CN115529206A - Remote and mobile office cooperative control system and access method based on dial-up cloud VPN - Google Patents

Remote and mobile office cooperative control system and access method based on dial-up cloud VPN Download PDF

Info

Publication number
CN115529206A
CN115529206A CN202211209601.4A CN202211209601A CN115529206A CN 115529206 A CN115529206 A CN 115529206A CN 202211209601 A CN202211209601 A CN 202211209601A CN 115529206 A CN115529206 A CN 115529206A
Authority
CN
China
Prior art keywords
vpn
user
office
terminal equipment
cpe terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202211209601.4A
Other languages
Chinese (zh)
Other versions
CN115529206B (en
Inventor
胡益明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Dimiantong Information Network Co ltd
Original Assignee
Shanghai Dimiantong Information Network Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Dimiantong Information Network Co ltd filed Critical Shanghai Dimiantong Information Network Co ltd
Priority to CN202211209601.4A priority Critical patent/CN115529206B/en
Priority claimed from CN202211209601.4A external-priority patent/CN115529206B/en
Publication of CN115529206A publication Critical patent/CN115529206A/en
Application granted granted Critical
Publication of CN115529206B publication Critical patent/CN115529206B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention relates to a remote and mobile office cooperative control system and an access method based on a dial-up cloud VPN, wherein the system comprises a VPN cloud server deployed in a data center, and a VPN virtual machine which is provided with open source VPN software and corresponds to a user in a one-to-one manner is virtualized on the VPN cloud server; the front end of the VPN cloud server is provided with VPN CPE terminal equipment, and a user office is provided with CPE terminal equipment; an SD-WAN connection or a GRE over IPSEC connection is established between the VPN CPE terminal equipment and the CPE terminal equipment; the CPE terminal equipment is connected with an office intranet server; wherein, the data access link loop is as follows: and remotely dialing the IP address to an IP distribution pool of the cloud VPN server, returning a routing definition to be bound with the user IP VPN instance, routing to an IPSEC or SDWAN interface of a CPE terminal of a user end to reach a user intranet, and forming a data access closed-loop link. Compared with the prior art, the method has the advantages of low cost, high network security, simple delivery process and no need of changing the existing network architecture of the client.

Description

Remote and mobile office cooperative control system based on dial-up cloud VPN and access method
Technical Field
The invention relates to the technical field of network communication, in particular to a remote and mobile office cooperative control system and an access method based on a dial-up cloud VPN.
Background
The existing enterprise self-built dialing VPN remote or mobile cooperative office has the following problems:
1) The cost is high: enterprises need to purchase expensive SSL VPN firewall or IPSEC VPN hardware equipment for self-construction of VPNs, and the hardware equipment needs to purchase VPN license, so that the cost is high, and the annual hardware renewal and maintenance cost is high; meanwhile, an enterprise also needs to rent an internet special line to an operator, but the broadband of home office staff comes from different operators during business trip or epidemic situation, so that the enterprise is required to have a plurality of special lines and a plurality of ips are distributed to establish VPN connection, and inconvenience is brought;
2) The management is inconvenient: customers need to maintain a plurality of subsystems such as VPN hardware equipment, an authentication server, enterprise private lines and the like, and higher requirements are also put forward on the skills of the customers.
In view of the foregoing, it is desirable to design a more convenient and low-cost cooperative remote and mobile office control system and method.
Disclosure of Invention
The invention aims to overcome the defects of the prior art and provides a remote office cooperative control system and an access method based on the dial-up cloud VPN, which have the advantages of low cost, high network security and simple delivery process.
The purpose of the invention can be realized by the following technical scheme:
according to a first aspect of the invention, a remote and mobile office cooperative control system based on a dial-up cloud VPN is provided, and the control system comprises a VPN cloud server deployed in a data center, wherein a VPN virtual machine which is provided with open source VPN software and corresponds to a user in a one-to-one manner is virtualized on the VPN cloud server;
the front end of the VPN cloud server is provided with VPN CPE terminal equipment, and a user office is provided with CPE terminal equipment; SD-WAN connection or GRE over IPSEC connection is established between the VPN CPE terminal equipment and the CPE terminal equipment; and the CPE terminal equipment is connected with the office intranet server.
Preferably, the CPE terminal device includes a firewall and a Router.
Preferably, the VPN CPE terminal device is provided with a user access port bound by an IP VPN instance.
Preferably, the SD-WAN connection or the GRE over IPSEC connection between the VPN CPE terminal device and the CPE terminal device is a communication connection that uses an IPSEC protocol encryption authentication technique.
Preferably, the VPN CPE terminal device and the CPE terminal device access a public network through a data center network and a broadband network, respectively.
Preferably, the office intranet server comprises a CRM, OA, NAS file server, and a webdisk server.
Preferably, the data access link corresponding to the control system specifically includes:
the remote dialing IP address is defined to an IP distribution pool of a VPN cloud server, bound to a dialing address pool dynamically distributed to a remote user on the VPN cloud server, returned to the routing definition and bound with a user IP VPN instance, and routed to an IPSEC or SDWAN interface of CPE terminal equipment arranged in a user office to reach an office intranet server to form a data access link loop.
According to a second aspect of the present invention, there is provided a remote office cooperative control access method based on a dial-up cloud VPN, which is applied to any one of the control systems, and the method specifically includes:
the method comprises the steps that a mobile office user or a home office user establishes a dialing connection from a PPTP protocol or an L2TP protocol to a VPN cloud server on a PC end, a VPN connection account is input on the PC end, after the dialing establishment is successful, the PC end obtains an IP address, a gateway is connected to the VPN cloud server, then a data packet passes through VPN CPE terminal equipment through a default route and then reaches the CPE terminal equipment of a user office network through an SDWAN or a GRE tunnel, the CPE terminal equipment is interconnected with a user intranet switch, a network route is searched, and the connection communication relation between the IP address of the PC end and the user office intranet server is established; when accessing the external network, the user can access the external network through the office network firewall or the proxy server.
Preferably, the connection corresponding to the PPTP protocol is a connection encrypted by using MPPE128 bits.
Preferably, the connection corresponding to the L2TP protocol is a connection using an IPSec AES256 encryption algorithm, an SHA2-256 hash authentication algorithm, and a Pre-Share Key.
Compared with the prior art, the invention has the following advantages:
compared with the traditional deployment mode, the user needs to apply for a special line with a fixed ip address, purchase expensive VPN equipment, deploy the VPN equipment by himself, and need to employ professional IT for maintenance, so that the operation and maintenance cost of common small and medium-sized enterprises is increased; the user is connected with an enterprise office network based on the dialing cloud VPN, and is delivered to the client for use in an account number mode, the client returns a routing definition to be bound with a VRF instance of the user through a remote dialing IP address to an IP distribution pool of a VPN cloud server, and the routing definition is routed to an IPSEC or SDWAN interface of CPE terminal equipment arranged in the office place of the user to reach an office intranet server to form a data access link loop, namely, the client can establish dialing connection to realize remote office only by one account number, the delivery process is simplified, and the existing network architecture of the client does not need to be changed.
Drawings
FIG. 1 is a system architecture diagram of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be obtained by a person skilled in the art without any inventive step based on the embodiments of the present invention, shall fall within the scope of protection of the present invention.
Examples
The invention will be explained first with respect to terms that relate to the invention:
CPE: the system is characterized in that the system refers to a user front-end device which mainly converts various protocols to realize a series of complex functions such as data encryption, routing exchange and the like;
VPN cloud server: the method comprises the steps that a universal x86 server is divided into a plurality of virtual machines after virtualization, then a universal Linux operating system is installed on each virtual machine, universal open source L2TP + IPSEC software is deployed, dial-up access is provided for a client terminal, and a dial-up channel is encrypted, algorithmic and authenticated;
VPN CPE terminal equipment: the VPN front-end CPE device isolates different users through RD by VRF isolation technology, so that channels of each user are isolated from each other, and the functions are similar to virtual channel VPI/VCI of a two-layer circuit, VLAN ID of Ethernet and the like.
And (3) SDWAN: the software defines the wide area network, and realizes the data security channel connection between two pieces of CPE equipment through the SDWAN technology;
GRE over IPSec: the encrypted tunnel protocol realizes the data secure channel connection between two pieces of CPE equipment through the encrypted tunnel technology;
a server: the general enterprise internal servers are all placed on the intranet, are not allowed to be deployed on a public network, and are prevented from being attacked and stealing data.
As shown in fig. 1, this embodiment provides a remote and mobile office cooperative control system based on dial-up cloud VPN, where the control system includes a VPN cloud server deployed in a data center, and a VPN virtual machine that is virtually installed with open-source VPN software (deployed with PPTP and L2TP VPN software) and corresponds to a user in a one-to-one manner, that is, each client corresponds to a logically independent VPN virtual machine, and different users are isolated by using an IP VPN technology, so that each client is isolated from another client; and the VPN CPE terminal equipment is provided with a user access port bound through a VRF instance.
The front end of the VPN cloud server is provided with VPN CPE terminal equipment, and CPE terminal equipment (such as firewall, router and other gateway equipment) is arranged in a user office; and an SD-WAN connection or a GRE over IPSEC connection is established between the VPN CPE terminal equipment and the CPE terminal equipment, and the VPN CPE terminal equipment and the CPE terminal equipment are respectively accessed to a public network through a data center network and a broadband network.
And the CPE terminal equipment is connected with the office intranet server. The office intranet server comprises a CRM (customer relationship management), an OA (office automation) file server, a NAS (network attached storage) file server and a network disk server. And the SD-WAN connection or GRE over IPSEC connection between the VPN CPE terminal equipment and the CPE terminal equipment is communication connection adopting an IPSec protocol encryption authentication technology.
The data access link corresponding to the control system specifically includes: the method comprises the steps of defining a remote dialing IP address route to an IP Pool distribution Pool of a cloud VPN server, binding the remote dialing IP address route to a dialing address Pool dynamically distributed to a remote user on a VPN cloud server, wherein the PPTP connection dialing Pool IP range is 192.168.2.2-192.168.2.127, the L2TP connection dialing Pool IP range is 192.168.2.128-192.168.2.255, returning the route definition to be bound with a user VRF instance, routing the route to an IPSec or SDWAN interface of CPE terminal equipment of a user office, and reaching a user intranet to form a data access link loop.
Next, a remote office access method based on dial-up cloud VPN is provided, and the control system is applied, and the method specifically comprises the following steps:
the method comprises the steps that a mobile office user or a home office user establishes a dialing connection from a PPTP protocol or an L2TP protocol to a VPN cloud server on a PC end, a VPN connection account is input into the PC end, after the dialing establishment is successful, the PC end obtains an IP address, a gateway is connected to the VPN cloud server, then a data packet passes through VPN CPE terminal equipment through a default route and then reaches the CPE terminal equipment of a user office network through an SDWAN or a GRE tunnel, the CPE terminal equipment is interconnected with a user intranet switch, a network route is searched, and the connection communication relation between the IP address of the PC end and the user office intranet server is established; when accessing the external network, the user can access the external network through the office network firewall or the proxy server.
The connection corresponding to the PPTP protocol is the connection encrypted by adopting MPPE128 bits. The connection corresponding to the L2TP protocol is the connection adopting an IPSec AES256 encryption algorithm, an SHA2-256 Hash authentication algorithm and a Pre-Share-Key Pre-sharing secret Key.
Net, wherein abc is a generic reference, for vpn.abc.net in the VPN cloud server of fig. 1.
While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and various equivalent modifications and substitutions can be easily made by those skilled in the art within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims (10)

1. A remote and mobile office cooperative control system based on a dial-up cloud VPN is characterized in that the control system comprises a VPN cloud server deployed in a data center, wherein a VPN virtual machine which is provided with open source VPN software and corresponds to a user in a one-to-one mode is virtualized on the VPN cloud server;
the front end of the VPN cloud server is provided with VPN CPE terminal equipment, and a user office is provided with CPE terminal equipment; an SD-WAN connection or a GRE over IPSEC connection is established between the VPN CPE terminal equipment and the CPE terminal equipment; and the CPE terminal equipment is connected with the office intranet server.
2. The system according to claim 1, wherein the CPE end devices comprise a firewall and a Router.
3. The system according to claim 1, wherein the VPN CPE termination equipment is configured with a user access port bound via a VRF instance.
4. The remote and mobile office cooperative control system based on dial-up cloud VPN as claimed in claim 1, wherein the SD-WAN connection or GRE over IPSEC connection between VPN CPE terminal device and CPE terminal device is communication connection using IPSec protocol encryption authentication technology.
5. The system according to claim 1, wherein the VPN CPE terminal device and the CPE terminal device access a public network through a data center network and a broadband network, respectively.
6. The system according to claim 1, wherein the office intranet servers comprise CRM, OA, NAS file servers and network disk servers.
7. The remote and mobile office cooperative control system based on the dial-up cloud VPN as claimed in claim 1, wherein the data access link corresponding to the control system is specifically:
the remote dialing IP address is defined to an IP distribution pool of a VPN cloud server, bound to a dialing address pool dynamically distributed to a remote user on the VPN cloud server, returned to the routing definition and bound with a user IP VPN instance, and routed to an IPSEC or SDWAN interface of CPE terminal equipment arranged in a user office to reach an office intranet server, so that a data access closed-loop link is formed.
8. A remote and mobile office cooperative control access method based on dial-up cloud VPN (virtual private network), which is characterized by applying the control system of any one of claims 1 to 7, and the method specifically comprises the following steps:
the method comprises the steps that a mobile office user or a home office user establishes a dialing connection from a PPTP protocol or an L2TP/IPSec protocol to a VPN cloud server on a PC end, a VPN connection account is input on the PC end, after the dialing establishment is successful, the PC end obtains an IP address, a gateway is connected to the VPN cloud server, then a data packet passes through VPN CPE terminal equipment through a default route and then reaches the CPE terminal equipment of a user office network through an SDWAN or a GRE tunnel, the CPE terminal equipment is interconnected with a user intranet switch, a network route is searched, and a connection communication relation between the IP address of the PC end and the user office intranet server is established; when accessing the external network, the user can access the external network through the office network firewall or the proxy server.
9. The method as recited in claim 8, wherein the connection corresponding to the PPTP protocol is a connection using MPPE 128-bit encryption.
10. The method according to claim 8, wherein the connection corresponding to the L2TP protocol is a connection using an IPSec AES256 encryption algorithm, an SHA2-256 hash authentication algorithm, and a Pre-Share Key.
CN202211209601.4A 2022-09-30 Remote and mobile office cooperative control system and access method based on dial-up cloud VPN Active CN115529206B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211209601.4A CN115529206B (en) 2022-09-30 Remote and mobile office cooperative control system and access method based on dial-up cloud VPN

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211209601.4A CN115529206B (en) 2022-09-30 Remote and mobile office cooperative control system and access method based on dial-up cloud VPN

Publications (2)

Publication Number Publication Date
CN115529206A true CN115529206A (en) 2022-12-27
CN115529206B CN115529206B (en) 2024-11-19

Family

ID=

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6970459B1 (en) * 1999-05-13 2005-11-29 Intermec Ip Corp. Mobile virtual network system and method
CN101908996A (en) * 2010-08-24 2010-12-08 福建星网锐捷网络有限公司 Method for accessing private network and data transmission method, device and system
CN110290093A (en) * 2018-03-19 2019-09-27 杭州达乎科技有限公司 The SD-WAN network architecture and network-building method, message forwarding method
CN110445858A (en) * 2019-08-02 2019-11-12 深圳震有科技股份有限公司 Server-side connects client approach and device, equipment, medium simultaneously
CN111106991A (en) * 2018-10-29 2020-05-05 中国移动通信集团浙江有限公司 Cloud special line system and service issuing and opening method thereof
CN111786870A (en) * 2019-04-04 2020-10-16 厦门网宿有限公司 Data transmission method and strongswan server
CN111786867A (en) * 2019-04-04 2020-10-16 厦门网宿有限公司 Data transmission method and server
CN112217771A (en) * 2019-07-11 2021-01-12 奇安信科技集团股份有限公司 Data forwarding method and data forwarding device based on tenant information
CN112333078A (en) * 2021-01-06 2021-02-05 杭州网银互联科技股份有限公司 Method and system for constructing SD-WAN data forwarding plane

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6970459B1 (en) * 1999-05-13 2005-11-29 Intermec Ip Corp. Mobile virtual network system and method
CN101908996A (en) * 2010-08-24 2010-12-08 福建星网锐捷网络有限公司 Method for accessing private network and data transmission method, device and system
CN110290093A (en) * 2018-03-19 2019-09-27 杭州达乎科技有限公司 The SD-WAN network architecture and network-building method, message forwarding method
CN111106991A (en) * 2018-10-29 2020-05-05 中国移动通信集团浙江有限公司 Cloud special line system and service issuing and opening method thereof
CN111786870A (en) * 2019-04-04 2020-10-16 厦门网宿有限公司 Data transmission method and strongswan server
CN111786867A (en) * 2019-04-04 2020-10-16 厦门网宿有限公司 Data transmission method and server
CN112217771A (en) * 2019-07-11 2021-01-12 奇安信科技集团股份有限公司 Data forwarding method and data forwarding device based on tenant information
CN110445858A (en) * 2019-08-02 2019-11-12 深圳震有科技股份有限公司 Server-side connects client approach and device, equipment, medium simultaneously
CN112333078A (en) * 2021-01-06 2021-02-05 杭州网银互联科技股份有限公司 Method and system for constructing SD-WAN data forwarding plane

Similar Documents

Publication Publication Date Title
CN107959654B (en) Data transmission method and device and mixed cloud system
US9647988B2 (en) Policy-based configuration of internet protocol security for a virtual private network
US9015855B2 (en) Secure tunneling platform system and method
US20020143960A1 (en) Virtual network generation system and method
EP2760174A1 (en) Virtual private cloud access authentication method and related apparatus
US20150150114A1 (en) Method and System for Providing Secure Remote External Client Access to Device or Service on a Remote Network
US20130283050A1 (en) Wireless client authentication and assignment
CN104506670A (en) Method, device and system for establishing online game connection
CN114285697A (en) Multi-network single-inlet VPN system based on WireGuard and OpenVPN
US8146144B2 (en) Method and system for the transparent transmission of data traffic between data processing devices, corresponding computer program product, and corresponding computer-readable storage medium
US20150026768A1 (en) Remote wireless adapter
Tongkaw et al. Multi-VLAN design over IPSec VPN for campus network
Sharma Secure remote access ipsec virtual private network to university network system
Clarke 1,001 CCNA Routing and Switching Practice Questions For Dummies (+ Free Online Practice)
CN106549936A (en) A kind of anti-source tracing method of the scanner based on multichannel VPN load balancing and equipment
CN115529206B (en) Remote and mobile office cooperative control system and access method based on dial-up cloud VPN
CN115529206A (en) Remote and mobile office cooperative control system and access method based on dial-up cloud VPN
CN218336061U (en) Remote and mobile office cooperative control system based on dialing cloud VPN
EP1413095B1 (en) System and method for providing services in virtual private networks
KR102386386B1 (en) Router with selective VPN connection function of terminal and VPN connection method of terminal using the same
US20200287868A1 (en) Systems and methods for in-band remote management
Polezhaev et al. Implementation of dynamically autoconfigured multiservice multipoint VPN
Vishwakarma Virtual private networks
Marković et al. Analysis of packet switching in VoIP telephony at the command post of tactical level units
Ibrahim Virtual private network (VPN) management and IPSec tunneling technology

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant