CN1118171C - On-demand system and method for access repeater applied to virtual private network - Google Patents

Abstract

The present invention uses two-stage PPP link to process the connection requirement of the user. The PPP link in the first stage is used to coordinate the communication between the user and the access repeater and to confirm the identity of the user. If the user is legitimate, it is assigned a new network address. Then, the user can select a service item from the function menu provided by the on-demand repeater, which includes VPN service and non-VPN service. If the user selects non-VPN service, the access repeater will forward the packet to its destination address, and if the user requests VPN service, the access repeater will establish a second stage PPP link with VPN.

Description

On-demand system and method for access repeater applied to virtual private network

technical field

The present invention is an access repeater (Access Concentrator) applied to a virtual private network (Virtual Private Networks, VPN), especially an access repeater that can provide on-demand services (On-Demand). Allow users to have other service options before connecting to the virtual private network server.

Background technique

A virtual private network (Virtual Private Network, hereinafter referred to as VPN) is a data network (data network) using a public telecommunications transmission system (public telecommunications infrastructure), as shown in Figure 1. The network system of the VPN is usually connected by a dedicated line, so it has privacy. Through an authorized Internet Service Provider (ISP) 13, a company or enterprise 14 can treat an Internet 15 as a large local area network. When transmitting data from one VPN to the other VPN via the public telephone network 12 and the Internet 15, encryption and decryption procedures are usually required to ensure data security. In order to protect the privacy and security of data, the Internet (Internet) uses tunneling (tunneling) 16 to provide a special channel (path) for a specific company to transmit information or files through the Internet 15 . The protocol that provides this communication is called Point-to-Point Tunneling Protocol (hereinafter referred to as PPTP). Through PPTP, companies can generate a VPN through tunnels on the Internet to transmit data securely. In this way, the company or enterprise 14 does not need to use its own leased wide-area network line, but can safely use the general network system.

The Internet service company 13 uses the access repeater 17 and a database 18 to handle VPN communication. Access repeater 17 has two interfaces: VPN interface 171 to provide point-to-point access using public switched telephone networks (PSTNs) or integrated services digital network (ISDN), and general network communication interface 172, which can provide TCP/IP Communication protocol to send packets to the Internet 15 or other general network services.

PPTP uses the enhanced GRE (Generic Routing Encapsulation) mechanism to provide flow and congestion control package (encapsulated) data frame (datagram) service to transmit point-to-point communication protocol format message packets (PPP message packets). When a user 11 of an enterprise uses the PPTP communication protocol and dials to an Internet service company 13 , the message packet will be encapsulated and then sent to the access repeater 17 . The wrapped PPP message packet will be transmitted by IP. Therefore, the data format of the wrapped PPP message packet will be as shown in FIG. 2 . The message packet 24 includes a media header 21 , an IP header 22 , a GRE header 23 , and PPP.

The access repeater 17 used now will only confirm the authenticity of the dial-up user's identity from the call ID field in the PPP message packet, and then assign a legal network address to the dial-up user to replace its source address . In this way, the dial-up user can access the virtual private network without decrypting the message packet. In other words, the network service company 13 can make the dial-up user 11 directly implement the PPP communication protocol with the server 14 . As a result, if the dial-up user only wants to browse the Internet or use functions such as remote login (TELNET), file transfer (FTP), electronic bulletin board (BBS), and Internet (WWW), he still must connect to the VPN19. server 14. Such a result not only consumes connection time, but also generates unnecessary communication traffic.

In addition, as far as the current structure of the access repeater is concerned, if the function of on-demand service is to be added, it must be completed in conjunction with the authentication structure of the "Remote Authentication Dial-InUser Service" (RADIOU) . In this way, not only must the existing PPP communication protocol be amended to support the EAP (PPP extensible authentication RFC2284) standard, but also the cost of the RADIUS authentication structure must be increased. In this way, it is relatively difficult and complicated in actual erection and program design. In addition, under the design of a single PPP link, the access repeater can only wrap the VPN header and forward the PPP data (Payload) message packet sent by the remote user, and cannot analyze the message packet at the same time. The data, such as IP, IPX and other addresses, are used as the basis for the selection of link service quality, so it is relatively inflexible in practice.

Contents of the invention

The purpose of the present invention is to provide an on-demand service system and method applied to a VPN access repeater, which allows users to request non-virtual private network access to the access repeater before connecting to the VPN server services.

Another object of the present invention is to provide an access repeater system and method that can provide on-demand services, which can continue the existing PPP communication agreement mechanism, and can provide the function of repeater on-demand services, so as to Reduce the cost of program installation and modification.

Another object of the present invention is to provide a method for segmenting PPTP links in a virtual private network, which can only slightly modify part of the program code of the virtual private network, and then provide a repeater to increase the function Or program code upgrades to reduce the complexity of equipment installation and maintenance.

Another object of the present invention is to provide a method for segmenting PPTP links without additional support for the RADIUS mechanism, which can save the cost of building RADIUS proxy servers and server equipment, thereby saving costs.

The on-demand service method applied to the access repeater of the virtual private network of the present invention comprises the following steps:

Establish a virtual private network user database to store user data of the virtual private network;

When receiving a connection request from a dial-up user, establish the first-stage point-to-point communication protocol for the dial-up user;

Query the virtual private network user database to determine the identity authenticity of the dial-up user;

When the identity of the dial-up user is determined to be true, give the dial-up user a network address, otherwise reject the above-mentioned first-stage PPP connection request;

Provide an on-demand service menu for the dial-up user to select, and the on-demand service includes connection services using virtual private networks and general network services that do not use virtual private networks;

When the dial-up user selects a virtual private network connection service, establish a second-stage point-to-point communication link with the server of the virtual private network; and

Give the dial-up user a legal virtual private network address to access the virtual private network;

When the identity of the above-mentioned dial-up user is determined to be false, the above-mentioned first-stage point-to-point communication connection request is rejected.

The aforementioned network address is an IP address.

The above-mentioned non-virtual private network services include: remote login, file transfer, Internet and electronic bulletin board.

Wherein the legal virtual private network address mentioned above is an IP address.

Wherein the legal virtual private network address mentioned above is an IPX address.

It further includes the step: when the above-mentioned dial-up user selects a non-virtual private network service, "forwarding the message packet of the above-mentioned dial-up user to its destination address.

Wherein the above-mentioned second-stage PPP communication connection is executed according to the user data obtained in the above-mentioned first-stage PPP communication connection.

The virtual private network access repeater system that can provide on-demand service functions of the present invention is realized in this way: it includes: an interface device for receiving connection requirements from the public telephone network; a first connection layer control device, Used to perform communication coordination with the connection layer of a dial-up user's host; an identity verification device, coupled to a virtual private network user database, to determine the correctness of the dial-up user's identity; a first network layer control A device for performing communication coordination with the network layer of the dial-up user's host and obtaining a network address; a service providing device for providing an on-demand service menu for the dial-up user to choose; a second connection layer The control device is used to establish a second connection layer communication coordination for a virtual private network server; and a second network layer control device is used to give the dial-up user a legal virtual private network address to access The virtual private network server.

The aforementioned network address is an IP address.

The on-demand services mentioned above include: virtual private network services and non-virtual private network services.

The above-mentioned non-virtual private network services include: remote login, file transfer, Internet and electronic bulletin board.

Wherein the legal virtual private network address mentioned above is an IP address.

Wherein the legal virtual private network address mentioned above is an IPX address.

Wherein the above-mentioned service providing device forwards the message packet of the above-mentioned dial-up user to its destination address when the above-mentioned dial-up user requests a non-virtual private network service.

The present invention mainly uses a two-stage PPP link to handle the user's connection requirements. The first phase of the PPP link is for coordination between the user and the access repeater. In the first phase of the PPP link, the identity of the user will be confirmed. If the user is a legitimate user, the user will be assigned a new network address. Then, the user can select a service item from the function menu provided by the on-demand repeater, including virtual private network and non-virtual private network, such as remote login (TELNET), file transfer (FTP), electronic bulletin board (BBS), etc. ) and the Internet (WWW). If the user chooses a non-virtual private network, the access repeater will send the message packet to its destination address. If the user requests a virtual network service, the access repeater will Establish a PPP communication protocol connected to the virtual private network. In this way, users can access services not connected to the virtual private network without directly connecting to the server of the virtual private network.

Description of drawings

Fig. 1 is a system schematic diagram of a virtual private network currently in use.

Figure 2 is the format of a wrapped PPP message packet.

Fig. 3 is a schematic diagram of the operation of the repeater system with on-demand function of the present invention.

Figure 4 is a flowchart of the method of the present invention.

Detailed ways

Assuming that the local area network connected to the virtual private network server uses the TCP/IP communication protocol, the method of the present invention is divided into two stages in the PPP link, as shown in FIG. 3 . Fig. 3 shows the access repeater with on-demand service function of the present invention. The access repeater 31 is implemented on a platform that accepts dial-up access, and can control dial-up telephone access control from public switched telephone networks (Public Switched Telephone Networks) 32, or integrated services digital network (ISDN) , or send an outbound circuit-switched link.

The access repeater 31 also provides a physical layer interface device 33 (Physical native interfacing device) to connect to the public switched telephone line 32 . When the far-end user dials successfully and requires a communication coordination with the connection layer (data link layer) of the network service company 30, the connection layer control device 361 just executes a PPP connection layer communication coordination for the dial-up user, so as to communicate with the network service company 30 The dial-up user's host computer 34 is connected. When connecting, the identity confirming device 362 inquires a VPN user database to perform identity confirmation, such as inquiring whether the data such as the source address in the user message packet, the use authority, the user identification code and the password are true. If it is determined that the user 34 is a legal VPN user, the PPP agreement will continue to carry out the communication coordination of the Network Layer. Different from the prior art, the communication control device 363 at the network layer decodes the message packet and obtains data such as its network number and service requirements. After the PPP communication coordination is completed, the remote user 34 will be assigned a new network address given by the system, such as an IP address. Since this network address is different from the original VPN network address to which the user belongs, the message packets sent by the user will not be sent to the VPN to which the user belongs. And the user does not need to connect to the VPN server 35 to which it belongs first, and then connect to other network services or use its resources by the VPN server 35. The network connection control device 363 can also determine the routing mode of the message packet.

Then, after the first PPP communication coordination is completed, the message packet with the new network address will be sent to the service provider 37 . The service provider 37 provides on-demand services for the dial-up user 34 to choose. Since the dial-up user has a new IP address, he can freely choose various non-virtual private network services, such as remote login (TELNET), file transfer (FTP), electronic bulletin board (BBS) and Internet ( www). If the user 34 selects the service of Non-VPN, the service provider 37 will directly send these packets to its destination address without connecting to the VPN server 35 of the user company. On the other hand, if the user 34 selects the VPN service, the access repeater 31 will establish a second PPP connection to the VPN server 35 . In the PPP communication protocol, the link layer control device 381 can obtain the user data from the link layer communication protocol of the first PPP connection, and no need to perform user identity verification, so the connection speed can be accelerated. Then, the message packet will be forwarded to the network layer connection control device 382 to establish network layer communication with the VPN server 35 . At this time, the user 11 can obtain a legal VPN address, such as an IP address or an IPX address, from the VPN server 35 , so the user can access the resources of the VPN server 35 .

Fig. 4 shows the on-demand method of the access repeater of application VPN of the present invention, comprises the following steps:

401: Execute a link layer communication coordination for a dial-up user when a link request is received.

402: Query a virtual private network user database to determine the identity of the dial-up user. If the identity of the dial-up user is correct, go to step 404; otherwise, go to step 403.

403: The connection request of the dial-up user is rejected.

404: Execute a network layer communication coordination for the dial-up user, including decrypting the PPP message packet to obtain the network address and service requirement data.

405: Assign a new network address to the dial-up user.

406: Provide a menu of on-demand services for the dial-up user to select. If the user requires a NON-VPN service, step 407 is executed. Otherwise, go to step 408 .

407: If the dial-up user chooses a NON-VPN service, such as TELNET, FTP, BBS and WWW, forward the message packet to its destination address.

408: Perform a link layer communication coordination with the virtual private network server according to the data obtained in the first link layer communication.

409: Execute a network layer communication coordination for the virtual private network server.

410: Provide a legal virtual private network address to the dial-up user, such as 1P address or IPX address.

411: Connect to the virtual private network server.

The preferred embodiment of the present invention has been described in detail above, but some changes made in the above-mentioned embodiment are still within the patent scope of the present invention, for example: the present invention can be generally applied to any virtual private network connection that can be applied in the future Similar to the communication protocol, moreover, the items of the on-demand service can also be set according to the actual situation, and are not limited to the above-mentioned services such as TELNET, FTP, BBS and WWW.

Claims (14)

1. An access repeater that is applied to virtual private networks with selecting method of servicing, it is characterized in that comprising the following step:

   Set up a virtual private networks user data bank, to store user's data of virtual private networks;

   When receiving a dialing user binding demand, set up the point-to-point communication agreement of this dialing user's phase I;

   Inquire about this virtual private networks user data bank to judge this dialing user's identity validity;

   When this dialing user's judging identity is a true time, give this dialing user one network address, link requirement otherwise refuse above-mentioned phase I PPP;

   Provide one to choose to this dialing user, and this comprise the line service of using virtual private networks with the choosing service and reach general networking service of not using virtual private networks with choosing service menu;

   When this dialing user chose the line service of a virtual private networks, the point-to-point communication of setting up a second stage with the server of this virtual private networks linked; And

   Give the legal virtual private networks address of this dialing user one with this virtual private networks of access;

   When above-mentioned dialing user's judging identity was falsity, the point-to-point communication of refusing the above-mentioned phase I linked requirement.
2. 2. as claimed in claim 1 with selecting method of servicing, it is characterized in that: the wherein above-mentioned network address is the IP address.
3. 3. as claimed in claim 1 with selecting method of servicing, it is characterized in that: wherein above-mentioned non-virtual private networks service comprises: Telnet, archives transmission, world-wide web, and BBS.
4. 4. as claimed in claim 1 with selecting method of servicing, it is characterized in that: wherein above-mentioned legal virtual private networks address is an IP address.
5. 5. as claimed in claim 1 with selecting method of servicing, it is characterized in that: wherein above-mentioned legal virtual private networks address is an IPX address.
6. 6. as claimed in claim 1 with selecting method of servicing, it is characterized in that: more comprise step:

   When above-mentioned dialing user chooses general networking when service, pass on above-mentioned dialing user's message bag to its destination address.
7. 7. as claimed in claim 1 with selecting method of servicing, it is characterized in that: the PPP communication link of wherein above-mentioned second stage is to carry out according to obtained user's data in the PPP communication link of above-mentioned phase I.
8. 8. one kind can provide with the virtual private networks access repeater system that selects service function, it is characterized in that comprising:

   One interfare device is in order to receive the binding demand from public phone network; One first binder couse control device is coordinated in order to the execution and the communication of the binder couse of a dialing user main frame; One identity confirmation device is to be coupled to a virtual private networks user data bank, in order to judge this dialing user's identity validity; One first network layer control device is coordinated in order to the execution and the communication of the network layer of this dialing user's main frame, and is obtained a network address; One service generator is in order to provide one with selecting the service menu to select to this dialing user; One second binder couse control device is coordinated in order to the communication of a virtual private networks server being set up one second binder couse; And one second network layer control device, in order to give this dialing user one legal virtual private networks address, with this virtual private networks server of access.
9. 9. as claimed in claim 8 providing with the virtual private networks access repeater system that selects service function, it is characterized in that: the wherein above-mentioned network address is the IP address.
10. 10. as claimed in claim 8 providing with the virtual private networks access repeater system that selects service function is characterized in that: wherein above-mentioned comprises with the choosing service: virtual private networks service and non-virtual private networks service.
11. 11. as claimed in claim 10 providing with the virtual private networks access repeater system that selects service function is characterized in that: wherein above-mentioned non-virtual private networks service comprises: Telnet, archives transmission, world-wide web, and BBS.
12. 12. as claimed in claim 8 providing with the virtual private networks access repeater system that selects service function is characterized in that: wherein above-mentioned legal virtual private networks address is an IP address.
13. 13. as claimed in claim 8 providing with the virtual private networks access repeater system that selects service function is characterized in that: wherein above-mentioned legal virtual private networks address is an IPX address.
14. 14. as claimed in claim 8 providing with the virtual private networks access repeater system that selects service function, it is characterized in that: wherein above-mentioned service generator ties up to above-mentioned dialing user when requiring as one of non-virtual private networks the network service, with above-mentioned dialing user's message packet transfer to its destination address.

Images