18 results about "IP tunnel" patented technology

A client device communicates with a network via a host device as an intermediary through a virtual link technique in which an Internet Protocol (IP) tunnel is established between the client device and the host device, and a plurality of physical links between the host device and the client device are assigned or otherwise associated with the IP tunnel such that the IP tunnel acts as a single virtual link between the client device and the host device, with fixed IP addresses, but therein data can be communicated between the client device and the host device on different physical links according to routing policy that includes routing rules for routing data packets between the different physical links according to one or more parameters.

A client device communicates with a network via a host device as an intermediary through a virtual link technique in which an Internet Protocol (IP) tunnel is established between the client device and the host device, and a plurality of physical links between the host device and the client device are assigned or otherwise associated with the IP tunnel such that the IP tunnel acts as a single virtual link between the client device and the host device, with fixed IP addresses, but therein data can be communicated between the client device and the host device on different physical links according to routing policy that includes routing rules for routing data packets between the different physical links according to one or more parameters.

The invention provides a data deduplication system and method based on an inter-network security IP tunnel, and the system comprises the inter-network security IP tunnel which is established between a local area network and a data center based on a programmable switch. The encryption module is used for encrypting the whole data packet related to data deduplication leaving the local area network and the data center and decrypting the whole data packet related to data deduplication entering the local area network and the data center; the edge switch corresponding to the storage server is used for completing data deduplication and encrypted online calculation; and the centralized controller in the data center network is responsible for carrying out key negotiation with the controller in the local area network. According to the method, finer duplicate removal granularity can be supported, so that the efficiency of deleting the duplicate data can be remarkably improved while acceptable extra storage cost is introduced and CPU (Central Processing Unit) consumption of a server is reduced.

The concepts and technologies disclosed herein are directed to software-defined wide-area network (“SD-WAN”) self-service for service assurance. The proposed SD-WAN self-service solution can be used for any policy-driven system that automatically troubleshoots the problems resulting from hybrid SD-WAN network activities, including virtual private network (“VPN”), IP tunnel, IPSec, and security policies. According to one aspect disclosed herein, a method can check network configurations, analyze switch responses, and locate network problems quickly. Moreover, the method can test the functionality of a rules-based troubleshooting software effectively without employing expensive testing equipment and with minimal human intervention. Without the disclosed solution, telecommunications service providers may have to hire more software engineers who understand SDN and cloud technologies to effectively troubleshoot SD-WAN network connectivity issues, including issues caused by virtual network function (“VNF”), virtual machine (“VM”), and SDN switches. Thus, this labor-intensive solution is not only expensive, but also not immune to human error.

The invention relates to a communication method and device, communication equipment, a readable storage medium and a computer program product. The method comprises: sending a first NAS message to an AMF network element, the first NAS message carrying a wireless local area network user plane access identifier, the wireless local area network user plane access identifier being used for indicating that a user plane data bearer is established on a wireless local area network; receiving a second NAS message sent by the AMF network element, wherein the second NAS message carries the IP address of the gateway; the IP address of the gateway is acquired by the AMF network element in response to the wireless local area network user plane access identifier; and establishing an IP tunnel between the UE and the gateway based on the wireless local area network IP address of the UE and the IP address of the gateway. By adopting the method, a mode for accessing the 5G core network from the non-3GPP access network, which is wider in application range, is provided.

This disclosure provides a method for routing of application traffic between a local and a central part of a Distributed Network, DN. The method comprises transmitting from a first network node to a second network node a first tunnel request to set up a tunnel between two Distributed Network Address Identifiers (DNAIs), the first tunnel request including at least one supported tunneling mechanism or protocol; transmitting from the second network node to a third network node a second tunnel request including the at least one supported tunneling mechanism or protocol and the two DNAIs; selecting at the third network node one of the at least one supported tunneling mechanism or protocol; determining at the third network node a first and a second User Plane Function (UPF) as the tunnel endpoints based on the DNAIs and the selected tunneling mechanism or protocol, particularly wherein the first UPF or the second UPF is a UPF in a central part of the DN or a local part of the DN; initiating at the third network node a N4 Session Establishment procedure with the first UPF, wherein the initiating further comprises receiving at the SMF from the first UPF an N4 Session Establishment Response including a Tunnel Endpoint Identifier (TEID) for uplink traffic of the tunnel, particularly wherein the TEID is selected by the first UPF; initiating at the third network node a N4 Session Establishment procedure with the second UPF to provide the TEID for uplink traffic of the tunnel and an IP tunnel endpoint address for uplink traffic, particularly wherein the IP tunnel endpoint address is obtained from an UPF or configured in the SMF, and particularly wherein the IP tunnel endpoint address further comprises a port number; transmitting from the third network node to the second network node a tunnel response including the selected tunneling mechanism or protocol and the IP tunnel endpoint address; and transmitting from the second network node to the first network node a tunnel response including the selected tunneling mechanism or protocol and the IP tunnel endpoint address.

Technologies directed to Internet Protocol (IP) tunnels for cloud-based applications on a streaming device are described. One method receives a request to execute a streaming application hosted by the remote computing device. The method establishes a first IP tunnel with the remote computing device using a first virtual interface. The method establishes a second IP tunnel with a container executing the streaming application using a second virtual interface. The method establishing routing between the second virtual interface and a local network interface. The method communicates data with the streaming application over the second IP tunnel.

The invention provides a method for determining tunnel connectivity. The method is applied to a first communication device supporting BFD (Bidirectional Forwarding Detection). The method comprises the following steps: generating and sending a first message, wherein the first message is a BFD (Bidirectional Forwarding Detection) message which is initiated by single-end equipment and is used for detecting the connectivity of a bidirectional tunnel; the first message comprises outer-layer tunnel information, inner-layer tunnel information and BFD control information. The outer-layer tunnel information indicates a first tunnel from the first communication device to the second communication device, and the inner-layer tunnel information indicates a second tunnel from the second communication device to the first communication device. The first tunnel and the second tunnel are IP tunnels. If both the first tunnel and the second tunnel have no fault, the first message is finally forwarded to the first communication device based on the outer-layer tunnel information and the inner-layer tunnel information, and correspondingly, the first communication device can determine the connectivity of the two-way tunnel. By using the scheme, even if the IP tunnel only comprises a single endpoint to support the BFD technology, the connectivity of the bidirectional tunnel can be determined.

One aspect of the invention relates to a method for establishing an IPCON (Mission Critical Data Internet Protocol Connectivity) MCData session in a communication network according to the 3GPP MCS (3rd Generation Partnership Program Mission Critical System) standard. The network comprises a sending MCData entity, a receiving MCData entity, and an MCData transport service connected to the sending and receiving MCData entities.The process includes: Obtaining (20), by the sending MCData entity, a DPPK "MCData Payload Protection Key" and a DPPK-ID "MCData Payload Protection Key Identifier", Transmitting (30), by the sending MCData entity to the receiving MCData entity via the MCData transport service a SIP-INVITE message including the DPPK and the DPPK-ID, Authenticating (40), by the receiving MCData entity, the message, and Determining (50), by the receiving MCData entity, the DPPK and the DPPK-ID and establishing an IP tunnel between the sending MCData entity and the receiving MCData entity.

The invention discloses a VPDN-based enterprise intranet security access method, apparatus and device, and a medium. The method comprises the steps of performing user identity authentication through fingerprint authentication Dongle; establishing a 5G session between the user terminal and a 5G core network through the fingerprint authentication Dongle, and establishing an L2TP tunnel session between the 5G core network and an enterprise LNS; requesting a private network IP address of a target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle; the private network IP address is used as an inner-layer IP address, an L2TP tunnel is used as an outer-layer IP tunnel layer, an enterprise intranet access request is sent to an enterprise LNS through a 5G core network, and tunnel encryption transmission is carried out on the enterprise intranet access request through an IPSec protocol; and forwarding the enterprise intranet access request to a corresponding target enterprise intranet through the enterprise LNS. The method improves the safety and convenience of remote access to the enterprise intranet, and can be widely applied to the technical field of networks.

The invention discloses a method and device for accessing an external service and electronic equipment, and the method applied to a master node of a K8S cluster comprises the following steps: decapsulating a tunnel message from a slave node received from an IP tunnel, and obtaining an original access message for accessing the external service of the K8S cluster; replacing the source address of the original access message with the IP address of the main node, generating an external access message, and storing an address conversion record; wherein the IP address of the main node is an IP address which is authenticated by an external service and has access authority; and forwarding the external access message to an external service corresponding to the destination address. Under the condition of not depending on an external gateway, the method can be particularly applied to a scene with a large number of two-layer networking or a security-limited K8S cluster scene, it can be guaranteed that a unified IP address is used for accessing external services, and the security is enhanced.

A method for establishing an IPCON Mission Critical Data Internet Protocol Connectivity MCData session in a communications network according to the 3GPP MCS 3rd Generation Partnership Program Mission Critical System standard. The network includes an emitting MCData entity, a destination MCData entity and an MCData transport service connected to the emitting and destination MCData entities. The method includes obtaining, from the emitting MCData entity, a DPPK MCData Payload Protection Key and a DPPK-ID MCData Payload Protection Key Identifier, transmitting a SIP-INVITE message comprising the DPPK key and the DPPK-IK key identifier, from the emitting MCData entity to the destination MCData entity via the MCData transport service, authenticating the message, by the destination MCData entity, and determining the DPPK key and the DPPK-ID key identifier, by the destination MCData entity, and establishing an IP tunnel between the emitting MCData entity and the destination MCData entity.

The invention discloses a data transmission method, device and system for a dense network, and belongs to the technical field of communication. The method comprises the following steps: packaging each IP data packet to be sent by adopting a UDP tunnel packaging technology to obtain UDP tunnel packaging data; and packaging each IP link into an IP tunnel based on the UDP through the operation, and packaging an IP data packet to be sent as a load of a UDP packet into an LLC frame to be transmitted in the IP tunnel. And the LLC frame is filled with the serial number of the UDP tunnel encapsulation data, the serial number of the dense network link for transmission and the retransmission mark, so that a receiving end can conveniently realize parallel transmission and ordered submission in the dense network, the adaptability is relatively high, and the transmission rate is relatively high. On this basis, a retransmission mechanism based on an ARQ feedback frame is designed to ensure reliability. On the basis, data transmission of the dense network, which is relatively high in adaptability and relatively high in transmission rate, can be realized on the premise of ensuring the reliability.

The present application relates to communication methods, an apparatus, a communication device, a readable storage medium and a computer program product. A method comprises: sending to an AMF network element a first NAS message, the first NAS message carrying a wireless local area network user plane access identifier, and the wireless local area network user plane access identifier being used for indicating that a user plane data bearer is established on a wireless local area network; receiving a second NAS message sent by the AMF network element, the second NAS message carrying an IP address of a gateway, and the IP address of the gateway being acquired by the AMF network element in response to the wireless local area network user plane access identifier; and, on the basis of a wireless local area network IP address of the UE and the IP address of the gateway, establishing an IP tunnel between the UE and the gateway.

The invention belongs to the technical field of human capital evaluation, financial science and technology and data security, and provides a talent financial value grade dynamic evaluation system based on a pricing golden rudder. The method comprises the following steps of: generating identification, calculating credibility, verifying security protection capability and generating a pre-authorization rule; encrypting fragmented talent sensitive data by a transmission channel module according to fields; a quantum encryption transmission channel and a dynamic IP tunnel are established, a data source calling evidence storage module stores an API calling behavior and verifies access compliance in real time, a risk decision module generates a dynamic risk score and a three-level response strategy, and a pricing golden rudder module generates a dynamic financial value level from four dimensions of talent, color, acquisition and financial based on processed data. Through multi-module cooperation, talent data full-process safety management and control and dynamic value evaluation are realized, and data interaction safety, evaluation accuracy and risk response efficiency are improved.

The application provides a data deduplication system and method based on an Internet security IP tunnel, which comprises: an Internet security IP tunnel based on a programmable switch between a local area network and a data center, which is used for encrypting the whole data packet of data deduplication related data packets leaving the local area network and the data center and decrypting the whole data packet of data deduplication related data packets entering the local area network and the data center; an edge switch corresponding to a storage server, which is used for completing in-network computing of data deduplication and encryption; and a centralized controller inside the data center network, which is responsible for key negotiation with a controller inside the local area network. The application can support a finer deduplication granularity, so that the efficiency of the data deduplication can be significantly improved while introducing acceptable additional storage costs and reducing the consumption of the server CPU.

The concepts and technologies disclosed herein are directed to software-defined wide-area network (“SD-WAN”) self-service for service assurance. The proposed SD-WAN self-service solution can be used for any policy-driven system that automatically troubleshoots the problems resulting from hybrid SD-WAN network activities, including virtual private network (“VPN”), IP tunnel, IPSec, and security policies. According to one aspect disclosed herein, a method can check network configurations, analyze switch responses, and locate network problems quickly. Moreover, the method can test the functionality of a rules-based troubleshooting software effectively without employing expensive testing equipment and with minimal human intervention. Without the disclosed solution, telecommunications service providers may have to hire more software engineers who understand SDN and cloud technologies to effectively troubleshoot SD-WAN network connectivity issues, including issues caused by virtual network function (“VNF”), virtual machine (“VM”), and SDN switches. Thus, this labor-intensive solution is not only expensive, but also not immune to human error.