CN1231024C - Virtual specsel net realizing method based on dynamic IP address and system - Google Patents

Abstract

The present invention discloses a realization method and a system of a virtual private network (VPN) based on a dynamic IP address. The method comprises the following steps that an address server for managing a dynamic IP address is established in an IP public network; the information of the dynamic IP address, a name, etc. is registered in the address server by a gateway of a virtual private network; when an initiating end gateway needs to be connected to a target gateway, the initiating end gateway is firstly enquired in the address server to obtain an IP address of the target gateway, and the IP address is used for establishing connection. The system of the present invention comprises an IP network, a virtual private network gateway which is connected with the IP network, and the address server for managing the dynamic IP address. A dynamic IP address management module and a data module are arranged in the address server. Public components of the address server are fully used by the present invention, and a VPN network can be conveniently established under the condition that the fixed IP address of a target VPN is not known by a VPN gateway. The present invention is very convenient and economical for an enterprise adopting dialing to be accessed in the IP network.

Description

Method and system for realizing virtual private network based on dynamic IP address

technical field

The invention relates to a virtual private network realization method and system based on a dynamic IP address.

Background technique

Virtual private network (Virtua1 Private Network, referred to as VPN) is to use public network infrastructure to achieve data security transmission similar to private private network through "tunnel" technology and other means. The network has the characteristics of virtuality: VPN is not a closed circuit proprietary to a certain company or a closed circuit provided by a leased network service provider, but at the same time, VPN has the data transmission function of a dedicated line, because a VPN can be used in a public network like a dedicated line. Handle your company's information on the Internet.

How a VPN works:

IP-based VPN basically comes down to two categories: dial-up VPN (commonly known as VDPN, that is, virtual dial-up private network) and dedicated line VPN (Dedicated VPN, that is, dedicated line VPN). A complete VPN solution usually combines dial-up VPN and dedicated line VPN Combined together to meet the needs of all users.

Dial-up VPN:

Dial-up VPN (VDPN) provides remote access to the corporate network for mobile users and telecommuting users. This is the most common form of VPN deployment today, mainly based on the L2F (Layer 2 Forwarding Protocol) protocol. VDPN allows users in many different fields to obtain secure access to their corporate internal network through the public network or the Internet or other public networks. Dial-up VPN can be divided into client-initiated (Client-Initiated) VPN and NAS-initiated VPN.

In the VPN initiated by the customer, the user dials to the local POP, and the customer sends the request and establishes an encrypted tunnel to the intranet of the enterprise. In order to establish a secure connection, the client runs IPsec software, and the client software communicates with the IPsec process on the company's internal network firewall, or directly communicates with routers that support IPsec to ensure the security of the connection. The characteristics of this form of VPN are:

(1) Remote users can establish IP tunnels (IPTunnel) with multiple home gateways (Home Gateway) at the same time.

(2) The remote user can enter another network without redialing.

(3) The establishment and management of VPN has nothing to do with the Internet service provider (ISP: internet service provider).

(4) This encrypted VPN tunnel is transparent to the service provider, and requires dedicated dial-up software on the client side.

(5) The client needs to know the fixed IP address of the enterprise in order to authenticate to the server of the enterprise.

In NAS-initiated VPN, the NAS in the service provider POP requests and creates a VPN tunnel to the customer company router (or Home Gateway). The NAS uses the L2F (Layer 2 Forwarding Protocol) or L2TP (Layer 2 Tunneling Protocol) protocol to establish a secure tunnel to the customer's Home Gateway.

In this form of dial-up VPN, user authentication is handled in two levels. When a user dials in, the service provider NAS first performs basic authentication, which only identifies the user's company identity. Then, the NAS opens a tunnel to the user's company's Home Gateway, and the Home Gateway performs user-level authentication. When this type of VPN is authenticated, the service provider also needs to know the IP address of the enterprise's Home Gateway.

Dedicated VPN:

In the private line VPN based on IP Tunnel, the point-to-point protocol (PPP: Point to Point Protocol) data packet flow is transmitted through the tunnel on the shared IP network. Tunnels are formed by tunneling protocols, which is no different from popular networks that rely on corresponding network protocols to complete communication. In order to transmit data packets from different networks, the most commonly used method is to first encapsulate various network protocols (IP, IPX, AppleTalk, etc.) into PPP, and then encapsulate the entire PPP data into the tunnel protocol. In this case, the fixed IP addresses of the individual endpoints need to be known.

In a VPN based on virtual circuits, service providers can provide virtual circuits to establish IP VPN services. Use PVC to establish point-to-point connections in Frame Relay (Frame Relay) and ATM networks, and manage layer 3 information through routers. Telecom operators or post offices can use this method to make full use of their existing frame switching (such as frame relay) or cell switching (such as ATM) infrastructure to provide IP VPN services.

It can be seen from the above that no matter dial-up VPN or leased-line VPN, at least one fixed IP address is required as the authentication control center. However, for small enterprises, or chain enterprises, each branch is relatively small, using broadband or narrowband access based on dynamic IP is the most economical way, but it is difficult to use traditional VPN technology to establish dynamic IP users in the way of existing technologies VPN between groups, unless the current IP address is exchanged with each other through artificial means. This is especially true for small groups of individuals.

Contents of the invention

The purpose of the present invention is to provide a method and system for realizing a virtual private network based on a dynamic IP address, so as to satisfy the automatic establishment of a VPN under the condition of a dynamic IP address.

The method of the present invention comprises the following steps: set up the address server of management dynamic IP address in IP public network; The gateway of virtual private network obtains the public network IP address of outlet by setting up the connection to IP public network; Virtual private network gateway is in Register in the address server, at least register the gateway name and dynamic IP address in the address server; when the initiator needs to connect to the target gateway, the gateway of the initiator first queries the address server to obtain the IP address of the target gateway, and uses the IP address to establish a connection.

The system of the present invention at least includes an IP network and a virtual private network gateway connected to the network, and its structural feature is that an address server for managing dynamic IP addresses is connected to the IP network, and a dynamic IP address management module is arranged in the address server and data module; the virtual private network gateway sends at least the information comprising its own name and dynamic IP address to the address server through the IP network; the dynamic IP address management module stores the information of the virtual private network gateway in the data module, according to the initiation The query request of the terminal obtains the dynamic IP address of the target gateway from the data module, and the address server provides it to the gateway of the initiator.

The present invention realizes the automatic establishment of VPN under the condition of dynamic IP address by increasing the mechanism of dynamic IP address registration and query, and effectively solves the technical problem that it is difficult to establish a VPN between dynamic IP user groups in the prior art by adopting traditional VPN technology. It does not have any impact on the establishment process of the VPN itself. Compared with the prior art, the present invention is simple and easy to implement. For the address server, it can also be implemented by using public services such as WEB, WEB service (WEB SERVICE), Lightweight Target Access Protocol (LDAP: Lightweight Directory Access Protocol), domain name service (DNS: domain name server) commonly used on the Internet, Therefore, its implementation cost is lower.

Description of drawings

Fig. 1 is the system block diagram realizing the present invention;

Fig. 2 is a flowchart of the present invention;

Fig. 3 is the flowchart of VPN gateway registration among the present invention;

Fig. 4 is a schematic diagram of VPN establishment process;

Fig. 5 is a flow chart of implementing the address server of the present invention using a WEB server.

Detailed ways

Referring to Figure 1 and Figure 2: the address server includes a dynamic IP address management module and a data module. The address server is connected to the IP public network and is used to manage the dynamic IP address of the VPN gateway accessing the public network. The address server has a fixed IP address, such as 66.77.9.76. The private networks in branch 1 and branch 2 are connected to the IP public network through the VPN gateway, and the gateway adopts the point-to-point protocol (PPP: Point to Point Protocol), and the point-to-point protocol of Ethernet (PPPOE: PPP over Ethernet) is established to the IP network. web link. When the gateway is connected to the IP public network, a dynamic public IP address is obtained. Then, the gateway registers in the address server, registers the gateway name, public IP address, authentication password and other related information to the address server, and the dynamic IP The address management module stores it in the data module, as shown in FIG. 3 . If the registration is successful, the address server will give confirmation. When a connection needs to be established between virtual private networks (VPN), the initiator first inquires the IP address of the target gateway from the address server, and the dynamic IP address management module obtains the dynamic IP address of the target gateway from the data module, which is provided by the address server to Initiating gateway. After the initiator obtains the IP address of the target gateway from the address server, it establishes a connection through the IP address. The initiator must pass the authentication when querying. For gateways that have not passed the authorization authentication, the address service refuses to query to ensure information security.

Referring to FIG. 4, the figure shows the process of establishing a connection between gateway A and gateway B of the virtual private network. The public network IP addresses 61.145.x.x, 61.135.x.x, names, authorization passwords and other relevant information at the exits of VPN gateway A and VPN gateway B have been registered in the address server. When VPN gateway B needs to establish a connection with VPN gateway A, VPN gateway B establishes a connection with the address server through the fixed IP address 66.77.9.76, and obtains the dynamic public network IP address 61.145.x.x of the VPN gateway from the server through the authorization and authentication of VPN gateway A. VPN gateway B negotiates to establish a VPN based on the obtained IP address 61.145.x.x of target gateway A. After completion, a VPN tunnel is established between VPN gateway A and VPN gateway B.

There may be multiple address servers in the present invention, and they shall be reasonably distributed according to regions.

The address server can be an independent server, and it can also be implemented by using public services such as WEB, WEBSERVICE, LDAP, and DNS commonly used on the Internet; the address server is established in the form of WEB SERVICE, and the VPN gateway can use Simple Object Access Protocol (SOAP: Simple Object Access Protocol) interacts with the address service, and discovers the service through Universal Description, Discovery, and Integration (UDDI: Universal Description, Discovery, and Integration); the address server is provided by LDAP SERVER, and the VPN gateway can interact with the address service through the LDAP protocol; the address The server uses a custom protocol based on TCP/IP, and the VPN gateway interacts with the address service through a custom protocol carried on top of the TCP/IP protocol.

Fig. 5 shows the process when the address server is realized by using a WEB server. Since most enterprises have WEB websites, they can embed this service into their own websites, and the reliability and security can be controlled by the enterprises themselves. At the same time, the VPN gateway needs to be configured with the webpage address of the corresponding service. It can be seen from the figure that the interaction process between VPN gateway A and VPN gateway B and the address server has changed, and the hypertext transfer protocol (HTTP) is used to carry the relevant registration and query information.

An enterprise can have its own address server, so that all the Internet of the enterprise can be accessed by dial-up or ADSL without special support from the operator.

There can also be an independent service provider to provide such services to the public. In this way, for enterprises, they can only use dial-up access or ADSL dynamic access to connect, and they do not need to maintain address servers.

The invention makes full use of the public address server part, so that the VPN gateway can conveniently establish a VPN network without knowing the fixed IP address of the target VPN. It is very convenient and economical for enterprises using fully distributed dial-up access.

Claims (15)

1, based on the Virtual Private Network implementation method of dynamic IP addressing, it is characterized in that: may further comprise the steps:

In the IP public network, set up the address server of management dynamic IP addressing;

The connection of the gateway of Virtual Private Network by being established to the IP public network is to obtain the public network IP address in exit;

The Virtual Private Network gateway is registered in address server, is registered in the address server to major general's gateway name and dynamic IP addressing;

When originating end need be connected to intended gateway, the gateway of originating end was inquired about the IP address with the acquisition intended gateway earlier from address server, and utilizes this IP address to connect;

Described originating end is the originating end that request connects at Virtual Private Network, and described intended gateway is a gateway of accepting the Virtual Private Network of this request.

2, method according to claim 1 is characterized in that: described address server is address server independently.

3, method according to claim 1 and 2 is characterized in that: described address server is a plurality of, and distributes according to the region.

4, method according to claim 1 is characterized in that: described address server is the WEB server, and this WEB server adopts HTML (Hypertext Markup Language) to exchange with the gateway of Virtual Private Network.

5, method according to claim 1 is characterized in that: described address server adopts the WEB service manner to set up, and the virtual private gateway is mutual by Simple Object Access Protocol and address server.

6, method according to claim 1 is characterized in that: described address server adopts lightweight target access protocol server to provide, and the virtual private gateway is mutual by lightweight target access agreement and address server.

7, method according to claim 1 is characterized in that: the Virtual Private Network gateway also comprises when registering in address server authentication password is registered in the address server.

8, method according to claim 1 is characterized in that: the IP address that initiating end gateway inserts the IP public network is that dynamical fashion distributes.

9, method according to claim 1 is characterized in that: carry out authorization identifying before the IP address of initiating end gateway query aim gateway from address server, to the gateway by authorization identifying, address server provides inquiry service, otherwise the refusal inquiry.

10, a kind of system of method according to claim 1 that realizes, at least comprise IP network and the Virtual Private Network gateway that is connected with this network, it is characterized in that: be connected with the address server of management dynamic IP addressing in the described IP network, be provided with dynamic IP addressing administration module and data module in this address server;

Described Virtual Private Network gateway sends the information comprise self title and dynamic IP addressing at least by IP network to address server;

Described dynamic IP addressing administration module in data module, from data module obtains the dynamic IP addressing of intended gateway according to the query requests of originating end with the information stores of Virtual Private Network gateway, offers initiating end gateway by address server;

Described originating end is the originating end that request connects at Virtual Private Network, and described intended gateway is a gateway of accepting the Virtual Private Network of this request.

11, system according to claim 10 is characterized in that: described address server is a plurality of, and distributes according to the region.

12, system according to claim 10 is characterized in that: the authorization message that also comprises the virtual private gateway in the described data module.

13, system according to claim 10 is characterized in that: described address server is the WEB server, and this WEB server adopts HTML (Hypertext Markup Language) to exchange with the gateway of Virtual Private Network.

14, system according to claim 10 is characterized in that: described address server is the server of WEB World Wide Web, and the virtual private gateway is mutual by Simple Object Access Protocol and address server.

15, system according to claim 10 is characterized in that: described address server is a lightweight target access protocol server, and the virtual private gateway is mutual by lightweight target access agreement and address server.

Images