Data transmission method, system, and apparatus

Patent metadata

Field	Value
Publication number	US-9350711-B2
Application number	US-201414336146-A
Country	US
Kind code	B2
Filing date	Jul 21, 2014
Priority date	May 11, 2012
Publication date	May 24, 2016
Grant date	May 24, 2016

Abstract

A data transmission method is applied in a virtual private network (VPN) and includes: querying, by an initiating client, a VPN server for external network Internet Protocol (IP) addresses of the initiating client and a responding client; performing, by the initiating client, key negotiation with the responding client through the VPN server; after the key negotiation is completed, writing, by the initiating client, the external network IP address of the initiating client into a source address field of a to-be-sent User Datagram Protocol (UDP) packet, writing the external network IP address of the responding client into a destination address field of the to-be-sent UDP packet, and encrypting the to-be-sent UDP packet according to a key obtained through the negotiation; and sending, by the initiating client, an encrypted UDP packet to the responding client, and performing packet interaction with the responding client directly.

First claim

What is claimed is:

1. A data transmission method implmented by an initiating client and applied in a virtual private network (VPN), comprising:
querying a VPN server for external network Internet Protocol (IP) addresses of the initiating client and a responding client;
performing key negotiation with the responding client through the VPN server;
writing the external network IP address of the initiating client into a source address field of a user datagram protocol (UDP) packet after the key negotiation is completed, wherein the UDP packet is generated by the initiating client;
writing the external network IP address of the responding client into a destination address field of the UDP packet;
encrypting the UDP packet according to a key obtained through the key negotiation to obtain an encrypted UDP packet;
sending, the encrypted UDP packet to the responding client; and
performing packet interaction with the responding client directly,
wherein performing the key negotiation with the responding client through the VPN server comprises:
sending a probe message to the responding client through the VPN server;
receiving a certification request message that is sent from the responding client and that is forwarded by the VPN server, wherein the certification request message is sent by the responding client after the probe message is received, and wherein the certification request message carries a public key of the responding client;
extracting the public key of the responding client from the certification request message as the key obtained through on the key negotiation;
performing identity certification on the public key of the responding client through a third-party certification server;
sending a certification verification message to the responding client through the VPN server after the certification succeeds, wherein the certification verification message carries a public key of the initiating client;
sending a negotiation finish message to the responding client through the VAN server;
determining that the key negotiation is completed after receiving a negotiation finish acknowledgment message that is from the responding client and is forwarded by the VPN server; and
determining that the key negotiation fails when the initiating client does not receive the certification verification message or the key negotiation finish acknowledgment message.

2. The method according to claim 1 , wherein querying the VPN server for the external network IP address of the initiating client and the responding client comprises:
sending, a query request message to the VPN server, wherein the query request message carries an identifier of the initiating client and an identifier of the responding client, wherein the identifier of the initiating client is allocated when the initiating client logs in to the VPN server, and wherein the identifier of the responding client is allocated when the responding client logs in to the VPN server;
receiving, a query response message returned by the VPN server; and
extracting the external network IP address of the initiating client and the external network IP address of the responding client from the query response message.

3. The method according to claim 1 , wherein after sending the encrypted UDP packet to the responding client, the method further comprises:
receiving, a UDP packet that is sent by the responding client and encrypted according to the public key of the initiating client; and
decrypting a received UDP packet according to a private key of the initiating client.

4. The method according to claim 2 , wherein after sending the encrypted UDP packet to the responding client, the method further comprises:
receiving, by the initiating client, a UDP packet that is sent by the responding client and encrypted according to the public key of the initiating client; and
decrypting, by the initiating client, a received UDP packet according to a private key of the initiating client.

5. An initiating client device applied in a virtual private network (VPN), comprising a processor and a memory storing instructions that when executed by the processor cause the initiating client device to:
query a VPN server for external network Internet Protocol (IP) addresses of the initiating client device and a responding client device;
perform key negotiation with the responding client device through the VPN server;
write the external network IP address of the initiating client device into a source address field of a user datagram protocol (UDP) packet after the key negotiation is completed, wherein the UDP packet is generated by the initiating client:
write the external network IP address of the responding client device into a destination address field of the UDP packet;
encrypt the to packet according to a key obtained through the key negotiation to obtain an encrypted UDP packet; and
send the encrypted UDP packet to the responding client device, and perform packet interaction with the responding client device directly,
wherein performing the key negotiation with the responding client device through the VPN server comprises:
sending a probe message to the responding client device through the VPN server;
receiving a certification request message that is sent from the responding client device and that is forwarded by the VPN server, wherein the certification request message is sent by the responding client device after the probe message is received, and wherein the certification request message carries a public key of the responding client device:
extracting the public key of the responding client device from the certification request message as the key obtained through the key negotiation;
performing identity certification on the public key of the responding client device through a third-party certification server;
sending a certification verification message to the responding client device through the VPN server after the certification succeeds, wherein certification verification message carries a public key of the initiating client device;
sending a negotiation finish message to the responding client device through the VPN server;
determining that the key negotiation is completed after receiving a negotiation finish acknowledgment message that is from the responding client device and is forwarded by the VPN server; and
determining that the key negotiation fails when the initiating client device does not receive the certification verification message or the key negotiation finish acknowledgment message.

6. The initiating client device according to claim 5 , wherein the instructions, when executed by the processor, further cause the initiating client device to:
send a query request message to the VPN server, wherein the query request message carries an identifier of the initiating client device and an identifier of the responding client device, wherein the identifier of the initiating client device is allocated when the initiating client device logs in to the VPN server, and wherein the identifier of the responding client device is allocated when the responding client device logs in to the VPN server;
receive a query response message returned by the VPN server; and
extract the external network IP address of the initiating client device and the external network IP address of the responding client device from the query response message.

7. The initiating client device according to claim 5 , wherein the instructions, when executed by the processor, further cause the initiating client device to:
receive a UDP packet that is sent by the responding client device and encrypted according to the public key of the initiating client device; and
decrypt a received UDP packet according to a private key of the initiating client device.

Assignees

• Huawei Tech Co Ltd

Inventors

• Zhai Xianqi
• Hua Guoyao
• Chen Aiping
• Gui Yao

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title