Method, device and equipment for requesting enterprise intranet service by SaaS platform and storage medium

Abstract

The invention discloses a method, a device and equipment for requesting an enterprise intranet service by a SaaS platform, and a storage medium. The method comprises the following steps: storing a target request message corresponding to the SaaS service to a request intermediate library of a server of an enterprise service request proxy service; when a client of the enterprise service request proxy service obtains a to-be-processed request, extracting a corresponding target request from the request intermediate library according to the request parameter of the to-be-processed request and returning the target request to the client; forwarding the target request through the enterprise intranet, obtaining a response message of the enterprise intranet service, and writing the response message into a response intermediate library of the server; and querying response data corresponding to the target request message from a response intermediate library. According to the invention, on the premise that only the enterprise side service actively requests the SaaS side service, the effect that the SaaS service actively requests the enterprise side service is achieved, the security of the enterprise digital service is improved, and the development cost is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method, device, equipment and storage medium for requesting enterprise intranet services from a SaaS platform. Background Art

[0002] In the process of SaaS platform providing digital services to enterprises, there may be situations where SaaS services need to actively call the enterprise's local system. For example, after business processing is completed, the enterprise's financial system is called back to generate financial vouchers.

[0003] Generally speaking, if the enterprise's local system is well maintained and open, it can provide an Internet-accessible interface to the SaaS service based on the https transmission protocol and OAuth2 or other request authentication protocol systems. In this case, by opening the network firewalls on the SaaS service side and the enterprise side, the SaaS service can directly access the enterprise service normally. However, the current status of enterprise digital services is that a large number of digital services deployed locally in the enterprise lack continuous maintenance and upgrades. They may be developed based on outdated and insecure frameworks and have a large number of security vulnerabilities. It is extremely unsafe to expose them to the Internet; or they are completely localized single-body deployment architectures and do not have the conditions for opening interfaces to the outside world. In this case, the SaaS service cannot directly access these enterprise service interfaces normally. Opening a dedicated line between the SaaS service and the enterprise side network is a solution, but this method is generally more expensive.

[0004] Therefore, there is an urgent need for a method for SaaS platforms to request enterprise intranet services, which can not only effectively improve the security of enterprise digital services, but also effectively reduce development costs. Summary of the invention

[0005] The main purpose of the present invention is to provide a method, device, equipment and storage medium for requesting enterprise intranet services from a SaaS platform, aiming to solve the technical problems of low security and high cost of enterprise digital services in the prior art.

[0006] To achieve the above object, the present invention provides a method for requesting enterprise intranet services via a SaaS platform, the method comprising the following steps:

[0007] The target request message corresponding to the SaaS service is stored in the request intermediate library of the server of the enterprise service request proxy service, and the server is deployed on the SaaS service side;

[0008] When a client of the enterprise service request proxy service obtains a pending request, a corresponding target request is extracted from the request intermediate library according to request parameters of the pending request and returned to the client, which is deployed on the enterprise side;

[0009] Forwarding the target request through the enterprise intranet, obtaining a response message from the enterprise intranet service, and writing the response message into a response intermediate library on the server side;

[0010] The response data corresponding to the target request message is queried from the response intermediate library.

[0011] Optionally, before the step of storing the target request message corresponding to the SaaS service in the request intermediate library of the server side of the enterprise service request proxy service, the step further includes:

[0012] Downloading a service certificate from a server of the enterprise service request proxy service through a client of the enterprise service request proxy service, wherein the service certificate includes an application identifier of the SaaS service and / or a server public key;

[0013] Initialize configuration of the client based on the service certificate and generate a client key pair;

[0014] Encrypting a registration request using the server public key, and transmitting the encrypted registration request to the server, the registration request including the application identifier, a timestamp, and a public key corresponding to the client key pair;

[0015] After receiving the encrypted registration request, the server uses the server private key to decrypt it and verifies the decryption result to obtain a verification result;

[0016] If the verification result indicates that the verification is passed, the public key corresponding to the client key pair is cached according to the application identifier.

[0017] Optionally, after receiving the encrypted registration request, the server uses a server private key to decrypt the request and verifies the decryption result to obtain the verification result, including:

[0018] After receiving the encrypted registration request, the server uses the server private key to decrypt the encrypted registration request to obtain a decryption result;

[0019] The timestamp is extracted based on the decryption result, and it is determined whether the timestamp is expired, and the determination result is used as the verification result.

[0020] Optionally, the step of storing the target request message corresponding to the SaaS service in a request intermediate library of the server side of the enterprise service request proxy service includes:

[0021] When the SaaS service needs to request an enterprise intranet service, it assembles the message based on the target application identifier and the original request message to generate a target request message.

[0022] After calling the request submission interface of the server of the enterprise service request proxy service to send the target request message to the server, obtain the server private key and the client public key corresponding to the target application identifier;

[0023] Encrypt the target request message using the client public key corresponding to the target application identifier, sign the encrypted target request message using the server private key, and obtain the encrypted and signed target request message;

[0024] The encrypted and signed target request message is stored in the request intermediate library of the server.

[0025] Optionally, when the client of the enterprise service request proxy service obtains a pending request, the step of extracting a corresponding target request from the request intermediate library according to request parameters of the pending request and returning the request to the client includes:

[0026] When the client of the enterprise service request proxy service obtains the pending request through periodic polling, the pending request is encrypted by using the server public key, and the encrypted pending request is signed by using the client private key to obtain the encrypted and signed pending request;

[0027] Transmitting the encrypted and signed pending request to the server;

[0028] After receiving the encrypted and signed pending request, the server uses the client public key to verify the signature of the encrypted and signed pending request;

[0029] After the signature verification is passed, the server private key is used to decrypt the encrypted and signed pending request to obtain the original pending request;

[0030] The corresponding target request is extracted from the request intermediate library according to the request parameters of the original request to be processed and returned to the client.

[0031] Optionally, the step of forwarding the target request through an intranet, obtaining a response message of the intranet service, and writing the response message into a response intermediate library of the server includes:

[0032] After the client receives the target request, it uses the server public key to verify the signature;

[0033] After the signature verification is passed, the target request is decrypted using the client private key to obtain the original target request;

[0034] Forwarding the original target request through the enterprise intranet to obtain a response message from the enterprise intranet service;

[0035] The response message is written into the response intermediate library of the server.

[0036] 8. Optionally, after the step of forwarding the original target request through the enterprise intranet and obtaining a response message of the enterprise intranet service, the step further includes:

[0037] The response message is encrypted using the server public key, and the encrypted response message is signed using the client private key to obtain an encrypted and signed response message;

[0038] Submit the encrypted and signed response message to the server, and use the client public key and the server private key to verify and decrypt the encrypted and signed response message in turn to obtain the original response message;

[0039] Accordingly, the step of writing the response message into the response intermediate library of the server includes:

[0040] The original response message is written into the response intermediate library of the server.

[0041] In addition, to achieve the above-mentioned purpose, the present invention also proposes a SaaS platform requesting an enterprise intranet service device, the device comprising:

[0042] A request storage module, used to store the target request message corresponding to the SaaS service in a request intermediate library of the server of the enterprise service request proxy service, wherein the server is deployed on the SaaS service side;

[0043] A request extraction module, used for extracting the corresponding target request from the request intermediate library according to the request parameters of the request to be processed and returning it to the client when the client of the enterprise service request proxy service obtains the request to be processed, and the client is deployed on the enterprise side;

[0044] A response storage module, used to forward the target request through the enterprise intranet, obtain the response message of the enterprise intranet service, and write the response message into the response intermediate library of the server;

[0045] The response query module is used to query the response data corresponding to the target request message from the response intermediate library.

[0046] In addition, to achieve the above-mentioned purpose, the present invention also proposes a SaaS platform requesting enterprise intranet service device, the device comprising: a memory, a processor, and a SaaS platform requesting enterprise intranet service program stored in the memory and executable on the processor, the SaaS platform requesting enterprise intranet service program being configured to implement the steps of the SaaS platform requesting enterprise intranet service method as described above.

[0047] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which is stored a SaaS platform requesting an enterprise intranet service program, and when the SaaS platform requesting an enterprise intranet service program is executed by a processor, the steps of the SaaS platform requesting an enterprise intranet service method as described above are implemented.

[0048] The present invention discloses a request intermediate library for storing a target request message corresponding to a SaaS service in a server of an enterprise service request proxy service, wherein the server is deployed on the SaaS service side; when a client of the enterprise service request proxy service obtains a pending request, the corresponding target request is extracted from the request intermediate library according to the request parameters of the pending request and returned to the client, wherein the client is deployed on the enterprise side; the target request is forwarded through an enterprise intranet, a response message of the enterprise intranet service is obtained, and the response message is written into the response intermediate library of the server; and the response data corresponding to the target request message is queried from the response intermediate library. Since the present invention deploys the server of the enterprise service request proxy service on the SaaS service side, and the client of the enterprise service request proxy service on the enterprise side, the server is used to temporarily store the SaaS service request, the client pulls the request, and the enterprise intranet forwards the response and transmits it back to the server, and the process of the SaaS service request response, compared with the prior art, the present invention realizes the effect that the SaaS service actively requests the enterprise side service under the premise that only the enterprise side service actively requests the SaaS side service, which not only improves the security of the enterprise digital service, but also reduces the development cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of a first embodiment of a method for requesting enterprise intranet services via a SaaS platform of the present invention;

[0050] Figure 2 A flowchart of a second embodiment of a method for requesting enterprise intranet services via a SaaS platform of the present invention;

[0051] Figure 3 A flowchart of a third embodiment of a method for requesting enterprise intranet services via a SaaS platform of the present invention;

[0052] Figure 4 This is a schematic diagram of the overall framework of the method for requesting enterprise intranet services via the SaaS platform of the present invention;

[0053] Figure 5 This is a schematic diagram of an application scenario of the method for requesting enterprise intranet services via a SaaS platform of the present invention;

[0054] Figure 6 This is a structural block diagram of the first embodiment of the device for requesting enterprise intranet services from a SaaS platform of the present invention;

[0055] Figure 7 It is a structural diagram of a SaaS platform in a hardware operating environment involved in an embodiment of the present invention requesting an enterprise intranet service device.

[0056] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0058] The embodiment of the present invention provides a method for requesting enterprise intranet services via a SaaS platform. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the method for requesting enterprise intranet services via a SaaS platform of the present invention.

[0059] In this embodiment, the method for requesting enterprise intranet service from the SaaS platform includes steps S10 to S40:

[0060] Step S10: storing the target request message corresponding to the SaaS service in the request intermediate library of the server of the enterprise service request proxy service, where the server is deployed on the SaaS service side.

[0061] It should be noted that the execution subject of this embodiment can be a computer server device with data processing, network communication and program running functions, such as a server, a personal computer, a laptop computer, a mobile phone, a smart watch, etc., which is used in the scenario of providing digital services to enterprises on the SaaS platform, or an electronic device capable of realizing the above functions, a SaaS platform requesting enterprise intranet service device, etc. The following takes a system including a SaaS platform requesting enterprise intranet service device as an example to illustrate this embodiment and the following embodiments.

[0062] It should be understood that the enterprise service request proxy service refers to a service mode in which an enterprise chooses to send and receive requests through a proxy server when processing its network service needs. Proxy service is a network service that allows clients (here refers to devices or users within the enterprise) to send requests through a proxy server to access the target server. The proxy server receives the client's request, processes the request on behalf of the target server and returns the result. In this process, the proxy server can perform multiple functions such as caching, filtering, encryption, etc. to improve network performance and security.

[0063] It is necessary to explain that the meaning of SaaS service side can be related to the roles and responsibilities of the SaaS provider or supplier. SaaS is a cloud computing-based software delivery model in which software suppliers deploy software applications on cloud servers and provide services to users through the Internet. The enterprise side can be the part involving the provision of digital services to enterprises.

[0064] In a specific implementation, the server of the enterprise service request proxy service can be deployed on the SaaS service side, and the client of the enterprise service request proxy service can be deployed on the enterprise side. Then, the network of the server where the client is located can be opened on the enterprise side to access the server.

[0065] It should be noted that the target request message may be a request message generated by assembling the target application identifier and the original request message.

[0066] It should be understood that the target application identifier, for example, AppId, can refer to a number or letter combination used to uniquely identify a specific application during software development and deployment. This identifier (application identifier) ​​plays an important role in the life cycle of an application. It is not only the identity of the application, but also involves multiple aspects such as permission verification, authorization management, and the distinction and management of applications.

[0067] In the specific implementation, in order to ensure the security of data transmission, the request submission interface of the server can also be called to send the target request message to the server, and then the target request message can be encrypted by an encryption algorithm, and then the encrypted target request message can be stored in the request intermediate library of the server.

[0068] Step S20: When the client of the enterprise service request proxy service obtains a pending request, the corresponding target request is extracted from the request intermediate library according to the request parameters of the pending request and returned to the client, which is deployed on the enterprise side.

[0069] It should be noted that the above client can obtain pending requests by means of periodic polling.

[0070] In a specific implementation, when the client obtains a pending request through periodic polling, the public key of the encryption algorithm is used to encrypt the pending request to obtain the encrypted pending request; the encrypted pending request is transmitted to the server; after the server receives the encrypted pending request, the private key of the encryption algorithm is used to decrypt the encrypted pending request to obtain the original pending request; the corresponding target request is extracted from the request intermediate library according to the request parameters of the original pending request and returned to the client.

[0071] Step S30: forwarding the target request through the enterprise intranet, obtaining a response message of the enterprise intranet service, and writing the response message into the response intermediate library of the server.

[0072] It should be understood that an intranet can be a local network formed within an enterprise through physical or virtual connections. Its coverage is generally within the enterprise or a specific area, and is used to achieve interconnection and data sharing within the enterprise.

[0073] Enterprise intranet service is an important part of enterprise informatization construction. It provides a series of services to meet the comprehensive needs of enterprises by building an internal network environment.

[0074] In the specific implementation, after the client receives the target request, it can use the private key of the encryption algorithm to decrypt the encrypted target request to obtain the original target request; forward the original target request through the enterprise intranet to obtain the response message of the enterprise intranet service; use the public key of the encryption algorithm to encrypt the response message to obtain the encrypted response message; submit the encrypted response message to the server, and use the private key of the encryption algorithm to decrypt the encrypted response message to obtain the original response message; write the original response message into the response intermediate library of the server.

[0075] Step S40: querying the response data corresponding to the target request message from the response intermediate library.

[0076] It should be noted that the event loop on the server triggered by the SaaS service request (i.e., the target request message) continuously polls the response intermediate library to query whether a response from the client is obtained. If a response is obtained, the response is returned to the SaaS service; if the upper limit of the event loop is reached and the client's response is still not obtained, it is judged as a timeout and the timeout is returned to the SaaS service.

[0077] It should be noted that the encryption algorithm mentioned in this embodiment may be a national secret algorithm, for example, the SM2 algorithm, which uses a public key for encryption and a private key for decryption.

[0078] This embodiment discloses storing the target request message corresponding to the SaaS service in the request intermediate library of the server of the enterprise service request proxy service, and the server is deployed on the SaaS service side; when the client of the enterprise service request proxy service obtains the pending request, the corresponding target request is extracted from the request intermediate library according to the request parameters of the pending request and returned to the client, and the client is deployed on the enterprise side; forwarding the target request through the enterprise intranet, obtaining the response message of the enterprise intranet service, and writing the response message into the response intermediate library of the server; querying the response data corresponding to the target request message from the response intermediate library. Since this embodiment deploys the server of the enterprise service request proxy service on the SaaS service side, and deploys the client of the enterprise service request proxy service on the enterprise side, uses the server to temporarily store the SaaS service request, the client pulls the request, and the enterprise intranet forwards the response and transmits it back to the server, the process of SaaS service request response, compared with the prior art, this embodiment realizes that only the enterprise side service actively requests the SaaS side service, and the SaaS service actively requests the enterprise side service, which not only improves the security of the enterprise digital service, but also reduces the development cost.

[0079] refer to Figure 2 , Figure 2 This is a flow chart of a second embodiment of the method for requesting enterprise intranet services via a SaaS platform of the present invention.

[0080] Based on the first embodiment described above, in this embodiment, before step S10, steps S01 to S05 are further included:

[0081] Step S01: downloading a service certificate from a server of the enterprise service request proxy service through a client of the enterprise service request proxy service, wherein the service certificate includes an application identifier of the SaaS service and / or a server public key.

[0082] Step S02: Initialize the client configuration based on the service certificate and generate a client key pair.

[0083] Step S03: Use the server public key to encrypt the registration request, and transmit the encrypted registration request to the server, wherein the registration request includes the application identifier, a timestamp, and the public key corresponding to the client key pair.

[0084] Step S04: After receiving the encrypted registration request, the server uses the server private key to decrypt it, and verifies the decryption result to obtain a verification result.

[0085] Step S05: If the verification result indicates that the verification is passed, the public key corresponding to the client key pair is cached according to the application identifier.

[0086] It should be understood that the above service certificates can be enterprise intranet service certificates, especially SSL certificates, which are crucial to ensuring the security and integrity of enterprise intranet data transmission. SSL certificates are mainly used to establish an encrypted communication channel between the client and the server to prevent data from being stolen or tampered with during transmission. In the enterprise intranet environment, although the data is not directly exposed to the public network, considering the security and compliance requirements of internal sensitive data, it is also important to deploy SSL certificates.

[0087] In order to further improve the security of encrypted transmission, the above step S104 includes: after the server receives the encrypted registration request, use the server private key to decrypt the encrypted registration request to obtain a decryption result; extract the timestamp based on the decryption result, and determine whether the timestamp is expired, whether the requesting IP address is a trusted IP address of the corresponding application identifier application, and then use the judgment result as the verification result. If the verification passes, the public key corresponding to the client key pair (i.e., the client public key) is cached according to the application identifier.

[0088] This embodiment discloses that a client of an enterprise service request proxy service downloads a service certificate from a server of the enterprise service request proxy service, wherein the service certificate includes an application identifier of a SaaS service and / or a server public key; the client is initialized and configured based on the service certificate and a client key pair is generated; the registration request is encrypted using the server public key and the encrypted registration request is transmitted to the server, wherein the registration request includes the application identifier, a timestamp and a public key corresponding to the client key pair; after the server receives the encrypted registration request, the server private key is used to decrypt the request and the decryption result is verified to obtain a verification result; if the verification result indicates that the verification is passed, the public key corresponding to the client key pair is cached according to the application identifier. Compared with the prior art, since this embodiment initializes and configures the client based on the service certificate and generates a client key pair; the registration request is encrypted using the server public key and the encrypted registration request is transmitted to the server, after the server receives the encrypted registration request, the server private key is used to decrypt the request and the decryption result is verified, and if the verification is passed, the client public key is cached according to the application identifier, thereby further ensuring the security of data transmission.

[0089] refer to Figure 3 , Figure 3 This is a flow chart of a third embodiment of the method for requesting enterprise intranet services via a SaaS platform of the present invention.

[0090] Based on the above embodiments, in this embodiment, step S10 includes steps S101 to S104:

[0091] Step S101: When the SaaS service needs to request an enterprise intranet service, a message is assembled based on the target application identifier and the original request message to generate a target request message.

[0092] Step S102: after calling the request submission interface of the server of the enterprise service request proxy service to send the target request message to the server, obtain the server private key and the client public key corresponding to the target application identifier.

[0093] Step S103: Encrypt the target request message using the client public key corresponding to the target application identifier, sign the encrypted target request message using the server private key, and obtain the encrypted and signed target request message.

[0094] Step S104: storing the encrypted and signed target request message in the request intermediate library of the server.

[0095] Accordingly, the step S20 includes steps S201 to S205:

[0096] Step S201: When the client of the enterprise service request proxy service obtains a pending request through periodic polling, the pending request is encrypted using the server public key, and the encrypted pending request is signed using the client private key to obtain the encrypted and signed pending request.

[0097] Step S202: Transmit the encrypted and signed pending request to the server.

[0098] Step S203: After the server receives the encrypted and signed request to be processed, the server uses the client public key to verify the signature of the encrypted and signed request to be processed.

[0099] Step S204: After the signature verification is passed, the encrypted and signed request to be processed is decrypted using the server private key to obtain the original request to be processed.

[0100] Step S205: extracting the corresponding target request from the request intermediate library according to the request parameters of the original request to be processed and returning it to the client.

[0101] Accordingly, step S30 includes steps S301 to S306:

[0102] Step S301: After the client receives the target request, it uses the server public key to verify the signature.

[0103] Step S302: After the signature verification is passed, the target request is decrypted using the client private key to obtain the original target request.

[0104] Step S303: forwarding the original target request via the enterprise intranet to obtain a response message from the enterprise intranet service.

[0105] Step S304: writing the response message into the response intermediate library of the server.

[0106] In order to enhance the security of data transmission, after step S303, it also includes: encrypting the response message using the server public key, signing the encrypted response message using the client private key, and obtaining an encrypted and signed response message; submitting the encrypted and signed response message to the server, and using the client public key and the server private key to verify and decrypt the encrypted and signed response message in turn to obtain the original response message.

[0107] Correspondingly, step S304 includes: writing the original response message into the response intermediate library of the server.

[0108] It should be explained that the encryption and decryption algorithm can be SM2, which uses a public key for encryption and a private key for decryption. The signature verification algorithm can be SM2WithSM3, which uses a private key for signature and a public key for verification.

[0109] For example, refer to Figure 4 and Figure 5 , Figure 4In the SaaS service room, deploy the server of the enterprise service request proxy service, deploy the client of the enterprise service request proxy service in the enterprise intranet room, and enable the server where the proxy service client is located to access the network of the SaaS side server on the enterprise side. Download the service certificate from the server on the SaaS side. The certificate contains the open application information of the SaaS service, application identifier (AppId) / server public key (the key pair is generated in advance) and other information. Install the service certificate on the client on the enterprise side, the client performs initialization configuration and generates a client key pair, and initiates a registration request to the server; the request contains: application identifier (AppId) + timestamp + public key of the client key pair; the message is encrypted with the server public key and transmitted to the server. After receiving the request, the server uses the server private key to decrypt it, and then verifies: whether the timestamp has expired, whether the requesting IP address is a trusted IP address of the corresponding AppId application; after the verification is passed, the client public key is cached according to the AppId. When the SaaS service needs to request an enterprise intranet service, after assembling the message, it calls the request submission interface (including application identification information) of the server of the enterprise service request proxy service. The latter first encrypts the request message with the client public key corresponding to the AppId, and then signs it with the server private key, stores it in the (request) intermediate library of the request proxy service, and then enters the event loop waiting for the response. The proxy service client deployed on the enterprise side obtains the pending proxy request through extremely short periodic polling of the proxy service server. The request parameters include: AppId + timestamp; the message is encrypted with the server public key, signed with the client private key, and then transmitted to the server. After receiving the request, the server verifies the signature with the client public key, decrypts it with the server private key, and then extracts the corresponding request from the request intermediate library according to the input AppId and timestamp; after extracting the request, it encrypts it with the client public key, signs it with the server private key, and then returns it to the client. The client extracts the request to be processed, verifies the signature of the request command using the server's public key, and then decrypts it using the client's private key to obtain the original request command; then the request command is forwarded in the enterprise intranet, and after obtaining the response of the intranet service, the response data is encrypted using the server's public key, signed using the client's private key, and then the proxy service server is called to submit the response. The proxy service server verifies the signature of the response message submitted by the client using the server's private key, decrypts it using the client's public key, obtains the original response result of the enterprise intranet service, and writes it to the response intermediate library. The event loop of the proxy service server triggered by the SaaS service request continuously polls the response intermediate library to check whether a response from the client is obtained. If a response is obtained, the response is returned to the SaaS service; if the upper limit of the event loop is reached and the client's response is still not obtained, it is judged as a timeout, and a timeout response is returned to the SaaS service. Figure 5The figure shows a simplified diagram of the principle of the enterprise service proxy service. The SaaS service normally requests the enterprise. If the enterprise's local system is well maintained and open, it can provide the SaaS service with an Internet-accessible interface based on the https transmission protocol and OAuth2 or other request authentication protocol systems. In this case, by opening the network firewalls on the SaaS service side and the enterprise side, the SaaS service can directly access the enterprise service normally. However, the current situation of domestic enterprise digital services is that a large number of digital services deployed locally in the enterprise lack continuous maintenance and upgrades. They may be developed based on outdated and insecure frameworks and have a large number of security vulnerabilities. It is extremely unsafe to expose them to the Internet; or they are completely localized single-body deployment architectures that do not have the conditions for opening interfaces to the outside world. In this case, the SaaS service cannot directly access these enterprise service interfaces normally. Therefore, this embodiment realizes that the SaaS service accesses the enterprise service through a proxy, deploys the server end of the enterprise service request proxy service in the SaaS service computer room, and deploys the client end of the enterprise service request proxy service in the enterprise intranet computer room. The encryption and decryption algorithm in the figure can be SM2, using public key encryption and private key decryption. The signature verification algorithm can be SM2WithSM3, using the private key for signature and the public key for verification.

[0110] This embodiment discloses that when a SaaS service needs to request an enterprise intranet service, it assembles messages based on the target application identifier and the original request message to generate a target request message; after calling the request submission interface of the server to send the target request message to the server, it obtains the server private key and the client public key corresponding to the target application identifier; encrypts the target request message using the client public key corresponding to the target application identifier, and then signs the encrypted target request message using the server private key to obtain an encrypted and signed target request message; and stores the encrypted and signed target request message in the request intermediate library of the server. Compared with the prior art, this embodiment ensures the reliability of encrypted transmission.

[0111] In addition, an embodiment of the present invention further proposes a storage medium, on which is stored a SaaS platform requesting an enterprise intranet service program, which, when executed by a processor, implements the steps of the SaaS platform requesting an enterprise intranet service method as described above.

[0112] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the device for requesting enterprise intranet services from the SaaS platform of the present invention.

[0113] like Figure 6As shown, the SaaS platform requesting enterprise intranet service device proposed in the embodiment of the present invention includes: a request storage module 601, a request extraction module 602, a response storage module 603 and a response query module 604.

[0114] The request storage module 601 is used to store the target request message corresponding to the SaaS service in the request intermediate library of the server of the enterprise service request proxy service, and the server is deployed on the SaaS service side.

[0115] The request extraction module 602 is used to extract the corresponding target request from the request intermediate library according to the request parameters of the request to be processed and return it to the client when the client of the enterprise service request proxy service obtains the request to be processed. The client is deployed on the enterprise side.

[0116] The response storage module 603 is used to forward the target request through the enterprise intranet, obtain the response message of the enterprise intranet service, and write the response message into the response intermediate library of the server;

[0117] The response query module 604 is used to query the response data corresponding to the target request message from the response intermediate library.

[0118] The embodiment of the device discloses storing the target request message corresponding to the SaaS service to the request intermediate library of the server of the enterprise service request proxy service, and the server is deployed on the SaaS service side; when the client of the enterprise service request proxy service obtains the pending request, the corresponding target request is extracted from the request intermediate library according to the request parameters of the pending request and returned to the client, and the client is deployed on the enterprise side; the target request is forwarded through the enterprise intranet, the response message of the enterprise intranet service is obtained, and the response message is written into the response intermediate library of the server; the response data corresponding to the target request message is queried from the response intermediate library. Since the embodiment of the device deploys the server of the enterprise service request proxy service on the SaaS service side, and the client of the enterprise service request proxy service on the enterprise side, the server is used to temporarily store the SaaS service request, the client pulls the request, and the enterprise intranet forwards the response and transmits it back to the server, the process of SaaS service request response, compared with the prior art, the embodiment of the device realizes that only the enterprise side service actively requests the SaaS side service, and the SaaS service actively requests the enterprise side service, which not only improves the security of the enterprise digital service, but also reduces the development cost.

[0119] Based on the above-mentioned first embodiment of the SaaS platform requesting an enterprise intranet service device of the present invention, a second embodiment of the SaaS platform requesting an enterprise intranet service device of the present invention is proposed.

[0120] In this embodiment, the system deployment module 601 is also used to download a service certificate from the server of the enterprise service request proxy service through the client of the enterprise service request proxy service, the service certificate including the application identifier and / or server public key of the SaaS service; initialize the client configuration based on the service certificate and generate a client key pair; use the server public key to encrypt the registration request, and transmit the encrypted registration request to the server, the registration request including the application identifier, timestamp and the public key corresponding to the client key pair; after the server receives the encrypted registration request, use the server private key to decrypt it, and verify the decryption result to obtain a verification result; if the verification result indicates that the verification is passed, cache the public key corresponding to the client key pair according to the application identifier.

[0121] The system deployment module 601 is also used to decrypt the encrypted registration request using the server private key after the server receives the encrypted registration request to obtain a decryption result; extract the timestamp based on the decryption result, and determine whether the timestamp has expired, and use the determination result as a verification result.

[0122] Other embodiments or specific implementations of the SaaS platform of the present invention requesting the enterprise intranet service device can refer to the above-mentioned method embodiments, which will not be repeated here.

[0123] The present application provides a SaaS platform requesting an enterprise intranet service device, the SaaS platform requesting an enterprise intranet service device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the SaaS platform requesting an enterprise intranet service method in the above-mentioned embodiment one.

[0124] Reference below Figure 7 , which shows a schematic diagram of the structure of the SaaS platform requesting enterprise intranet service device suitable for implementing the embodiment of the present application. The SaaS platform requesting enterprise intranet service device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7The SaaS platform requesting the enterprise intranet service device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] like Figure 7 As shown, the SaaS platform requesting the enterprise intranet service device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 to the random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the SaaS platform to request the enterprise intranet service device to operate are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the SaaS platform to request the enterprise intranet service device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a SaaS platform with various systems requesting the enterprise intranet service device, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0126] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0127] The SaaS platform provided in this application requests the enterprise intranet service device, and adopts the SaaS platform requesting the enterprise intranet service method in the above embodiment, which can solve the technical problems of low security and high cost of enterprise digital services in the prior art. Compared with the prior art, the beneficial effects of the SaaS platform requesting the enterprise intranet service device provided in this application are the same as the beneficial effects of the SaaS platform requesting the enterprise intranet service method provided in the above embodiment, and the other technical features of the SaaS platform requesting the enterprise intranet service device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0128] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0130] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0131] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0133] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for requesting enterprise intranet services from a SaaS platform, characterized in that: The method includes: The target request message corresponding to the SaaS service is stored in the request intermediate library of the server of the enterprise service request proxy service, and the server is deployed on the SaaS service side; When a client of the enterprise service request proxy service obtains a pending request, the corresponding target request is extracted from the request intermediate library according to the request parameters of the pending request and returned to the client, which is deployed on the enterprise side; Forwarding the target request through the enterprise intranet, obtaining a response message from the enterprise intranet service, and writing the response message into a response intermediate library on the server side; The response data corresponding to the target request message is queried from the response intermediate library.

2. The method according to claim 1, characterized in that Before the step of storing the target request message corresponding to the SaaS service in the request intermediate library of the service end of the enterprise service request proxy service, the method further includes: Downloading a service certificate from a server of the enterprise service request proxy service through a client of the enterprise service request proxy service, wherein the service certificate includes an application identifier of the SaaS service and / or a server public key; Initialize configuration of the client based on the service certificate and generate a client key pair; Encrypting a registration request using the server public key, and transmitting the encrypted registration request to the server, the registration request including the application identifier, a timestamp, and a public key corresponding to the client key pair; After receiving the encrypted registration request, the server uses the server private key to decrypt it and verifies the decryption result to obtain a verification result; If the verification result indicates that the verification is passed, the public key corresponding to the client key pair is cached according to the application identifier.

3. The method according to claim 2, characterized in that After the server receives the encrypted registration request, the server uses the server private key to decrypt the request and verifies the decryption result to obtain the verification result, including: After receiving the encrypted registration request, the server uses the server private key to decrypt the encrypted registration request to obtain a decryption result; The timestamp is extracted based on the decryption result, and it is determined whether the timestamp is expired, and the determination result is used as the verification result.

4. The method according to claim 1, characterized in that The step of storing the target request message corresponding to the SaaS service in the request intermediate library of the server side of the enterprise service request proxy service includes: When the SaaS service needs to request an enterprise intranet service, it assembles the message based on the target application identifier and the original request message to generate a target request message. After calling the request submission interface of the server of the enterprise service request proxy service to send the target request message to the server, obtain the server private key and the client public key corresponding to the target application identifier; Encrypt the target request message using the client public key corresponding to the target application identifier, sign the encrypted target request message using the server private key, and obtain the encrypted and signed target request message; The encrypted and signed target request message is stored in the request intermediate library of the server.

5. The method according to claim 1, characterized in that The step of extracting the corresponding target request from the request intermediate library according to the request parameters of the request to be processed and returning it to the client when the client of the enterprise service request proxy service obtains the request to be processed includes: When the client of the enterprise service request proxy service obtains the pending request through periodic polling, the pending request is encrypted by using the server public key, and the encrypted pending request is signed by using the client private key to obtain the encrypted and signed pending request; Transmitting the encrypted and signed pending request to the server; After receiving the encrypted and signed pending request, the server uses the client public key to verify the signature of the encrypted and signed pending request; After the signature verification is passed, the server private key is used to decrypt the encrypted and signed pending request to obtain the original pending request; The corresponding target request is extracted from the request intermediate library according to the request parameters of the original request to be processed and returned to the client.

6. The method according to claim 5, characterized in that The step of forwarding the target request through the enterprise intranet, obtaining a response message of the enterprise intranet service, and writing the response message into the response intermediate library of the server includes: After the client receives the target request, it uses the server public key to verify the signature; After the signature verification is passed, the target request is decrypted using the client private key to obtain the original target request; Forwarding the original target request through the enterprise intranet to obtain a response message from the enterprise intranet service; The response message is written into the response intermediate library of the server.

7. The method according to claim 6, characterized in that After the step of forwarding the original target request through the enterprise intranet and obtaining the response message of the enterprise intranet service, the method further includes: The response message is encrypted using the server public key, and the encrypted response message is signed using the client private key to obtain an encrypted and signed response message; Submit the encrypted and signed response message to the server, and use the client public key and the server private key to verify and decrypt the encrypted and signed response message in turn to obtain the original response message; Accordingly, the step of writing the response message into the response intermediate library of the server includes: The original response message is written into the response intermediate library of the server.

8. A SaaS platform requesting an enterprise intranet service device, characterized in that: The device comprises: A request storage module, used to store the target request message corresponding to the SaaS service in a request intermediate library of the server of the enterprise service request proxy service, wherein the server is deployed on the SaaS service side; A request extraction module, used for extracting the corresponding target request from the request intermediate library according to the request parameters of the request to be processed and returning it to the client when the client of the enterprise service request proxy service obtains the request to be processed, and the client is deployed on the enterprise side; A response storage module, used to forward the target request through the enterprise intranet, obtain the response message of the enterprise intranet service, and write the response message into the response intermediate library of the server; The response query module is used to query the response data corresponding to the target request message from the response intermediate library.

9. A SaaS platform requests an enterprise intranet service device, characterized in that: The device includes: a memory, a processor, and a SaaS platform requesting enterprise intranet service program stored in the memory and executable on the processor, wherein the SaaS platform requesting enterprise intranet service program is configured to implement the steps of the SaaS platform requesting enterprise intranet service method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a SaaS platform requesting an enterprise intranet service program, and when the SaaS platform requesting an enterprise intranet service program is executed by the processor, the steps of the SaaS platform requesting an enterprise intranet service method as described in any one of claims 1 to 7 are implemented.

Images