclosure.

[0019] FIG. 8 is a diagram for explaining an update of a mapping table based on an IP address change according to one embodiment of the present disclosure.

[0020] FIG. 9 illustrates a sequence diagram for explaining a relay VPN connection procedure according to one embodiment of the present disclosure.

[0021] FIG. 10 illustrates a sequence diagram for explaining a procedure for notifying an IP address change according to one embodiment of the present disclosure.

[0022] FIG. 11A and FIG. 11B are diagrams for explaining an IP address update method according to embodiments of the present disclosure.

[0023] FIG. 12 is a flowchart illustrating an operation for setting an IP address update method according to one embodiment of the present disclosure.

[0024] FIG. 13 is a diagram for explaining a UI for notifying a change in an IP address according to one embodiment of the present disclosure.

[0025] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings so that those skilled in the art can easily implement the present disclosure. However, the present disclosure may be implemented in various different forms and is not limited to the embodiments described herein. In connection with the description of the drawings, the same or similar reference numerals may be used for the same or similar components. In addition, in the drawings and related descriptions, descriptions of well-known functions and configurations may be omitted for clarity and conciseness.

[0026] FIG. 1 is a block diagram of an electronic device (101) within a network environment (100) according to various embodiments.

[0027] Referring to FIG. 1, in a network environment (100), an electronic device (101) may communicate with an electronic device (102) via a first network (198) (e.g., a short-range wireless communication network), or may communicate with an electronic device (104) or a server (108) via a second network (199) (e.g., a long-range wireless communication network). According to one embodiment, the electronic device (101) may communicate with the electronic device (104) via the server (108). According to one embodiment, the electronic device (101) may include a processor (120), a memory (130), an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a connection terminal (178), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197). In some embodiments, the electronic device (101) may omit at least one of these components (e.g., the connection terminal (178)), or may have one or more other components added. In some embodiments, some of these components (e.g., the sensor module (176), the camera module (180), or the antenna module (197)) may be integrated into one component (e.g., the display module (160)).

[0028] The processor (120) may, for example, execute software (e.g., a program (140)) to control at least one other component (e.g., a hardware or software component) of the electronic device (101) connected to the processor (120) and perform various data processing or operations. According to one embodiment, as at least a part of the data processing or operations, the processor (120) may store commands or data received from other components (e.g., a sensor module (176) or a communication module (190)) in a volatile memory (132), process the commands or data stored in the volatile memory (132), and store result data in a non-volatile memory (134). According to one embodiment, the processor (120) may include a main processor (121) (e.g., a central processing unit or an application processor) or an auxiliary processor (123) (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor) that can operate independently or together with the main processor (121). For example, when the electronic device (101) includes the main processor (121) and the auxiliary processor (123), the auxiliary processor (123) may be configured to use less power than the main processor (121) or to be specialized for a given function. The auxiliary processor (123) may be implemented separately from the main processor (121) or as a part thereof.

[0029] The auxiliary processor (123) may control at least a portion of functions or states associated with at least one component (e.g., a display module (160), a sensor module (176), or a communication module (190)) of the electronic device (101), for example, on behalf of the main processor (121) while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state. In one embodiment, the auxiliary processor (123) (e.g., an image signal processor or a communication processor) may be implemented as a part of another functionally related component (e.g., a camera module (180) or a communication module (190)). In one embodiment, the auxiliary processor (123) (e.g., a neural network processing unit) may include a hardware structure specialized for processing artificial intelligence models. The artificial intelligence models may be generated through machine learning. This learning can be performed, for example, in the electronic device (101) itself where artificial intelligence is performed, or can be performed through a separate server (e.g., server (108)). The learning algorithm can include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model can include multiple artificial neural network layers.The artificial neural network may be one of a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above, but is not limited to the examples described above. In addition to, or alternatively to, a hardware structure, an artificial intelligence model may include a software structure.

[0030] The memory (130) can store various data used by at least one component (e.g., processor (120) or sensor module (176)) of the electronic device (101). The data can include, for example, software (e.g., program (140)) and input data or output data for commands related thereto. The memory (130) can include volatile memory (132) or non-volatile memory (134).

[0031] The program (140) may be stored as software in the memory (130) and may include, for example, an operating system (142), middleware (144), or an application (146).

[0032] The input module (150) can receive commands or data to be used in a component of the electronic device (101) (e.g., a processor (120)) from an external source (e.g., a user) of the electronic device (101). The input module (150) can include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

[0033] The audio output module (155) can output audio signals to the outside of the electronic device (101). The audio output module (155) can include, for example, a speaker or a receiver. The speaker can be used for general purposes, such as multimedia playback or recording playback. The receiver can be used to receive incoming calls. In one embodiment, the receiver can be implemented separately from the speaker or as part of the speaker.

[0034] The display module (160) can visually provide information to an external party (e.g., a user) of the electronic device (101). The display module (160) may include, for example, a display, a holographic device, or a projector and a control circuit for controlling the device. According to one embodiment, the display module (160) may include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of a force generated by the touch.

[0035] The audio module (170) can convert sound into an electrical signal, or vice versa, convert an electrical signal into sound. According to one embodiment, the audio module (170) can acquire sound through the input module (150), output sound through the sound output module (155), or an external electronic device (e.g., electronic device (102)) (e.g., speaker or headphone) directly or wirelessly connected to the electronic device (101).

[0036] The sensor module (176) can detect the operating status (e.g., power or temperature) of the electronic device (101) or the external environmental status (e.g., user status) and generate an electrical signal or data value corresponding to the detected status. According to one embodiment, the sensor module (176) can include, for example, a gesture sensor, a gyro sensor, a barometric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

[0037] The interface (177) may support one or more designated protocols that may be used to directly or wirelessly connect the electronic device (101) with an external electronic device (e.g., the electronic device (102)). In one embodiment, the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

[0038] The connection terminal (178) may include a connector through which the electronic device (101) may be physically connected to an external electronic device (e.g., electronic device (102)). According to one embodiment, the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0039] The haptic module (179) can convert electrical signals into mechanical stimuli (e.g., vibration or movement) or electrical stimuli that a user can perceive through tactile or kinesthetic sensations. According to one embodiment, the haptic module (179) can include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

[0040] The camera module (180) can capture still images and videos. According to one embodiment, the camera module (180) may include one or more lenses, image sensors, image signal processors, or flashes.

[0041] The power management module (188) can manage power supplied to the electronic device (101). According to one embodiment, the power management module (188) can be implemented as, for example, at least a part of a power management integrated circuit (PMIC).

[0042] A battery (189) may power at least one component of the electronic device (101). In one embodiment, the battery (189) may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0043] The communication module (190) may support the establishment of a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device (101) and an external electronic device (e.g., electronic device (102), electronic device (104), or server (108)), and the performance of communication through the established communication channel. The communication module (190) may operate independently from the processor (120) (e.g., application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication module (190) may include a wireless communication module (192) (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module (194) (e.g., a local area network (LAN) communication module, or a power line communication module). Among these communication modules, the corresponding communication module can communicate with an external electronic device (104) via a first network (198) (e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)) or a second network (199) (e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)). These various types of communication modules can be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (192) can verify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199) by using subscriber information (e.g., an international mobile subscriber identity (IMSI)) stored in the subscriber identification module (196).

[0044] The wireless communication module (192) can support 5G networks and next-generation communication technologies following the 4G network, such as NR access technology (new radio access technology). The NR access technology can support high-speed transmission of high-capacity data (eMBB (enhanced mobile broadband)), minimization of terminal power and connection of multiple terminals (mMTC (massive machine type communications)), or high reliability and low latency (URLLC (ultra-reliable and low-latency communications)). The wireless communication module (192) can support, for example, a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate. The wireless communication module (192) can support various technologies for securing performance in a high-frequency band, such as beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large scale antenna. The wireless communication module (192) can support various requirements specified in the electronic device (101), an external electronic device (e.g., the electronic device (104)), or a network system (e.g., the second network (199)). According to one embodiment, the wireless communication module (192) can support a peak data rate (e.g., 20 Gbps or more) for eMBB realization, a loss coverage (e.g., 164 dB or less) for mMTC realization, or a U-plane latency (e.g., 0.5 ms or less for downlink (DL) and uplink (UL), or 1 ms or less for round trip) for URLLC realization.

[0045] The antenna module (197) can transmit or receive signals or power to or from an external device (e.g., an external electronic device). In one embodiment, the antenna module (197) may include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). In one embodiment, the antenna module (197) may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as the first network (198) or the second network (199), may be selected from the plurality of antennas, for example, by the communication module (190). A signal or power may be transmitted or received between the communication module (190) and an external electronic device via the at least one selected antenna. In some embodiments, in addition to the radiator, another component (e.g., a radio frequency integrated circuit (RFIC)) may be additionally formed as a part of the antenna module (197).

[0046] According to various embodiments, the antenna module (197) may form a mmWave antenna module. In one embodiment, the mmWave antenna module may include a printed circuit board, an RFIC disposed on or adjacent a first side (e.g., a bottom side) of the printed circuit board and capable of supporting a designated high-frequency band (e.g., a mmWave band), and a plurality of antennas (e.g., an array antenna) disposed on or adjacent a second side (e.g., a top side or a side side) of the printed circuit board and capable of transmitting or receiving signals in the designated high-frequency band.

[0047] At least some of the above components can be interconnected and exchange signals (e.g., commands or data) with each other via a communication method between peripheral devices (e.g., a bus, GPIO (general purpose input and output), SPI (serial peripheral interface), or MIPI (mobile industry processor interface)).

[0048] According to one embodiment, commands or data may be transmitted or received between the electronic device (101) and an external electronic device (104) via a server (108) connected to a second network (199). Each of the external electronic devices (102 or 104) may be the same or a different type of device as the electronic device (101). According to one embodiment, all or part of the operations executed in the electronic device (101) may be executed in one or more of the external electronic devices (102, 104, or 108). For example, when the electronic device (101) is to perform a certain function or service automatically or in response to a request from a user or another device, the electronic device (101) may, instead of or in addition to executing the function or service itself, request one or more external electronic devices to perform the function or at least a part of the service. One or more external electronic devices that receive the request may execute at least a portion of the requested function or service, or an additional function or service related to the request, and transmit the result of the execution to the electronic device (101). The electronic device (101) may process the result as is or additionally and provide it as at least a portion of a response to the request. For this purpose, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used, for example. The electronic device (101) may provide an ultra-low latency service by using distributed computing or mobile edge computing, for example. In another embodiment, the external electronic device (104) may include an Internet of Things (IoT) device. The server (108) may be an intelligent server utilizing machine learning and / or a neural network. According to one embodiment, the external electronic device (104) or the server (108) may be included in the second network (199).The electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

[0049] FIG. 2 is a diagram illustrating a configuration of an electronic device communicating via VPN according to one embodiment of the present disclosure.

[0050] Referring to FIG. 2, the electronic device (200) (e.g., the electronic device (101)) may include at least one of a processor (210) (e.g., the processor (120)), a communication circuit (220) (e.g., the communication module (190)), or a memory (230) (e.g., the memory (130)). The electronic device (200) is not limited to a form that includes only the illustrated components, and the electronic device (200) may include more or fewer components than the illustrated components.

[0051] The electronic device (200) may communicate with an external electronic device (e.g., an API server (540), a relay server (550), and / or a VPN server (560) of FIG. 5A) using wireless communication technology and / or wired communication technology via the communication circuit (220). In one embodiment, the electronic device (200) may access a data network (e.g., the Internet or a VPN) using WiFi or using a cellular communication technology (e.g., 4G, 5G, or NR).

[0052] In one embodiment, the communication circuit (220) may include one or more communication components that transmit and receive signals using one or more antennas (not shown) with an external electronic device (e.g., the API server (540), the relay server (550), and / or the VPN server (560) of FIG. 5A). In one embodiment, the one or more antennas may be implemented as part of the antenna module (198) of FIG. 1. According to one embodiment, the communication circuit (220) may support a communication technology based on a WiFi method and / or a cellular communication technology.

[0053] The electronic device (200) may include a processor (210) that may be implemented as one or more single-core processors or one or more multi-core processors, and a memory (230) that stores instructions for the operation of the electronic device (200).

[0054] According to embodiments of the present disclosure, the memory (230) may store instructions or related data for establishing, maintaining, and managing a VPN connection. According to embodiments of the present disclosure, the processor (210) may execute at least one application utilizing Internet communication and control the communication circuit (220) according to the execution of the application.

[0055] According to one embodiment of the present disclosure, the memory (230) can store data such as a basic program, an application program, and / or setting information for the operation of the electronic device (200). The memory (230) can provide the stored data upon request of the processor (210). The memory (230) can be configured as a storage medium or a combination of storage media such as a read only memory (ROM), a random access memory (RAM), a hard disk, a compact disc read only memory (CD-ROM), and a digital versatile disc (DVD). The memory (230) can include one or more memories. The processor (210) can perform at least one of the operations corresponding to the embodiments of the present disclosure based on a program for performing at least one of the operations corresponding to the embodiments of the present disclosure stored in the memory (210).

[0056] FIG. 3 is a diagram for explaining a communication method using a VPN according to one embodiment.

[0057] Referring to FIG. 3, an electronic device (200) (e.g., electronic device (101)) may communicate with a VPN server (300) using a VPN connection via a network (e.g., a WiFi network and / or a cellular network) (304). The VPN connection may be based on a tunneling technology that encrypts and transmits traffic (e.g., IP packets (302)) between the electronic device (200) and the server (300).

[0058] The electronic device (200) can securely transmit data (e.g., IP packets (302)) transmitted and received over a network using pre-arranged password information with the VPN server (300). The electronic device (200) and the VPN server (300) can exchange password information (e.g., encryption algorithms and / or encryption keys) to be used in the VPN connection when establishing a VPN connection. The electronic device (200) can encrypt data according to the pre-exchanged password information and transmit an IP packet (302) containing the encrypted data to the VPN server (300) via the network (304). Since the data transmitted from the electronic device (200) is encrypted, the confidentiality of the data can be maintained in the network (304) between the electronic device (200) and the VPN server (300). The IP address of the electronic device (200) used in the network (304) is, for example, 1.1.1.1, and the source IP address (source IP address: Src_IP) of the IP packet (302) can be set to 1.1.1.1, which is the IP address of the electronic device (200).

[0059] When the IP packet (302) is transmitted to the VPN server (300), the VPN server (300) can decrypt the data in the IP packet (302) using previously agreed-upon password information and change the source IP address of the IP packet (302) to the IP address of the VPN server (300) (e.g., 3.3.3.3). An IP packet (314) including the data of the IP packet (302) and the changed source IP address (e.g., 3.3.3.3) can be transmitted from the VPN server (300) to the destination of the IP packet (302) (e.g., an external electronic device (310)) through the network (314). Although the data of the IP packet (312) is disclosed unencrypted in the network (314) between the VPN server (300) and the external electronic device (310), an unauthorized user (not shown) recognizes that the IP packet (312) was sent by the VPN server (300) and not the electronic device (200), so the electronic device (200), which is the actual source of the IP packet (312), can be protected.

[0060] FIG. 4 is a diagram for explaining a communication method using a relay VPN according to one embodiment of the present disclosure.

[0061] Referring to FIG. 4, an electronic device (200) (e.g., electronic device (101)) can communicate with a VPN server (300) via a relay server (400). When establishing a VPN connection, the electronic device (200) can exchange encryption information (e.g., an encryption algorithm and / or an encryption key) to be used in the VPN connection with the VPN server (300). When sending an IP packet (402), the electronic device (200) can set the destination IP address (Dst_IP) of the IP packet (402) to the IP address of the relay server (400) (e.g., 4.4.4.4) rather than the IP address of the VPN server (300) (e.g., 3.3.3.3). The source IP address of the IP packet (402) can be set to the IP address of the electronic device (200) (e.g., 1.1.1.1).

[0062] The relay server (400) can receive the IP packet (402) and change the source IP address of the IP packet (402) to the IP address of the relay server (400) (e.g., 4.4.4.4) and set the destination IP address to the IP address of the VPN server (300) (e.g., 3.3.3.3). Here, since the data of the IP packet (402) is encrypted according to the password information agreed upon between the electronic device (200) and the VPN server (300), the relay server (400) cannot read the data of the IP packet (402). An IP packet (404) including the data of the IP packet (402), the changed source IP address, and the changed destination IP address can be transmitted from the relay server (400) to the VPN server (300).

[0063] The VPN server (300) may receive the IP packet (404), change the source IP address of the IP packet (404) to the IP address of the VPN server (300) (e.g., 3.3.3.3), and set the destination IP address to the IP address of the counterpart device (410) with which the electronic device (200) wishes to communicate. An IP packet (412) including the data of the IP packet (404), the changed source IP address, and the changed destination IP address may be transmitted from the VPN server (300) to the counterpart device (410).

[0064] Since the source IP address of the IP packet (404) that the VPN server (300) receives from the relay server (400) is the IP address of the relay server (400), the relay server (400) cannot know the electronic device (200) that is the actual source of the IP packet (404). Therefore, in the communication between the electronic device (200) and the counterpart device (410), neither the VPN server (300) nor the relay server (400) can know both the source and the data.

[0065] A VPN architecture may include multiple VPN servers (e.g., VPN server (300)) and a VPN mapping server (not shown) to seamlessly provide VPN services to multiple clients (e.g., electronic devices (200)). When a client establishes a VPN connection, the VPN mapping server may map available VPN servers to the client according to an algorithm defined by a service requested by the client. In an architecture that provides a relay VPN, a relay server (e.g., relay server (400)) may create, store, and manage a mapping table that maps each client to a corresponding VPN server.

[0066] The IP address of an electronic device (200) may change for various reasons. For example, if the physical location of the electronic device (200) is moved, the electronic device (200) is connected to a different network, or if an IP reallocation occurs in the WiFi network to which the electronic device (200) is connected, the IP address of the electronic device (200) may change. In a structure such as FIG. 3, where the electronic device (200) is directly connected to a VPN server (300), if the IP address of the electronic device (200) changes, the server (300) can recognize the changed IP address of the electronic device (200) through a handover. On the other hand, in a structure such as FIG. 4 where an electronic device (200) is connected to a VPN server (300) through a relay server (400), since the electronic device (200) cannot directly communicate with the VPN server (300), the VPN server (300) cannot verify encrypted data included in an IP packet, and therefore cannot recognize a change in the IP address of the electronic device (200), and thus cannot support handover of the electronic device (200).

[0067] When the IP address of the electronic device (200) changes while the electronic device (200) is communicating via a VPN connection, the electronic device (200) establishes a new VPN connection with the new IP address to provide mapping information (e.g., a mapping table) for the new IP address to the relay server (400), which may cause service inconveniences such as unnecessary traffic generation and service delays to both the user and the service provider.

[0068] Embodiments of the present disclosure can increase connection availability when an IP address is changed and save system resources by enabling an electronic device (200) to reuse an existing VPN connection through a new IP address without re-establishing a VPN connection for tunneling even when the IP address of the electronic device (200) is changed in a relay VPN structure.

[0069] FIG. 5a is a diagram for explaining a system structure that provides a communication service through a relay VPN connection according to one embodiment of the present disclosure.

[0070] Referring to FIG. 5A, the electronic device (200) may include a processor (510) (e.g., processor (210)) and a communication module (520) (e.g., communication circuit (220)). The processor (510) may include at least one application (512) that uses Internet communication and detects an IP address change and an application programmable interface (API) communication module (514) that generates an IP change request. The communication module (520) may include at least one of a wireless communication module (522) (e.g., wireless communication module (192)), a wired communication module (524) (e.g., wired communication module (194)), or a VPN module (526).

[0071] In one embodiment, at least one application (512) may detect a change in the IP address of the electronic device (200) while establishing a VPN connection with the VPN server (560) through the relay server (550) and performing Internet communication through the VPN connection. The processor (510) may generate an IP change request based on the notification of the IP address change by the at least one application (512). In one embodiment, the IP change request may be included in an API command generated by the API communication module (514) or a packet according to a protocol and / or packet format (e.g., an unencrypted IP packet) agreed upon in advance between the electronic device (200) and the relay server (550). The IP change request may be transmitted to the relay server (530) through the communication module (520). In one embodiment, the VPN module (526) of the communication module (520) may transmit the IP change request to the relay server (530) through the wireless communication module (522) or the wired communication module (524). In one embodiment, when the IP change request is transmitted via an API command, the API command may be transmitted to the relay server (550) via the API communication module (542) of the API server (540).

[0072] In one embodiment, the processor (510) of the electronic device (200) may transmit the IP change request to a pre-designated field of an API packet transmitted to the API server (540), and the API server (540) may transmit the API packet to the relay server (550). In one embodiment, the processor (510) of the electronic device (200) may transmit an API command including the IP change request to the relay server (550) through the API server (540). In one embodiment, the processor (510) of the electronic device (200) may include the IP change request in a pre-designated field of a packet of a pre-arranged format (e.g., an IP packet), and transmit the packet including the IP change request to the relay server (550).

[0073] The relay VPN (530) may include at least one of an API server (540), a relay server (550) (e.g., relay server (400)), or a VPN server (560) (e.g., VPN server (300)). The API server (540) may include an API communication module (542) that handles communication between the electronic device (200) and the relay server (550). The relay server (550) may include an API communication module (552) that communicates with the electronic device (200) via the API server (540) and a VPN mapping module (554) that stores and manages a mapping table (556) (e.g., mapping table (710, 810, 1110, or 1120)) between the electronic device (200) and the VPN server (560).

[0074] At least one of the API server (540), the relay server (550), or the VPN server (560) may be configured as an independent entity, or may be configured as a combination of at least one. In one embodiment, the API server (540) may be located separately from the relay server (550), or may be configured in combination with the relay server (550). The API server (540) manages API communication between the electronic device (200) and the relay server (550), and may additionally perform additional functions such as customer management and / or VPN connection management. The VPN server (560) may include a VPN module (562) that performs VPN communication with the electronic device (200).

[0075] The relay server (550) may receive the IP change request from the electronic device (200) and transmit the IP change request to the VPN mapping module (554). In one embodiment, the IP change request may be received by the API communication module (552). In one embodiment, the IP change request may be received using a protocol and / or packet format agreed upon in advance between the electronic device (200) and the relay server (550). Based on the IP change request, the VPN mapping module (554) may include mapping information for mapping the changed IP address (e.g., a new IP address) of the electronic device (200) to the VPN server (560) in the mapping table (556).

[0076] FIG. 5b is a diagram illustrating an example of a mapping table for managing IP changes according to one embodiment of the present disclosure.

[0077] Referring to FIG. 5B, a mapping table (e.g., mapping table (556)) may include at least one of a client IP indicating an IP address of a client device (e.g., electronic device (200)), a VPN IP indicating an IP address of a VPN server (e.g., VPN server (560)), a service ID identifying a service of the client device, a country indicating a location of the client device in the case of a location-based VPN service, a register datetime indicating a date and / or time when mapping information was registered, an update datetime indicating a date and / or time when mapping information was updated, or a last access datetime indicating a date and / or time when mapping information was last used. Although not shown, according to embodiments, the mapping table (556) may further include additional items, such as, for example, usage.

[0078] FIG. 6 is a flowchart illustrating the operation of an electronic device according to one embodiment of the present disclosure. In one embodiment, at least one of the operations described below may be executed by the processor (210) of the electronic device (200). In the embodiments below, the operations may be performed sequentially, but are not necessarily performed sequentially. For example, according to embodiments, at least one of the operations described below may be omitted, modified, or executed in a different order, and at least two operations may be performed in parallel.

[0079] Referring to FIG. 6, according to an embodiment, in operation 605, the electronic device (200) (e.g., the processor (210)) may obtain a VPN profile for a VPN connection with a VPN server (e.g., the VPN server (560)) through a relay server (e.g., the relay server (550)), and generate a VPN stack policy according to the VPN profile. In an embodiment, the VPN profile may include password information (e.g., an encryption algorithm and / or an encryption key) for tunneling between the electronic device (200) and the VPN server (560) and / or an IP address of the VPN server (560). The electronic device (200) may generate a VPN stack policy including the password information according to the VPN profile, the IP address of the VPN server (560), and / or the IP address of the relay server (550), and store the VPN stack policy in a memory (e.g., the memory (230)) in association with the VPN server (560).

[0080] In operation 610, the electronic device (200) (e.g., the processor (210)) may perform VPN communication with the VPN server (560) through the relay server (550) based on the VPN stack policy. In one embodiment, the VPN communication may include an operation of generating an IP packet including the IP address of the electronic device (200) as a source IP address and the IP address of the relay server (550) as a destination IP address, and transmitting the IP packet through the communication circuit (220).

[0081] In operation 615, the electronic device (200) (e.g., processor (210)) may determine whether the IP address of the electronic device (200) has changed. In one embodiment, if the electronic device (200) connects to a different network (e.g., a WiFi network or a cellular network) due to movement of the electronic device (200), or if IP reallocation occurs in the current network (e.g., a WiFi network or a cellular network) to which the electronic device (200) is connected, the electronic device (200) may determine that an IP address change has occurred and may acquire a changed IP address (e.g., a new IP address). If the IP address of the electronic device (200) has not changed, the electronic device (200) (e.g., processor (210)) may return to operation 610 and continue to perform VPN communication using the current IP address. If the IP address of the electronic device (200) is changed, the electronic device (200) (e.g., processor (210)) may proceed to operation 620.

[0082] At step 620, the electronic device (200) (e.g., processor (210)) may determine whether the electronic device (200) has valid VPN connection information (e.g., relay VPN connection information) related to a relay VPN. In one embodiment, if the electronic device (200) (e.g., processor (210)) is using Internet communication through a currently established VPN connection and the VPN connection includes a connection with a VPN server (560) through a relay server (550), the electronic device (200) (e.g., processor (210)) may determine that it has valid VPN connection information through a relay VPN (530) and may proceed to step 625.

[0083] In one embodiment, the electronic device (200) (e.g., the processor (210)) may maintain connection information related to the VPN server (560) according to a predefined condition even if the VPN connection with the VPN server (560) is disabled (or released). In one embodiment, the connection information (e.g., password information) may be obtained from the VPN server (560) when the VPN connection is established and may be valid until a predefined expiration time. In one embodiment, the electronic device (200) (e.g., the processor (210)) may store connection information related to the VPN server (560) in a memory (e.g., the memory (230)) even if the VPN connection with the VPN server (560) is disabled (or released), and / or if the stored connection information is valid (e.g., not expired), the electronic device (200) may proceed to operation 625 even if a VPN connection with the VPN server (560) is not currently established.

[0084] In one embodiment, if the electronic device (200) (e.g., processor (210)) does not have a VPN connection, or if the VPN connection includes a direct connection with a VPN server (560) (e.g., not via a relay server), or if the electronic device (200) (e.g., processor (210)) does not store valid connection information associated with the VPN connection (e.g., relay VPN connection information), the electronic device (200) (e.g., processor (210)) may return to operation 610.

[0085] In operation 625, the electronic device (200) (e.g., processor (210)) may transmit an IP change request to the relay server (550). In one embodiment, the IP change request may be included in an API command generated by the API communication module (514) or a packet (e.g., an IP packet) in a pre-defined format. In one embodiment, the IP change request may include a new IP address of the electronic device (200). In one embodiment, the IP change request may include information indicating an update method (e.g., replacement or addition) of the IP address.

[0086] In operation 630, the electronic device (200) (e.g., processor (210)) may apply the new IP address resulting from the IP address change to the VPN stack policy corresponding to the relay server (550) and the VPN server (560). In one embodiment, the electronic device (200) (e.g., processor (210)) may include the new IP address in the VPN stack policy.

[0087] In operation 635, the electronic device (200) (e.g., processor (210)) may perform VPN communication with the VPN server (560) through the relay server (550) based on the VPN stack policy including the new IP address. In one embodiment, the electronic device (200) (e.g., processor (210)) may continue to perform VPN communication based on the VPN stack policy including the new IP address without establishing a new VPN connection with the relay server (550).

[0088] FIG. 7 is a diagram illustrating a mapping table for a VPN connection according to one embodiment of the present disclosure.

[0089] Referring to FIG. 7, an electronic device (200) may be assigned a first IP address (e.g., 1.1.1.1) in a WiFi network of, for example, a public place (e.g., a park or a subway), and may establish a VPN connection (702) with VPN server 1 (712) through a relay server (550) using the first IP address. When the VPN connection (702) is established, the relay server (550) may add information mapping the first IP address of the electronic device (200) to VPN server 1 (712) (e.g., “1.1.1.1->VPN1”) to a mapping table (710). The mapping table (710) may include information (e.g., “6.6.6.6->VPN2, 7.7.7.7->VPN3”) that maps IP addresses of one or more clients (e.g., electronic device (200)) to one or more VPN servers (e.g., VPN server 1 (712), VPN server 2 (714), and VPN server 3 (716)). Here, VPN1, VPN2, and VPN3 may refer to the IP addresses of VPN server 1 (712), VPN server 2 (714), and VPN server 3 (716), respectively.

[0090] FIG. 8 is a diagram for explaining an update of a mapping table based on an IP address change according to one embodiment of the present disclosure.

[0091] Referring to FIG. 8, the electronic device (200) may be assigned a second IP address (e.g., 2.2.2.2) when moving from the WiFi network of FIG. 7 to another network (e.g., another WiFi network or a cellular network) or due to IP reallocation in the WiFi network of FIG. 7. The electronic device (200) may detect that an IP address change has occurred by acquiring the second IP address while having a VPN connection (702) with VPN server 1 (712) via the relay server (550), and may transmit an IP change request (802) to the relay server (550). In one embodiment, the IP change request (802) may be transmitted via an API command. In one embodiment, an IP packet including the IP change request (802) may include a source IP address set to a new IP address of the electronic device (200) (e.g., the second IP address 2.2.2.2) and IP address change information. In one embodiment, the IP address change information may indicate that the IP address of the electronic device (200) is changed from a first IP address (e.g., 1.1.1.1) to a second IP address (e.g., 2.2.2.2).

[0092] After transmitting the IP change request (802), the electronic device (200) may reflect the second IP address (e.g., 2.2.2.2) in the VPN stack policy stored in the VPN module (526). The VPN stack policy may include an encryption algorithm, an encryption key, the second IP address of the electronic device (200), and / or the IP address of the relay server (550) related to the VPN connection (702).

[0093] In response to the IP change request (802), the relay server (550) may add information (e.g., “2.2.2.2->VPN1”) for mapping the second IP address of the electronic device (200) to the mapping table (810) (e.g., mapping table (1110 or 1120)) to the VPN server 1 (712). In one embodiment, the relay server (550) may replace the existing mapping information (e.g., “1.1.1.1->VPN1”) of the electronic device (200) in the mapping table (810) (e.g., mapping table (1110)) with new mapping information (e.g., “2.2.2.2->VPN1”), or add the new mapping information to the mapping table (810) (e.g., mapping table (1120)) while maintaining the existing mapping information, according to a predetermined or requested update method (e.g., replacement or addition) from the electronic device (200).

[0094] Figure 9 illustrates a sequence diagram illustrating a relay VPN connection procedure according to one embodiment of the present disclosure. In the following embodiments, the operations may be performed sequentially, but are not necessarily sequential. For example, depending on the embodiments, at least one of the operations described below may be omitted, modified, or executed in a different order, and at least two operations may be performed in parallel.

[0095] Referring to FIG. 9, according to one embodiment, in operation 902, the electronic device (200) may transmit a VPN profile request for a VPN connection to the API server (540). The VPN profile request may include an IP address of the electronic device (200) (e.g., a first IP address 1.1.1.1). In one embodiment, the VPN profile request may include VPN profile information requested by the electronic device (200). In operation 904, the API server (540) may generate a VPN profile for the electronic device (200) in response to the VPN profile request (e.g., VPN profile information). The VPN profile may include cryptographic information (e.g., a cryptographic algorithm and / or an encryption key) to be shared between the electronic device (200) and a VPN server (e.g., a VPN server (560)) and / or a VPN ID that identifies the VPN connection.

[0096] In operation 906, the API server (540) may query the relay server (550) for the IP address of the VPN server to be connected while transmitting the VPN profile and the first IP address (e.g., 1.1.1.1) of the electronic device (200). In operation 908, the relay server (550) may query the VPN server (560) for the IP address of the VPN server to be connected while transmitting the VPN profile. At this time, the IP address of the electronic device (200) (e.g., the first IP address 1.1.1.1) may not be transmitted to the VPN server (560). In operation 910, the VPN server (560) may respond to the relay server (550) with the IP address (e.g., 30.30.30.30) of the VPN server (560). Although not shown, a query for the VPN server IP address of the relay server (550) may be forwarded to a VPN mapping server (not shown), and the VPN mapping server may respond to the relay server (550) with the IP address of the VPN server (560).

[0097] In operation 912, the relay server (550) may store mapping information between the IP address of the electronic device (200) (e.g., first IP address 1.1.1.1) received from the API server (540) and the IP address of the VPN server (560) (e.g., 30.30.30.30) in a mapping table (e.g., mapping table (710)). For example, the mapping information may include (client, vpn) = (1.1.1.1, 30.30.30.30).

[0098] In steps 914 and 916, the relay server (550) may transmit the VPN profile and the IP address (e.g., 200.200.200.200) of the relay server (550) provided from the API server (540) to the electronic device (200) via the API server (540). In one embodiment, in step 914, the relay server (550) may transmit the IP address of the relay server (550) to the API server (540), and in step 916, the API server (540) may transmit the VPN profile and the IP address of the relay server (550) to the electronic device (200). The electronic device (200) may store a VPN stack policy based on the VPN profile in the VPN module (526).

[0099] In operation 918, the electronic device (200) can perform communication using tunneling through the VPN connection established through operations 902 to 916.

[0100] The procedure for communicating through a VPN connection by the electronic device (200) in operation 918 is described as follows. The electronic device (200) can encrypt data to be transmitted and an actual destination address (e.g., real_dst) using an encryption algorithm and an encryption key stored in the VPN policy stack of the VPN module (526). The electronic device (200) can set the destination address (dst_IP) of an IP packet including the encrypted data (e.g., data to be transmitted and destination address) to 200.200.200.200, which is the IP address of the relay server (550), and transmit the IP packet to the relay server (550). For example, the IP packet transmitted by the electronic device (200) can include {src_IP: 1.1.1.1, dst_IP: 200.200.200.200, ENC(real_dst: XXXX, data to be transmitted)}. Here, ENC() can mean encrypted data.

[0101] The relay server (550) can receive the IP packet and find the IP address (e.g., 30.30.30.30) of the VPN server (560) mapped to the electronic device (200) in a mapping table (e.g., mapping table (710)). Based on the mapping table, the relay server (550) can reset the source IP address and the destination IP address of the IP packet to the IP address of the relay server (550) and the IP address of the VPN server (560), respectively. For example, the reset IP packet (e.g., the second IP packet) can include {src_IP: 200.200.200.200, dst_IP: 30.30.30.30, ENC(real_dst: XXXX, data to be transmitted)}. The relay server (550) can transmit the second IP packet to the VPN server (560).

[0102] The VPN server (560) can decrypt the encrypted data (e.g., ENC(real_dst: XXXX, data to be transmitted)) included in the second IP packet using an encryption algorithm and an encryption key agreed upon in advance with the electronic device (200), thereby obtaining the actual destination address (e.g., XXXX) and the data to be transmitted. The VPN server (560) can transmit an IP packet (e.g., a third IP packet) including the IP address of the VPN server (560) as a source IP address and including the actual destination address and the decrypted data to the actual destination address.

[0103] When the VPN server (560) receives an IP packet (e.g., a fourth IP packet) from an actual destination address, the VPN server (560) can encrypt the fourth IP packet and transmit it to the relay server (550). The relay server (550) can transmit the encrypted fourth IP packet to the electronic device (200). Since the actual data of the fourth IP packet transmitted through the relay server (550) is encrypted, the relay server (550) cannot know the actual data. Since the source IP address of the IP packet passing through the VPN server (560) is set to the IP address of the relay server (550), the VPN server (560) cannot know that the electronic device (200) is the source of the IP packet.

[0104] In operation 920, the electronic device (200) may detect that the IP address of the electronic device (200) has changed. For example, the IP address of the electronic device (200) may change from 1.1.1.1 to 2.2.2.2. In operation 922, if the electronic device (200) transmits an IP packet based on the changed IP address (e.g., 2.2.2.2) without an IP change request, the IP packet may not reach the relay server (550) or the VPN server (560), or may be discarded by the relay server (550) or the VPN server (560). In operation 924, the electronic device (200) may perform a VPN reconnection (e.g., operations 902 to 916) with the VPN server (560) through the relay server (550), for example, based on the fact that a response (e.g., ACK) to the IP packet is not received within a specified time period.

[0105] FIG. 10 illustrates a sequence diagram illustrating a procedure for notifying an IP address change according to one embodiment of the present disclosure. In one embodiment, operations 1002 through 1018 may be identical to or similar to operations 902 through 918. In the embodiments below, the operations may be performed sequentially, but are not necessarily performed sequentially. For example, according to embodiments, at least one of the operations described below may be omitted, modified, or performed in a different order, and at least two operations may be performed in parallel.

[0106] Referring to FIG. 10, according to one embodiment, in operation 1002, the electronic device (200) may transmit a VPN profile request for a VPN connection to the API server (540). The VPN profile request may include an IP address of the electronic device (200) (e.g., a first IP address 1.1.1.1). In one embodiment, the VPN profile request may include VPN profile information requested by the electronic device (200). In operation 1004, the API server (540) may generate a VPN profile for the electronic device (200) in response to the VPN profile request (e.g., VPN profile information). The VPN profile may include cryptographic information (e.g., a cryptographic algorithm and / or an encryption key) to be shared between the electronic device (200) and a VPN server (e.g., a VPN server (560)) and / or a VPN ID that identifies the VPN connection.

[0107] In operation 1006, the API server (540) may query the IP address of the VPN server to be connected while transmitting the VPN profile and the first IP address (e.g., 1.1.1.1) of the electronic device (200) to the relay server (550). In operation 1008, the relay server (550) may query the IP address of the VPN server to be connected while transmitting the VPN profile to the VPN server (560). At this time, the IP address of the electronic device (200) (e.g., the first IP address 1.1.1.1) may not be transmitted to the VPN server (560). In operation 1010, the VPN server (560) may respond to the relay server (550) with the IP address (e.g., 30.30.30.30) of the VPN server (560).

[0108] In operation 1012, the relay server (550) may store mapping information between the IP address of the electronic device (200) (e.g., first IP address 1.1.1.1) received from the API server (540) and the IP address of the VPN server (560) (e.g., 30.30.30.30) in a mapping table (e.g., mapping table (710)). For example, the mapping information may include (client, vpn) = (1.1.1.1, 30.30.30.30).

[0109] In operation 1014 and operation 1016, the relay server (550) may transmit the VPN profile and the IP address (e.g., 200.200.200.200) of the relay server (550) provided from the API server (540) to the electronic device (200) through the API server (540). In operation 1016a, the electronic device (200) may store a VPN stack policy based on the VPN profile in the VPN module (526). In one embodiment, the VPN stack policy may include at least one of a VPN ID, password information, an IP address of the electronic device (200), an IP address of the relay server (550), or an IP address of the VPN server (560). In operation 1018, the electronic device (200) may perform communication using tunneling through the VPN connection established through operations 1002 to 1016.

[0110] In operation 1020, the electronic device (200) may detect that the IP address of the electronic device (200) has changed to a new IP address (e.g., 2.2.2.2) while the VPN connection with the VPN server (560) is maintained or while connection information (e.g., relay VPN connection information) related to the VPN connection is valid. In one embodiment, the electronic device (200) may detect the IP address change through the wireless communication module (522) or the wired communication module (524).

[0111] In operation 1022 and operation 1024, the electronic device (200) may transmit an IP change request to the relay server (550) via the API server (540). In one embodiment, in operation 1022, the electronic device (200) may generate an API command including the IP change request by the API communication module (514) and then transmit the API command to the API server (540) via the communication module (520). In operation 1024, the API server (540) may transmit the API command including the IP change request to the relay server (550) via the API communication module (542). In one embodiment, the IP change request may include information notifying that the IP address of the electronic device (200) is changed (e.g., "1.1.1.1 -> 2.2.2.2"). In one embodiment, the IP change request (e.g., API command) may be received directly from the electronic device (200) to the relay server (550) (e.g., API communication module (552)) instead of passing through the API server (540). The API communication module (552) of the relay server (550) may forward the IP change request to the VPN mapping module (554).

[0112] In operation 1026, the relay server (550) may update the new IP address (e.g., 2.2.2.2) of the electronic device (200) in the mapping table (e.g., mapping table (810)) based on the IP change request received by the VPN mapping module (554).

[0113] In operation 1028, the electronic device (200) may apply the new IP address to the VPN stack policy managed by the VPN module (526) based on detecting the IP address change in operation 1020. In one embodiment, the electronic device (200) may change the IP address of the VPN stack policy to the new IP address.

[0114] In operation 1030, the electronic device (200) can continue to perform communication (e.g., tunneling) using the new IP address through the VPN connection established through operations 1002 to 1016 based on the VPN stack policy including the new IP address.

[0115] In one embodiment, the relay server (550) may replace existing mapping information (e.g., “1.1.1.1->VPN1”) of the electronic device (200) in the mapping table (810) with new mapping information (e.g., “2.2.2.2->VPN1”), or add the new mapping information to the mapping table (810) while maintaining the existing mapping information, according to a predetermined or requested update method (e.g., replacement or addition) from the electronic device (200). The electronic device (200) may determine an update method of an IP address through a user input and transmit information on the determined update method to the relay server (550).

[0116] FIG. 11A and FIG. 11B are diagrams for explaining an IP address update method according to embodiments of the present disclosure.

[0117] Referring to FIG. 11A, the relay server (550) may include (e.g., store) a mapping table (1110). Upon receiving an IP change request (e.g., the IP change request of operation 1022), the relay server (550) may replace existing mapping information (e.g., "1.1.1.1->VPN1") in the mapping table (1110) with new mapping information (e.g., "2.2.2.2->VPN1") based on the IP change request. Here, VPN1 may refer to the IP address of the VPN server (560) (e.g., 30.30.30.30). The relay server (550) may map the electronic device (200) to the VPN server (560) on a 1:1 basis without storing unnecessary resources (e.g., existing mapping information).

[0118] Referring to FIG. 11B, the relay server (550) may include (e.g., store) a mapping table (1120). Upon receiving an IP change request (e.g., the IP change request of operation 1022), the relay server (550) may add new mapping information (e.g., "2.2.2.2->VPN1") based on the IP change request to the mapping table (1120) without deleting existing mapping information (e.g., "1.1.1.1->VPN1") of the mapping table (1120). For example, the mapping table (1120) may include all of the plurality of mapping information (e.g., 1.1.1.1 -> 30.30.30.30 and 2.2.2.2 -> 30.30.30.30) of the electronic device (200).

[0119] In one embodiment, a situation may frequently occur in a network environment where the connected network changes depending on the physical location of the electronic device (200). For example, as the electronic device (200) moves within a wide space, the electronic device (200) may move from the WiFi network of AP1 to the WiFi network of AP2, and then return to the WiFi network of AP1 and reconnect to the WiFi network of AP1. In a situation where the network to which the electronic device (200) is connected frequently changes, the relay server (550) can provide a VPN service to the electronic device (200) without delay by utilizing existing mapping information without repeatedly deleting and adding mapping information.

[0120] FIG. 12 is a flowchart illustrating an operation for setting an IP address update method according to one embodiment of the present disclosure. In one embodiment, at least one of the operations described below may be executed by the processor (210) of the electronic device (200). In the embodiments below, the operations may be performed sequentially, but are not necessarily performed sequentially. For example, according to embodiments, at least one of the operations described below may be omitted, modified, or executed in a different order, and at least two operations may be performed in parallel.

[0121] Referring to FIG. 12, in one embodiment, at operation 1205, the electronic device (200) (e.g., the processor (210)) may display a relay VPN configuration UI (user interface) (e.g., via the display module (160)) related to a relay VPN connection. In one embodiment, the relay VPN configuration UI may include an object for receiving an IP update method (e.g., the IP update method configuration object (1315) of FIG. 13). The object may be configured to receive a user input for selecting either an alternative or additional method for updating an IP address change in a relay VPN connection. In one embodiment, the electronic device (200) (e.g., the processor (210)) may display the relay VPN configuration UI based on a user input requesting a relay VPN configuration, or while establishing a relay VPN connection.

[0122] In operation 1210, the electronic device (200) (e.g., the processor (210)) may receive a user input for selecting either an alternative or additional IP update method through the relay VPN setting UI. In operation 1215, the electronic device (200) (e.g., the processor (210)) may transmit IP update setting information indicating an IP update method based on the user input to the relay server (550). In one embodiment, the IP update setting information may be transmitted to the relay server (550) in a profile request (e.g., the profile request of operation 1002), an IP change request (e.g., the IP change request of operation 1022), or included in a designated IP packet.

[0123] In one embodiment, the electronic device (200) or relay server (550) can determine the IP address update method for each designated IP address. In one embodiment, the electronic device (200) or relay server (550) can set the IP address update method for an IP address or IP address group set by a user.

[0124] FIG. 13 is a diagram for explaining a UI for notifying a change in an IP address according to one embodiment of the present disclosure.

[0125] Referring to FIG. 13, the electronic device (200) may display information (1310) notifying an IP address change (e.g., via the display module (160)) while an IP address change for a new IP address is being processed (e.g., at least one of operation 1020, operation 1022, operation 1024, operation 1026, or operation 1028). In one embodiment, the information (1310) may include at least one of a phrase notifying an IP address change (e.g., “New IP detected - applying”), or an object (1315) for setting an IP address update method. In one embodiment, the information (1310) may be displayed by an application (512) of the electronic device (200) via any one of a notification, a pop-up, a push, or a top indicator. In one embodiment, the information (1310) may be displayed in the form of any one of an icon, text, or animation.

[0126] Embodiments of the present disclosure can prevent service delays and / or unnecessary traffic by maintaining existing tunneling (e.g., existing VPN connections) without re-establishing end-to-end tunneling when an IP address changes due to movement or handover of an electronic device (200) in a relay VPN environment. Embodiments of the present disclosure can increase connection availability when an IP address changes by reusing an existing tunnel (e.g., VPN connections), and can save resources of the electronic device (200) and the network (e.g., API server (540), relay server (550), and / or VPN server (560)).

[0127] An electronic device (200) according to one embodiment of the present disclosure may include a memory (230) for storing instructions, a communication circuit (220), and at least one processor (210) operatively connected to the memory and the communication circuit. The instructions, when executed by the at least one processor, may cause the electronic device to establish a VPN connection with a virtual private network (VPN) server (560) through a relay server (550) based on an IP address of the electronic device, using the communication circuit. The instructions, when executed by the at least one processor, may cause the electronic device to determine whether the IP address of the electronic device has changed. The instructions, when executed by the at least one processor, may cause the electronic device to determine whether the electronic device stores valid connection information related to the VPN server based on the IP address of the electronic device being changed to a new IP address. The instructions may cause the at least one processor to transmit an IP change request including the new IP address to the relay server based on the electronic device storing valid connection information related to the VPN server. The instructions, when executed by the at least one processor, may cause the electronic device to communicate with the VPN server through the VPN connection via the relay server based on the new IP address.

[0128] In one embodiment, the instructions may cause the electronic device to create a VPN stack policy associated with the VPN connection while establishing the VPN connection, and to apply the new IP address to the VPN stack policy based on the IP address of the electronic device being changed to the new IP address.

[0129] In one embodiment, the VPN stack policy may be configured to include a cryptographic algorithm and / or encryption key for tunneling between the electronic device and the VPN server.

[0130] In one embodiment, the commands may cause the electronic device to transmit the IP address change request to the relay server, causing the relay server to store the new IP address in a mapping table in association with the VPN server.

[0131] In one embodiment, the IP address change request may be included in an application programmable interface (API) command and transmitted from the electronic device to the relay server.

[0132] In one embodiment, the instructions may cause the electronic device to transmit IP update configuration information to the relay server, instructing the relay server to either replace or add to the manner in which the new IP address is updated.

[0133] In one embodiment, the IP address change request may include IP update configuration information that instructs the relay server to either replace or add to the method of updating the new IP address.

[0134] In one embodiment, the IP update setting information may instruct the relay server to replace first mapping information mapping the IP address of the electronic device to the VPN server with second mapping information mapping the IP address of the electronic device to the VPN server, when generally instructing a method of updating the new IP address.

[0135] In one embodiment, the IP update setting information may further instruct the relay server to maintain first mapping information that maps the IP address of the electronic device to the VPN server, and to additionally store second mapping information that maps the IP address of the electronic device to the VPN server, when further instructing a method of updating the new IP address.

[0136] In one embodiment, the commands may cause the electronic device to display a relay VPN configuration user interface (UI) and receive user input selecting either the replacement or the addition method for updating the new IP address via the relay VPN configuration UI.

[0137] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium storing one or more programs may include instructions configured to cause the electronic device (200) to: establish a VPN connection with a virtual private network (VPN) server (560) based on an IP address of the electronic device through a relay server (550), determine whether the IP address of the electronic device has changed, determine whether the electronic device stores valid connection information related to the VPN server based on the IP address of the electronic device being changed to a new IP address, transmit an IP change request including the new IP address to the relay server based on the electronic device storing valid connection information related to the VPN server, and communicate with the VPN server through the VPN connection through the relay server based on the new IP address.

[0138] In one embodiment, the at least one program may include instructions configured to cause the electronic device to: create a VPN stack policy associated with the VPN connection while establishing the VPN connection, and apply the new IP address to the VPN stack policy based on the IP address of the electronic device being changed to the new IP address.

[0139] In one embodiment, the VPN stack policy may include a cryptographic algorithm and / or encryption key for tunneling between the electronic device and the VPN server.

[0140] In one embodiment, the at least one program may include instructions configured to cause the electronic device to: transmit the IP address change request to the relay server, thereby causing the relay server to store the new IP address in a mapping table in association with the VPN server.

[0141] In one embodiment, the IP address change request may be included in an application programmable interface (API) command and transmitted from the electronic device to the relay server.

[0142] In one embodiment, the at least one program may include instructions configured to cause the electronic device to transmit IP update configuration information to the relay server, the IP update configuration information instructing the relay server to either replace or add to the manner in which the new IP address is updated.

[0143] In one embodiment, the IP address change request may include IP update configuration information that instructs the relay server to either replace or add to the method of updating the new IP address.

[0144] In one embodiment, the IP update setting information may instruct the relay server to replace first mapping information mapping the IP address of the electronic device to the VPN server with second mapping information mapping the IP address of the electronic device to the VPN server, when generally instructing a method of updating the new IP address.

[0145] In one embodiment, the IP update setting information may further instruct the relay server to maintain first mapping information that maps the IP address of the electronic device to the VPN server, and to additionally store second mapping information that maps the IP address of the electronic device to the VPN server, when further instructing a method of updating the new IP address.

[0146] In one embodiment, the at least one program may include instructions configured to cause the electronic device to: display a relay VPN configuration user interface (UI), and receive user input via the relay VPN configuration UI to select a method of updating the new IP address, either as the replacement or the addition.

[0147] Electronic devices according to the various embodiments disclosed in this document may take various forms. Electronic devices may include, for example, portable communication devices (e.g., smartphones), computer devices, portable multimedia devices, portable medical devices, cameras, wearable devices, or home appliances. Electronic devices according to the embodiments of this document are not limited to the aforementioned devices.

[0148] The various embodiments of this document and the terminology used therein are not intended to limit the technical features described in this document to specific embodiments, but should be understood to include various modifications, equivalents, or substitutes of the embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of the items, unless the context clearly indicates otherwise. In this document, each of the phrases "A or B", "at least one of A and B", "at least one of A or B", "A, B, or C", "at least one of A, B, and C", and "at least one of A, B, or C" can include any one of the items listed together in the corresponding phrase among those phrases, or all possible combinations thereof. Terms such as "first," "second," or "first" or "second" may be used merely to distinguish one component from another, and do not limit the components in any other respect (e.g., importance or order). When a component (e.g., a first component) is referred to as "coupled" or "connected" to another (e.g., a second component), with or without the terms "functionally" or "communicatively," it means that the component can be connected to the other component directly (e.g., wired), wirelessly, or through a third component.

[0149] The term "module" used in various embodiments of this document may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be an integral component, or a minimum unit or part of such a component that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0150] Various embodiments of the present document may be implemented as software (e.g., a program (240)) including one or more instructions stored in a storage medium (e.g., an internal memory (236) or an external memory (238)) readable by a machine (e.g., an electronic device (201)). For example, a processor (e.g., a processor (220)) of the machine (e.g., an electronic device (201)) may call at least one instruction among the one or more instructions stored from the storage medium and execute it. This enables the machine to operate to perform at least one function according to the at least one called instruction. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' simply means that the storage medium is a tangible device and does not contain signals (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently or temporarily on the storage medium.

[0151] According to one embodiment, the method according to various embodiments disclosed in this document may be provided as a computer program product. The computer program product may be traded between sellers and buyers as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or may be provided through an application store (e.g., Play Store). TM ) or directly between two user devices (e.g., smart phones), online distribution (e.g., downloading or uploading). In the case of online distribution, at least a portion of the computer program product may be at least temporarily stored or temporarily created in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or an intermediary server.

[0152] According to various embodiments, each component (e.g., a module or a program) of the above-described components may include one or more entities, and some of the entities may be separated and arranged in other components. According to various embodiments, one or more components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (e.g., a module or a program) may be integrated into a single component. In such a case, the integrated component may perform one or more functions of each of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. According to various embodiments, the operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

Claims

1. In an electronic device (200), Memory (230) for storing commands; Communication circuit (220); and At least one processor (210) operatively connected to the memory and the communication circuit, wherein the instructions, when executed by the at least one processor, cause the electronic device to: Using the above communication circuit, a VPN connection is established based on the internet protocol (IP) address of the electronic device and a virtual private network (VPN) server (560) through a relay server (550), Determining whether the IP address of the electronic device has changed, Determining whether the electronic device stores valid connection information related to the VPN server based on the IP address of the electronic device being changed to a new IP address; Based on the electronic device storing valid connection information related to the VPN server, transmitting an IP change request including the new IP address to the relay server, An electronic device characterized in that it communicates with the VPN server and the VPN connection through the relay server based on the new IP address.

2. In the first paragraph, the commands cause the electronic device to: While establishing the above VPN connection, create a VPN stack policy related to the above VPN connection, An electronic device characterized in that the new IP address is applied to the VPN stack policy based on the IP address of the electronic device being changed to the new IP address.

3. In paragraph 1 or 2, the VPN stack policy is: An electronic device characterized by including a cryptographic algorithm and / or an encryption key for tunneling between the electronic device and the VPN server.

4. In any one of paragraphs 1 to 3, the commands cause the electronic device to: An electronic device characterized in that it transmits the IP address change request to the relay server, causing the relay server to store the new IP address in a mapping table in association with the VPN server.

5. In any of paragraphs 1 to 4, the IP address change request is: An electronic device characterized in that it is included in an API (application programmable interface) command and transmitted from the electronic device to the relay server.

6. In any one of paragraphs 1 to 5, the commands cause the electronic device to: An electronic device characterized in that it transmits IP update setting information to the relay server, instructing the relay server to either replace or add a method of updating the new IP address.

7. In any one of paragraphs 1 to 5, the IP address change request is: An electronic device characterized by including IP update configuration information that instructs the relay server to either replace or add a method of updating the new IP address.

8. In clause 6 or clause 7, the IP update setting information is: An electronic device characterized in that when generally instructing a method of updating said new IP address, the relay server is instructed to replace first mapping information mapping said IP address of said electronic device to said VPN server with second mapping information mapping said IP address of said electronic device to said VPN server.

9. In clause 6 or 7, the IP update setting information is: An electronic device characterized in that when further instructing a method of updating said new IP address, the relay server is further instructed to maintain first mapping information mapping said IP address of said electronic device to said VPN server, and to additionally store second mapping information mapping said IP address of said electronic device to said VPN server.

10. In any one of paragraphs 6 to 9, the commands cause the electronic device to: Displays the relay VPN settings UI (user interface), An electronic device characterized in that it receives user input selecting either the replacement or the addition method of updating said new IP address via said relay VPN setup UI.

11. In a non-transitory computer-readable storage medium storing one or more programs, the one or more programs, when executed by at least one processor (210) of an electronic device (200), cause the electronic device to: Establishing a VPN connection based on the IP address of the electronic device and a virtual private network (VPN) server (560) through a relay server (550), Determining whether the IP address of the electronic device has changed, Determining whether the electronic device stores valid connection information related to the VPN server based on the IP address of the electronic device being changed to a new IP address; Based on the electronic device storing valid connection information related to the VPN server, transmitting an IP change request including the new IP address to the relay server, A storage medium characterized by including commands configured to communicate with the VPN server and the VPN connection through the relay server based on the new IP address.

12. In paragraph 11, the at least one program causes the electronic device to: While establishing the above VPN connection, create a VPN stack policy related to the above VPN connection, Contains commands configured to apply the new IP address to the VPN stack policy based on the IP address of the electronic device being changed to the new IP address; The above VPN stack policy is: A storage medium characterized by including an encryption algorithm and / or an encryption key for tunneling between the electronic device and the VPN server.

13. In claim 11 or 12, said at least one program causes said electronic device to: Contains commands configured to transmit the above IP address change request to the relay server, causing the relay server to store the new IP address in a mapping table in association with the VPN server; The above IP address change request is, A storage medium characterized in that it is transmitted from the electronic device to the relay server, and is included in an API (application programmable interface) command.

14. In any one of paragraphs 11 to 13, said at least one program causes said electronic device to: Contains commands configured to cause said relay server to transmit IP update configuration information that instructs said relay server to either replace or add a method of updating said new IP address; The above IP address change request is, Contains IP update configuration information that instructs the relay server to either replace or add a method of updating the new IP address; The above IP update settings information is: When generally instructing a method of updating said new IP address, instructing said relay server to replace first mapping information mapping said IP address of said electronic device to said VPN server with second mapping information mapping said IP address of said electronic device to said VPN server, The above IP update settings information is: A storage medium characterized in that when further instructing a method of updating said new IP address, the relay server is instructed to maintain first mapping information mapping said IP address of said electronic device to said VPN server, and to additionally store second mapping information mapping said IP address of said electronic device to said VPN server.

15. In paragraph 14, the at least one program causes the electronic device to: Display the relay VPN settings UI (user interface) through the display module, A storage medium comprising instructions configured to receive a user input selecting either the replacement or the addition method of updating the new IP address via the relay VPN setup UI.

Images