KR100958098B1 - Virtual private network service method and system - Google Patents

Abstract

The present invention relates to a virtual private network service method and system, and to a virtual private network (VPN) implementation method for accessing a private network in an enterprise through a public network in a remote user terminal, wherein the public network is provided through a public network in the remote user terminal. A first step of transmitting virtual private network installation information from the VPN main unit to the remote user terminal when connecting to a VPN main unit connecting a network and a private network in the enterprise; A second step of downloading an authentication module and a VPN tunneling unit from the VPN main unit to the remote user terminal when a VPN installation request signal is received from the remote user terminal; A third step of installing the authentication module and a VPN tunneling unit in the remote user terminal; A fourth step of authenticating a connection of the remote user terminal through the authentication module in the VPN main unit; When a packet for a predetermined internal terminal connected to the private network in the enterprise is generated at the remote user terminal, the VPN tunneling unit hooks the packet passing through a TDI layer, encrypts the hooked packet, and A fifth step of transmitting to the VPN main unit; A sixth step of decrypting the received packet from the VPN main unit and transmitting the received packet to the predetermined internal terminal, and encrypting and transmitting a response packet to the remote user terminal to interconnect the remote user terminal and the internal terminal; It is characterized by.

As a result, the virtual private network system can be downloaded and installed from a remote user terminal on the web anytime, anywhere through a public network network, so that a virtual private network (VPN) can be implemented regardless of time and place without having a separate VPN device or architecture change. Can be.

Description

Virtual private network service method and system {VIRTUAL PRIVATE NETWORK SERVICE METHOD AND ITS SYSTEM}

The present invention relates to a virtual private network service method and a system thereof, and more particularly, to implement a virtual private network without having to provide a separate VPN equipment by installing and installing a virtual private network system to a remote user terminal on a web through a public network. It relates to a possible virtual private network service method and system.

Typically, the representative way to connect the headquarters and branch offices in a distributed enterprise environment is to build a network using leased lines or frame relays.

However, such a leased line or a frame relay has a relatively expensive line cost.

Therefore, virtual private network VPN (Virtual Private Network) technology has emerged as a new network service using the Internet (public network), which is inexpensive and widely used compared to a leased line or a frame relay.

Virtual private network VPN (Virtual Private Network) technology is a technology that establishes a virtual private network so that a safe communication with the outside is possible by connecting a remote terminal (branch office) and a main office using an existing public network.

However, the conventional virtual private network (VPN) system, as shown in Figure 1, the remote client 401 to build a virtual communication line called 'tunnel' at the start and end points of the virtual private network (VPN) on the public network network In addition, VPN units 200, 300, and 400 were also required on the LAN 201 side of the branch office / injection LAN and the internal terminal PC side connected to the private network in the enterprise.

Therefore, the remote user has no choice but to transmit / receive information and data only at the place where the VPN units 200, 300, and 400 are installed, and the user has to carry the VPN units 200, 300, and 400 directly.

In addition, VPN units 200, 300, and 400 are not only easy to install by general users, but also have problems in compatibility with different networks and systems.

Accordingly, an object of the present invention is to provide a virtual private network (VPN) service method and a system that can be easily installed by downloading a virtual private network system on the web anytime and anywhere without a separate VPN equipment.

According to an embodiment of the present invention, the remote user terminal 20 to the VPN main unit 50 that connects the public network 10 and the private network 40 in the enterprise through the public network 10 in the network (10) The first step (S10) of transmitting the virtual private network (VPN) installation information 51 from the VPN main unit 50 to the remote user terminal 20, and installing the virtual private network (VPN) from the remote user terminal 20. When the request signal is received, the second step (S15) and the remote user terminal 20 to download the authentication module 55 and the VPN tunneling unit 53 from the VPN main unit 50 to the remote user terminal 20; A third step (S17) in which the authentication module 55 and the VPN tunneling unit 53 are installed in the authentication module 55, and the VPN main unit 50 authenticates the connection of the remote user terminal 20 through the authentication module 55. Step 4 (S18) and the predetermined internal end connected to the private network 40 in the enterprise in the remote user terminal 20 When the packet 60 directed to the device 30 is generated, the VPN tunneling unit 53 hooks the packet 60 passing through the TDI layer 31, and encrypts the hooked packet 60. The fifth step (S21) of transmitting to the VPN main unit 50 and the VPN main unit 50 decrypts the packet 60 and transmits it to a predetermined internal terminal 30, and responds to the remote user terminal 20. By encrypting and transmitting the packet 66, a sixth step (S26 to S28) in which the remote user terminal 20 and the internal terminal 30 are interconnected is achieved.

Meanwhile, the VPN tunneling unit 53 includes a filter 531, a redirector module 533, and an agent module 535, and the fifth step S21 includes a filter. Step (A) for filtering the packet 60 destined for a predetermined internal terminal 30 of all packets 60 passing through the TDI layer 31 of the remote user terminal 20 in the (531), and the redirector module Hooking the filtered packet 60 at 533 and transmitting it to the agent module 535, and encrypting the hooked packet 60 at the agent module 535 to encrypt the VPN. Step C may be further transmitted to the main unit 50.

Here, in step A, each of the internal terminals PC1 to PCn connected to the destination IP 63 of all packets 60 passing through the TDI layer 31 of the remote user terminal 20 and the private network 40 in the enterprise By comparing the IP 70 of the packets, the packet 60 may be filtered when the destination IP 63 of the packet 60 and the IP 70 of the internal terminals PC1 ˜ PCn match.

here, Step B, converting the destination IP 63 of the packet 60 hooked in the redirector module 533 to the agent module IP 90 of the agent module 535, and converts the packet 60 agent The method may further include transmitting to the (Agent) module 535.

Here, in step C, when the packet 60 hooked by the agent module 535 is received, the agent module 535 VPNs the agent module IP 90 of the hooked packet 60. Converting to the main unit IP 100, adding the destination IP 70 to the content 65 of the packet 60 to be initially accessed by the remote user terminal 20, and converting the packet 60 into a VPN. The method may further include transmitting to the main unit 50.

Here, the sixth step is a step of decoding the packet 60 received by the VPN main unit 50, and the VPN main unit IP (100) of the received packet 60 to the first destination IP (internal terminal 30) ( 63) and may further include transmitting to the internal terminal 30, and encrypting the response packet 66 to the remote user terminal 20 in the reverse order.

Here, the VPN main unit 50 may be provided to enable SSL (Secure Sockets Layer) encrypted communication.

On the other hand, the above object, according to an embodiment of the present invention, when connected via the remote user terminal 20, the user terminal 20, the virtual private network (VPN) installation information 51 to the remote user terminal 20 And a VPN main unit 50 for providing the VPN tunneling unit 53 and the authentication module 55 to the remote user terminal 20 when the user's installation request signal is received, and the remote user terminal 20. The destination IP (63) and each internal terminal (PC1 ~) of all packets passing through the TDI layer 31 of the remote user terminal 20, the internal terminal 30 connected to the private network 40 in the enterprise A filter 531 for filtering the matching packet by comparing the IP 70 of the PCn, and hooking the filtered packet 60, and the hooked packet The redirector converts the destination IP 63 of 60 into the agent module IP 90 and transmits it to the agent module 535. The module 533 and the agent module IP 90 of the packet 60 transmitted from the redirector module 533 are converted into the VPN main unit IP 100, encrypted, and transmitted to the VPN main unit 50. A VPN tunneling unit 53 having a 535, an authentication module 55 for authenticating a connection to the VPN main unit 50 of the remote user terminal 20, and an encrypted packet 60 from the agent module 535. Is received, the VPN main unit IP (100) of the packet 60 is converted to the destination IP (70) to be initially connected from the remote user terminal 20, and decrypted to the internal connection with the private network 40 in the enterprise Including the VPN main unit 50 to transmit to the terminal 30, the response packet 66 is encrypted in reverse order to the remote user terminal 20, the user terminal 20 and the internal terminal 30 mutually This is also achieved by the systems to which they are connected.

Therefore, according to the virtual private network service method and system according to an embodiment of the present invention described above, the virtual private network (VPN) by downloading the virtual private network system on the web anytime, anywhere through the public network network without a separate VPN equipment on the remote user terminal side ) Can be easily installed and used.

In addition, the virtual private network system is implemented in the application layer, so that the system has no difficulty and the transmission speed is improved.

In addition, since the packet is hooked at the TDI layer, there is no change and burden on the system, and the possibility of impulse with other applications is reduced.

Hereinafter, with reference to the accompanying drawings will be described in detail an embodiment of the present invention.

1 is a block diagram illustrating a conventional virtual network, FIG. 2 is a block diagram illustrating a virtual private network (VPN) virtual network according to an embodiment of the present invention, and FIG. 3 is a virtual private network according to an embodiment of the present invention. Is a block diagram of the VPN tunneling unit 53.

2 and 3, a virtual private network (VPN) service system 1 according to an embodiment of the present invention includes a remote user terminal 20, a public network network 10, an internal corporate network 40, The VPN main unit 50, the VPN tunneling unit 53, and the internal terminal 30 are included.

Here, the VPN tunneling unit 53 may further include a filter 531, a redirector module 533, and an agent module 535.

The remote user terminal 20 connects to the VPN main unit 50 connecting the public network 10 and the private network 40 in the enterprise through the public network 10.

As illustrated in FIG. 2, the remote user terminal 20 may be provided as a computer that can be connected to the Internet or the public network network 10.

Here, the Internet or public network network 10 may use a variety of methods using wireless or wired.

As shown in Figure 2, the internal terminal 30 is connected to the private network 40 in the enterprise connected to the VPN main unit 50.

The VPN main unit 50 communicates with the agent module 535 by SSL (Secure Sockets Layer) WEB standard encryption.

SSL (Secure Sockets Layer) WEB standard encrypted communication is a communication technology that protects the contents of information even if information is leaked through hacking by encrypting the information in the communication between the browser and the server by web server authentication.

Therefore, the VPN main unit 50 has the advantage of providing a physical device protection function, internal security information protection function, virtual private network (VPN) function while minimizing performance degradation of the existing network.

In addition, the VPN main unit 50 may support various algorithms such as RSA (4096), RC5, 3DES, SHA-1, and protocols such as SSL v2, v3, TLS v1, and WTLS for communication security.

In addition, since the VPN main unit 50 is capable of High Availability (H / A), it is possible to configure for a stable service through Failover when a failure occurs.

In addition, the VPN main unit 50 is capable of load balancing operation between the system (L / B) is possible.

As illustrated in FIG. 3, the VPN tunneling unit 53 may include a filter 531, a redirector module 533, and an agent module 535.

As shown in FIG. 3, the filter 531 inspects all the packets 60 passing through the TDI layer 31 of the remote user terminal 20, and among the packets 60 passing through the TDI layer 31. The packet 60 destined for the predetermined internal terminal 30 is filtered.

Here, the TDI layer 31 is located as a standard between the user mode 33 and the kernel mode 35 of the window, as shown in FIG.

In general, all the transmission packets 60 of the PC pass through the user mode 33 of the window and pass through the kernel mode 35 to determine whether or not the accessibility is possible. The filter 531 is installed in the TDI layer 31 to filter the packet 60 destined for an impossible area (private network in the enterprise).

Therefore, by hooking the packet 60 in the TDI layer 31, there is no need to change the system, there is no burden on the system and the possibility of impulse with other applications is reduced.

Hereinafter, filtering conditions and methods will be described later.

As shown in FIG. 3, the redirector module 533 hooks the packet 60a filtered by the filter 531 to the agent module 535.

When the agent module 535 receives the packet 60b from the redirector module 533, the agent module 535 establishes an SSL communication connection with the VPN main unit 50.

Since the agent module 535 establishes SSL communication with the VPN main unit 50 in the application layer of the user mode 33, the agent module 535 has an advantage that the transmission speed is increased without difficulty in the system.

The virtual private network service method 1 described above will be described in detail with reference to FIGS. 3 to 8 as follows.

The virtual private network service system 1 according to an embodiment of the present invention includes a remote user terminal 20 and an agent module 535, an agent module 535, a VPN main unit 50, a VPN main unit 50, and an enterprise. It is connected to the server of the internal terminal 30 connected to my private network 40 three times.

Virtual private network service system 1 according to an embodiment of the present invention is shown in Figure 4, the remote user terminal 20, the agent module 535, the VPN main unit 50 and the internal terminal 30 Each IP address may have 70, 80, 90, and 100.

Therefore, the packet 60 generated in the remote user terminal 20 can be transmitted / received to the destination through each IP address 70, 80, 90, 100.

The user connects to the VPN main unit 50 through the public network 10 using the remote user terminal 20. (S10)

The user may run a web browser using the remote user terminal 20 to access the VPN main unit 50, and input the IP address set by the administrator of the VPN main unit 50 in the WEB address bar.

As shown in FIG. 4, the remote user terminal 20 may have each assigned public IP 80 address connected to the public network 10.

For example, the remote user terminal 20 may have a user terminal IP 80 192.168.1.1, as shown in FIG.

When the remote user terminal 20 is connected to the VPN main unit 50, the VPN main unit 50 transmits the virtual private network installation information 51 to the remote user terminal 20 (S11).

When the remote user terminal 20 is connected to the VPN main unit 50, the VPN main unit 50 transmits the virtual private network installation information 51 to the remote user terminal 20, as shown in FIG.

As shown in FIG. 7, the virtual private network installation information 51 may be transmitted to an application window asking whether to install the virtual private network.

As shown in FIG. 7, the user can install the virtual private network (VPN) software by clicking the installation tool 52.

Here, the installation tool 52 is available in various forms, for example, ActiveX control driver installation can be used.

Therefore, the user can easily install and use the virtual private network software anytime, anywhere through the public network network 10 without having to provide a separate VPN unit (300,400) on the user terminal side as shown in FIG. There is this.

The user transmits a response signal of whether the virtual private network is installed to the VPN main unit 50 through the remote user terminal 20. (S13)

As shown in FIG. 7, the user may transmit a response signal to the VPN main unit 50 by clicking the installation tool 52 in the virtual private network installation information 51.

In this case, when the user does not select the installation tool 52, the VPN main unit 50 may release the connection and may ask whether to install it again.

When the user selects the installation tool 52, the VPN main unit 50 downloads the VPN tunneling unit 53 and the authentication module 55 to the remote user terminal 20. (S15)

The user installs the VPN tunneling unit 53 and the authentication module 55 downloaded to the remote user terminal 20. (S17)

When the VPN tunneling unit 53 and the authentication module 55 are installed in the remote user terminal 20, as shown in FIG. 8, the authentication module 55 application window for establishing the VPN tunneling to the remote user terminal 20. The user is authenticated to access the remote user terminal 20 through the authentication module 55. (S18)

The login method through the authentication module 55 may be provided in various ways. For example, as shown in FIG. 8, an ID / password, a certificate, an ID / password / certificate, or a mobile phone SMS authentication method may be used. .

If the user is authorized through the ID / password and certificate, the remote user terminal 20 is connected to the VPN main unit 50 (S19).

The packet 60 is generated in the remote user terminal 20 and passes through the user mode 33, the TDI layer, and the kernel mode 35. (S20)

All packets 60 generated in the application of the remote user terminal 20 pass through the TDI layer 31 in the user mode 33 and go to the kernel mode 35, as shown in FIG. 3.

Here, the filter 531 is the IP 70 of the internal terminals (PC1 ~ PCn) connected to the private network 40 in the enterprise of the destination IP (63) of the packet among all the packets 60 passing through the TDI layer 31 Compare or not with (S21).

The filter 531 may be installed at various positions. For example, as illustrated in FIG. 3, the filter 531 may be installed at the TDI layer 31.

Therefore, there is no change and burden of the system, and the possibility of impulse with other applications is reduced.

The filter 531 compares the destination IP 63 of all packets 60 passing through the TDI layer 31 with the IP 70 of predetermined internal terminals PC1 to PCn connected to the private network 40 in the enterprise. .

The filter 531 may be performed with various filtering conditions. For example, the filter 531 may be configured to connect the destination IP 63 of all packets 60 passing through the TDI layer 31 to the private network 40 in the enterprise. It can be compared with the IP 70 of the internal terminals (PC1 ~ PCn).

In addition, the filter 531 may be implemented as a situation analysis method that intelligently filters through a state table managing sessions that change according to network conditions, instead of filtering by simple rules when controlling packets to be transmitted / received.

Accordingly, the filter 531 is the destination IP 63 of the packet 60 and the predetermined internal terminal among all the packets 60 passing through the TDI layer 31 of the remote user terminal 20, as shown in FIG. When the IP 70 of the PC1 to PCn is compared, and the destination IP 63 of the packet 60 and the IP 70 of the predetermined internal terminals PC1 to PCn are matched, the matching packet 60 is After filtering, the remaining packet 60 flows to kernel mode 35.

The filter 531 simply flows the packet 60 into the kernel mode 35 when the destination IP 63 of the packet 60 does not match the IP 70 of the predetermined internal terminals PC1 to PCn. (S22)

As shown in FIG. 3, the filter 531 filters the packet 60a when the destination IP 63 of the packet 60 and the IP 70 of the internal terminals PC1 to PCn match.

At this time, the redirector module 533 hooks the packet 60a filtered by the filter 531, converts the destination IP 63 of the packet 60a into the agent module IP 90, and sends the packet 60a to the agent module 535. (S23)

As shown in FIG. 3, the redirector module 533 hooks the packet 60a and transmits it to the agent module 535.

At this time, when the destination IP (63) of the packet 60 is generated as 10.10.0.1, the source port is assigned an arbitrary port, the redirector module 533 is a random port (originating port) assigned to the memory The destination address and destination port 10.0.0.1 are stored in memory.

Then, the redirector module 533 converts the destination IP 63 of the packet 60a to the agent module IP 90 of the agent module 535 and converts the converted packet 60b as shown in FIG. Send to module 535.

That is, in the redirector module 533, the destination IP 63 is converted from 10.10.0.1/80 to 127.0.0.1/31081 and transmitted to the agent module 535 as shown in FIG. 5.

Upon receiving the packet 60b, the agent module 535 converts the agent module IP 90 of the packet 60b into the VPN main unit IP 100 (S24).

When receiving the packet 60b, the agent module 535 connects the SSL main unit 50 with SSL communication, and transmits the received packet 60b to the VPN main unit 50.

When the packet 60b is received by the agent module 535, the agent module 535 is installed in the user mode 33 of the remote user terminal 20 to establish SSL communication with the VPN main unit 50.

The agent module 535 transmits the packet 60c transmitted from the redirector module 533 to the VPN main unit 50.

At this time, the agent module 535 converts the destination IP 63 of the received packet 60b into the VPN main unit IP 100.

That is, as shown in FIG. 5, the destination IP 63 127.0.0.1/31081 of the packet 60b received by the agent module 535 is converted into 211.1.1.1/8080 and transmitted to the VPN main unit 50. do.

The agent module 535 adds and transmits the destination IP 10.10.0.1/80 for the first access to the content 65 of the packet 60c.

That is, when the packet 60b is received, the agent module 535 searches for the source port in the memory, finds the stored destination IP 10.10.0.1 and the destination port, and adds it to the content 65.

The agent module 535 encrypts the packet 60c and transmits the encrypted packet 60c to the VPN main unit 50 (S25).

The VPN main unit 50 receiving the packet 60c converts the VPN main unit IP 100 of the packet 60c into a destination IP 70 to be initially accessed by the remote user terminal 20 (S26).

When the VPN main unit 50 receives the packet 60c from the agent module 535, the VPN main unit 50 makes a new connection with the internal terminal 30 connected to the private network 40 to be initially connected and receives the received packet 60c. To transmit to the internal terminal (30).

At this time, the VPN main unit 50 converts the destination IP 63 of the received packet 60c into the IP 70 of the internal terminal 30 to which the remote user terminal initially attempts to connect.

That is, the destination IP 63 of the received packet 60c is converted from 211.1.1.1/8080 to 10.10.0.0/80, as shown in FIG.

The VPN main unit 50 decrypts the packet 60d and transmits the packet to the internal terminal 30 (S27).

The internal terminal 30 receiving the packet 60d transmits the response packet 66 to the VPN main unit 50, and the VPN main unit 50 transmits the response packet 66 to the remote user terminal 20. (S28)

As shown in FIG. 4, the VPN main unit 50 encrypts the response packet 66 with the remote user terminal 20 waiting for a response, and transmits the packet 60 in the reverse order.

When the response packet 66 is received from the remote user terminal 20, the remote user terminal 20 and the internal terminal 30 are interconnected (S29).

As a result, the user can download and install the virtual private network system 1 to the remote user terminal 20 on the web through the public network network 10 so that the virtual private network system 1 can be installed anytime and anywhere without the need for a separate VPN device. Can be installed and used.

1 is a block diagram of a conventional virtual private network (vpn) service system,

2 is a block diagram of a virtual private network service system according to an embodiment of the present invention;

3 is a block diagram of a VPN turning unit of a virtual private network service system according to an embodiment of the present invention;

4 is a block diagram showing an IP address of each component of the virtual private network service system according to an embodiment of the present invention;

5 is a block diagram illustrating a packet conversion process of a virtual private network service system according to an embodiment of the present invention;

6 is a flowchart of a virtual private network service system according to an embodiment of the present invention;

7 is a screen example showing virtual private network installation information provided to a user according to one embodiment of the present invention;

8 is a screen example showing an authentication module provided to a user according to an embodiment of the present invention.

                   ** Description of the symbols for the main parts of the drawings **

1: Virtual private network (VPN) service system and method,

10: public network network, 20: remote user terminal,

30: internal terminal, 31: TDI layer,

33: user mode, 35: kernel mode,

40: private network, 50: VPN main unit,

51: virtual private network installation information, 52: installation tool,

53: VPN tunneling unit, 55: authentication module, 60 (60a, 60b, 60c, 60d): packet,

61: source IP, 63: destination IP, 65: content, 66: response packet, 70: internal terminal IP, 80: remote user terminal IP, 90: agent IP, 100: VPN main unit IP, 531: filter, 533: Redirector module, 535: Agent module.

Claims (8)

A method for implementing a virtual private network (VPN) for accessing a private network in an enterprise through a public network in a remote user terminal, A first step of transmitting virtual private network (VPN) installation information from the VPN main unit to the remote user terminal when the remote user terminal connects to the VPN main unit connecting the public network network and the private network within the enterprise through a public network network; ; A second step of downloading an authentication module and a VPN tunneling unit from the VPN main unit to the remote user terminal when a VPN installation request signal is received from the remote user terminal; A third step of installing the authentication module and a VPN tunneling unit in the remote user terminal; A fourth step of authenticating a connection of the remote user terminal through the authentication module in the VPN main unit; When the remote user terminal generates a packet directed to a predetermined internal terminal connected to the private network in the enterprise, the VPN tunneling unit hooks the packet passing through a TDI layer, encrypts the hooked packet, and A fifth step of transmitting to the VPN main unit; A sixth step of decrypting the received packet from the VPN main unit and transmitting the received packet to the predetermined internal terminal, and encrypting and transmitting a response packet to the remote user terminal to interconnect the remote user terminal and the internal terminal; Virtual private network (VPN) service method. The method of claim 1, The VPN tunneling module includes a filter, a redirector module, and an agent module. The fifth step includes: filtering, from the filter, packets destined for the predetermined internal terminal among all packets passing through the TDI layer of the remote user terminal; Hooking the filtered packet in the redirector module and transmitting the hooked packet to the agent module; And encrypting the hooked packet in the agent module and transmitting the encrypted packet to the VPN main unit. The method of claim 2, In step A, a destination IP of all packets passing through the TDI layer of the remote user terminal is compared with IPs of respective internal terminals connected to the private network in the enterprise, and the destination IP of the packet is identical to the IP of the internal terminals. If the packet is filtered (Virtual Private Network (VPN)), characterized in that the filtering (Filtering). The method according to claim 2 or 3, remind Step B may include converting a destination IP of the hooked packet into an agent IP of the agent module in the redirector module; And transmitting the packet to the agent module. The method of claim 4, wherein In step C, when the hooked packet is received by the agent module, the agent module converts the agent IP of the hooked packet into a VPN main unit IP. Steps; Adding a destination IP to the contents of the packet to be accessed first by the remote user terminal; Transmitting the packet to the VPN main unit; a virtual private network (VPN) service method comprising a. The method of claim 5, The sixth step may include: decrypting a packet received by the VPN main unit; Reconverting the VPN main unit IP of the received packet to the first destination IP of the internal terminal and transmitting the converted packet to the internal terminal; And encrypting a response packet to the remote user terminal in reverse order. The method of claim 1, The VPN main unit is a virtual private network (VPN) service method characterized in that the SSL (Secure Sockets Layer) encrypted communication is possible. A remote user terminal; The VPN main unit transmits the VPN installation information to the remote user terminal when connected through the user terminal, and provides a VPN tunneling unit and an authentication module to the remote user terminal when a user's installation request signal is received. and; An internal terminal connected to an intra-company private network network to which the remote user terminal is to access; A filter for filtering matching packets by comparing destination IPs of all packets passing through the TDI layer of the remote user terminal and IPs of the respective internal terminals, and hooking the filtered packets ( A redirector module for hooking and converting the destination IP of the hooked packet into an agent IP, and receiving the converted packet from the redirector module to convert the agent IP into a VPN main unit IP. A VPN tunneling unit having an agent module for adding a destination IP to the content of the packet to be initially accessed by the remote user terminal, encrypting the packet, and transmitting the encrypted IP to the VPN main unit; An authentication module for authenticating access to the VPN main unit of the remote user terminal; When the encrypted packet is received from the agent module, the VPN main unit IP of the packet is converted into the destination IP to be initially accessed by the remote user terminal, and then decrypted and transmitted to the internal terminal connected to the private network in the enterprise. And a VPN main unit encrypting the response packet and transmitting the reverse packet to the remote user terminal in reverse order.  Virtual private network (VPN) service system, characterized in that the user terminal and the internal terminal is interconnected.

Images