Virtual private network implementation method and client device

A client device, applied to a virtual private network over Secure Sockets Layer (SSL VPN), wherein the SSL VPN comprises a client device, a gateway, and an intranet server of the SSL VPN, wherein the client device communicates with the intranet server using the gateway, wherein the client device comprises:

• a client;
• a Transport Driver Interface (TDI) driver;
• a Network Driver Interface Specification (NDIS) protocol driver;
• a NDIS network interface card driver;
• and
• a NDIS intermediate driver configured to:
• intercept an original packet sent by an application program to the intranet server;
• determine, according to a process identification (PID) corresponding to the original packet, whether to allow a process corresponding to the original packet to use the SSL VPN by:
• obtaining a protocol type and a port number of the original packet;
• determining, according to a mapping relationship between a protocol type, a port number, and a PID, the PID corresponding to the original packet;
• and
• determining, according to the PID, whether to allow the process corresponding to the PID to use the SSL VPN;
• establish a new packet when the process corresponding to the original packet is allowed to use the SSL VPN;
• set a destination address of the new packet as a local address of the client device on which the application program is located;
• set a destination port number of the new packet as a port number by which the client receives the original packet;
• change a source Internet Protocol (IP) address of the original packet to a virtual IP address;
• use the original packet as a payload of the new packet;
• and
• submit the new packet to the NDIS network interface card driver, wherein the virtual IP address is a virtual IP address obtained from the gateway after the client and the gateway establish a Secure Sockets Layer (SSL) tunnel, and
• wherein the NDIS network interface card driver is configured to send the new packet to the client, so that the client sends the new packet to the intranet server.

A virtual private network over Secure Sockets Layer (SSL VPN), comprising:

• a client device comprising a processing hardware platform executing instructions stored on a non-transitory computer-readable storage medium, to perform functions as a plurality of modules, the plurality of modules comprise a Transport Driver Interface (TDI) driver, a Network Driver Interface Specification (NDIS) protocol driver, a NDIS intermediate driver, a NDIS network interface card driver, and a client;
• a gateway;
• and
• an intranet server of the SSL VPN,
• wherein the client device communicates with the intranet server using the gateway,
• wherein the NDIS intermediate driver is configured to:
• intercept an original packet sent by an application program to the intranet server;
• determine, according to a process identification (PID) corresponding to the original packet, whether to allow a process corresponding to the original packet to use the SSL VPN by:
• obtaining a protocol type and a port number of the original packet;
• determining, according to a mapping relationship between a protocol type, a port number, and a PID, the PID corresponding to the original packet;
• and
• determining, according to the PID, whether to allow the process corresponding to the PID to use the SSL VPN;
• establish a new packet when the process corresponding to the original packet is allowed to use the SSL VPN;
• set a destination address of the new packet as a local address of the client device on which the application program is located;
• set a destination port number of the new packet as a port number by which the client receives the original packet;
• change a source Internet Protocol (IP) address of the original packet to a virtual IP address;
• use the original packet as a payload of the new packet;
• and
• submit the new packet to the NDIS network interface card driver, wherein the virtual IP address is a virtual IP address obtained from the gateway after the client and the gateway establish a Secure Sockets Layer (SSL) tunnel, and
• wherein the NDIS network interface card driver is configured to send the new packet to the client, so that the client sends the new packet to the intranet server.