Web application access proxy method and device in heterogeneous network environment

Abstract

The embodiment of the invention provides a web application access proxy method and device in a heterogeneous network environment, and the method comprises the steps: carrying out the identity authentication of a client based on an access request when the access request sent by the client is monitored, and carrying out the access control and content filtering of the access request after the identity authentication is passed; the reverse proxy service is used for dynamically converting the IP address in the access request and then forwarding the IP address to the target server; and receiving a request result returned by the reverse proxy service, and forwarding the request result to the client.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of cross-node access of web applications, and in particular, to a web application access proxy method and device in a heterogeneous network environment, and a computer-readable storage medium storing a computer program. Background Art

[0002] Application access proxy technology is a technology that manages network communications between clients and servers through a proxy server. It allows users to access internal company applications through a secure connection (such as SSL / TLS) in a wide area network (WAN) environment without directly exposing the IP address of the internal application, thereby reducing security risks. At the same time, access proxy also has many advantages such as access control, load balancing, traffic monitoring, content filtering, access acceleration, etc.

[0003] In a wide area network distributed heterogeneous environment, computers or application systems of different platforms, types and locations are interconnected to achieve data sharing and collaborative work. At the same time, since the application systems and the application systems and users in the heterogeneous environment need to interact across different nodes, potential security risks are increased. Currently, network access control is usually based on firewalls, but relying solely on firewalls cannot achieve functions such as content filtering and IP hiding. Summary of the invention

[0004] The embodiments described herein provide a web application access proxy method and apparatus in a heterogeneous network environment, and a computer-readable storage medium storing a computer program.

[0005] According to a first aspect of the present disclosure, a web application access proxy method in a heterogeneous network environment is provided, which is applied to a forward proxy service. The method includes: when an access request sent by a client is monitored, authenticating the client based on the access request, and performing access control and content filtering on the access request after the authentication is passed; dynamically converting the IP address in the access request and forwarding it to the reverse proxy service of the target server; and receiving the request result returned by the reverse proxy service, and forwarding the request result to the client.

[0006] In some embodiments of the present disclosure, the client is authenticated based on the identity authentication information of the client in the access request, and a data connection is established with the client after the authentication is passed; the client is waited for to send request data, and the request data is matched with the policy rules specified in the access control list, and the client access is prohibited if the match fails; and the request data is content filtered according to user needs to obtain filtered request data, and the content filtering includes URL filtering, keyword filtering and file type filtering.

[0007] In some embodiments of the present disclosure, the filtered request data is compared with the pre-stored static cache data, and the validity of the static cache data is determined; if the filtered request data contains static cache data and the static cache data is valid, the corresponding static cache data is returned to the client, and the static cache data includes pictures, script files, CSS styles and HTML files.

[0008] In some embodiments of the present disclosure, the source IP address in the access request is replaced with the public IP address of the forward proxy service; whether the access request forwarded by the forward proxy service is forwarded successfully is monitored; if the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

[0009] In some embodiments of the present disclosure, the working status of the forward proxy service is judged based on the success rate and response time of the forward request. When the forward proxy service is detected to be working abnormally, the forward proxy service is shut down; whether the bypass mechanism is met is judged based on the network delay, the load of the forward proxy service and the response status of the reverse proxy service. When the bypass mechanism is met, the access request is sent directly to the reverse proxy service of the target server; and when the forward proxy service returns to normal, the forward proxy service is restarted, and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

[0010] In some embodiments of the present disclosure, in response to receiving an access request, the reverse proxy service converts the destination IP address in the access request into the private IP address and port of the target server; based on the private IP address and port, the reverse proxy service forwards the access request to the backend server according to preset application routing rules, and returns the request result to the client's forward proxy service; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

[0011] In some embodiments of the present disclosure, the reverse proxy service uses the public key of the target server to encrypt the request data and sends the encrypted request data to the target server; after receiving the encrypted request data, the target server uses the private key to decrypt the encrypted request data to obtain the original request data of the client; the target server processes the original request data to obtain the request result, encrypts the request result with the private key and returns it to the reverse proxy service; the reverse proxy service decrypts the encrypted request result with the public key of the target server and returns it to the client's forward proxy service.

[0012] In some embodiments of the present disclosure, the reverse proxy service is used to distribute requests to multiple backend servers according to a preset load balancing strategy, and when a backend server fails, the request is redirected to other available servers.

[0013] According to a second aspect of the present disclosure, a web application access proxy device in a heterogeneous network environment is provided. The device includes at least one processor; and at least one memory storing a computer program. When the computer program is executed by at least one processor, the device: when monitoring an access request sent by a client, authenticates the client based on the access request, and performs access control and content filtering on the access request after the authentication is passed; dynamically converts the IP address in the access request and forwards it to the reverse proxy service of the target server; and receives the request result returned by the reverse proxy service, and forwards the request result to the client.

[0014] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device causes the device to perform access control and content filtering on the access request through the following operations: authenticate the client based on the identity authentication information of the client in the access request, and establish a data connection with the client after the authentication is passed; wait for the client to send request data, match the request data with the policy rules specified in the access control list, and prohibit the client from accessing if the match fails; and perform content filtering on the request data according to user needs to obtain filtered request data, wherein the content filtering includes URL filtering, keyword filtering, and file type filtering.

[0015] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device causes the device to cache match the access request through the following operations: comparing the filtered request data with the pre-stored static cache data; if the filtered request data contains static cache data, returning the corresponding static cache data to the client, and the static cache data includes pictures, script files, CSS styles and HTML files.

[0016] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device also performs the following operations to dynamically convert the IP address in the access request and forward it to the reverse proxy service of the target server: replace the source IP address in the access request with the public IP address of the forward proxy service; monitor whether the access request forwarded by the forward proxy service is forwarded successfully; if the forwarding fails, send the access request directly to the reverse proxy service of the target server according to the bypass mechanism.

[0017] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device also causes the device to send the access request directly to the reverse proxy service of the target server through the following operations: judging the working status of the forward proxy service based on the success rate and response time of the forwarding request, and shutting down the forward proxy service when it is detected that the forward proxy service is working abnormally; judging whether the bypass mechanism is met based on the network delay, the load of the forward proxy service and the response status of the reverse proxy service, and sending the access request directly to the reverse proxy service of the target server when the bypass mechanism is met; and restarting the forward proxy service when the forward proxy service returns to normal, and forwarding the access request to the reverse proxy service of the target server through the forward proxy service.

[0018] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device also receives the request result returned by the reverse proxy service and forwards the request result to the client through the following operations: in response to receiving an access request, the reverse proxy service converts the destination IP address in the access request into the private IP address and port of the target server; based on the private IP address and port, the reverse proxy service forwards the access request to the backend server according to preset application routing rules, and returns the request result to the forward proxy service of the client; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

[0019] In some embodiments of the present disclosure, when the computer program is executed by at least one processor, the device also causes the device to return the request result to the client's forward proxy service through the following operations: the reverse proxy service uses the public key of the target server to encrypt the request data, and sends the encrypted request data to the target server; after the target server receives the encrypted request data, it uses the private key to decrypt the encrypted request data to obtain the original request data of the client; after processing the original request data, the request result is obtained, and the request result is encrypted using the private key and returned to the reverse proxy service; the reverse proxy service uses the public key of the target server to decrypt the encrypted request result and returns it to the client's forward proxy service.

[0020] According to a third aspect of the present disclosure, a computer-readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the web application access proxy method in a heterogeneous network environment according to the first aspect of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments will be briefly described below. It should be noted that the drawings described below only relate to some embodiments of the present disclosure, but are not intended to limit the present disclosure, wherein: Figure 1 A schematic diagram showing a usage mode of a forward proxy service according to an embodiment of the present disclosure is shown; Figure 2 A schematic diagram showing a reverse proxy service usage mode according to an embodiment of the present disclosure is shown; Figure 3 A schematic diagram showing a principle of web application access in a heterogeneous network environment according to an embodiment of the present disclosure is shown; Figure 4 An exemplary flow chart showing a web application access proxy method 400 in a heterogeneous network environment according to an embodiment of the present disclosure; Figure 5 A schematic diagram of the cross-node application access request interaction process in a wide area network is shown; Figure 6 It is a schematic block diagram of a web application access proxy device in a heterogeneous network environment according to an embodiment of the present disclosure.

[0022] It should be noted that the elements in the drawings are schematic and not drawn to scale. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work also fall within the scope of protection of the present disclosure.

[0024] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which the subject matter of the present disclosure belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meanings in the context of the specification and the relevant art, and will not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. In addition, terms such as "first" and "second" are only used to distinguish one component (or a portion of a component) from another component (or another portion of a component).

[0025] As we all know, both forward proxy and reverse proxy are proxy servers located between the client and the server. Forward proxy needs to actively set the proxy server IP address or domain name, and use the set proxy server IP or domain name to access the server content and return it to the client. Reverse proxy is a proxy server that receives client requests, then forwards the requests to the server on the internal network, and returns the results returned from the server to the client. In other words, the forward proxy is the client's proxy, while the reverse proxy is the server's proxy.

[0026] Figure 1 FIG. 1 shows a schematic diagram of a forward proxy service usage mode according to an embodiment of the present disclosure. Figure 1 As shown in the figure, when a client in the local area network accesses the network server, the forward proxy service is used as an intermediary to forward the request data and response data. Specifically, the client sends an access request, the client identity is authenticated through the authorization and authentication mechanism, and the authenticated client establishes a data connection with the forward proxy service. The forward proxy service obtains the target server address and port, establishes a data connection with the server, waits for the client to send request data, forwards the request data to the server, waits for the server to return the response data, and forwards the response data to the client.

[0027] Figure 2 FIG. 1 shows a schematic diagram of a reverse proxy service usage mode according to an embodiment of the present disclosure. Figure 2 As shown, the server application system needs to provide the reverse proxy service with information such as application IP, port, protocol type, etc. in order to register with the reverse proxy service and assign a unique identifier. The reverse proxy service receives the connection request from the client on the WAN, redirects the request to the actual internal application server based on the application unique identifier, and returns the request result to the client.

[0028] Aiming at the security, traffic management and availability issues of cross-node application access in a wide area network distributed heterogeneous environment, the present invention proposes a web application access proxy method in a heterogeneous network environment. The method realizes secure cross-node access and traffic forwarding by combining proxy services and firewall policies.

[0029] Figure 3 FIG. 1 is a schematic diagram showing the principle of web application access in a heterogeneous network environment according to an embodiment of the present disclosure. Figure 3 As shown, the WAN distributed heterogeneous environment includes two or more nodes: Node A, Node B, Node C, Node D, Node E, etc.

[0030] Taking the example of a client at node A accessing the application system at node B across nodes, the proxy direction of node A is forward proxy, the source address is the proxy service IP of node A, the destination address is the proxy service IP of node B, and the port is the application port of node B. The proxy direction of node B is reverse proxy, the source address is the proxy service IP of node A, the destination address is the proxy service IP of node B, and the port is the application port of node B.

[0031] Node A registers the client IP address to the forward proxy service of Node A through user authentication, so as to allow forwarding of requests from the client IP address. Node A's forward proxy service first identifies the client IP address, and the data authentication service queries whether the IP address is in the local IP address list. After the IP address is queried, all access requests of the client are processed with data identification, and proxy forwarding is performed after success. Traffic with the source IP address of the proxy service IP of Node A and the destination address of the proxy service IP of other nodes is released.

[0032] Node B allows traffic whose source IP address is the proxy service IP of other nodes and whose destination address is the proxy service IP of node B. Node B publishes the application to the reverse proxy service of node B and assigns a unique identifier so that the reverse proxy service can redirect the request to the actual internal application server based on the unique identifier of the application.

[0033] To further explain the embodiments of the present disclosure in detail, Figure 4 An exemplary flow chart of a web application access proxy method 400 in a heterogeneous network environment according to an embodiment of the present disclosure is shown.

[0034] exist Figure 4 In block S402, when an access request sent by a client is monitored, the client is authenticated based on the access request, and access control and content filtering are performed on the access request after the identity authentication is passed.

[0035] The forward proxy service is set up on the client side. After listening to the access request sent by the client, it first authenticates the client according to the client's identity authentication information in the access request, and establishes a data connection with the client after the authentication is passed. Specifically, the client's access request usually includes the request method, URL, request header and request body. The request header contains client identity authentication information, such as user name and password, API key, token, etc. The identity of the client can be verified according to the preset identity authentication mechanism. For example, the identity authentication information is compared with the stored user database (local IP address list), and after the verification is passed, it is checked whether the client has the authority to access the requested resources. After the authentication is passed, a data connection is established with the client, and the forward proxy assigns a unique session ID to the connection.

[0036] Then, it waits for the client to send request data, matches the request data with the policy rules specified in the access control list, and prohibits access if the match fails.

[0037] Among them, the access control list (ACL) includes multiple policy rules, which are used to define which clients can access which resources and under what conditions to allow or deny access. Each policy rule includes multiple conditions, such as source address (client IP address), destination address (target server IP address), port (target server port number), access path, access time, etc.

[0038] The steps of the matching process are as follows: Sequential matching: Rules in the ACL are arranged in order and matched one by one from top to bottom.

[0039] Condition check: For each rule, check whether the request meets all the conditions of the rule.

[0040] Hitting a rule: Once a request meets a rule, the action defined by the rule (such as allowing or denying access) is immediately executed, and the subsequent rule checks are terminated. If the request meets the conditions of a rule, the proxy service will forward the request to the target server and return a response to the client. If the request matches a deny rule, an error response (such as 403Forbidden) is returned to inform the client that access is denied.

[0041] Assume that the ACL contains the following rules: Rule 1: Source address: 192.168.1.0 / 24 Destination address: example.com Port: 80 Access path: / public / * Visiting time: 9:00-17:00 on weekdays Action: Allow access Rule 2: Source address: 192.168.1.0 / 24 Destination address: example.com Port: 80 Access path: / private / * Action: Access denied In this example, if a request comes from the IP address 192.168.1.x and accesses / public / resource, it will be allowed. If it attempts to access / private / resource, it will be denied. ACLs can be reviewed and updated regularly to ensure that they reflect the latest security requirements and business changes. Access control logs are recorded to track and audit access behavior and identify potential security threats.

[0042] After the access control list matches, the client request data can be content filtered according to user needs, including URL filtering, keyword filtering, and file type filtering.

[0043] For example, URL filtering: parse the requested domain name / IP address / URL and match it with the domain name blacklist / IP blacklist / URL blacklist. If the match is successful, the request is rejected.

[0044] Keyword filtering: Set sensitive keywords to be monitored. Analyze the data in the request (such as HTTP request body, query parameters, etc.) to find matching keywords. Check whether the request contains sensitive keywords. If so, reject the request or return a warning message.

[0045] File type filtering: Define the file types that are allowed or prohibited (such as images, documents, executable files, etc.). Determine the file type by analyzing the Content-Type header in the request. Parse the Content-Type information in the request header. Check whether the file type is in the allowed list or prohibited list. Decide whether to release or block the request based on the check result.

[0046] In order to reduce the access efficiency to the target server and improve the network access efficiency, the request data after content filtering can also be compared with the pre-stored static cache data, and the validity of the static cache data can be judged. If the request data after filtering contains static cache data and the static cache data is valid, the static cache data is directly returned to the client. Among them, the static cache data includes pictures, script files, CSS styles, HTML files, etc. The validity period of the cache can be set to determine when the cache needs to be updated. For example, use the If-Modified-Since or If-None-Match header for conditional requests to ensure that the cache is updated only when the data changes. Or use the LRU (least recently used) strategy to manage cache space and eliminate infrequently used data. Therefore, if the request data contains cached static network content, it is also necessary to judge the validity of the cache (usually by setting the expiration time). If the cache is valid, the proxy server can directly return the cached data to the client, avoiding requests to the target server.

[0047] exist Figure 4 In block S404, the IP address in the access request is dynamically converted and then forwarded to the reverse proxy service of the target server.

[0048] In some embodiments of the present disclosure, the forward proxy service replaces the source IP address in the client access request with the public IP address of the forward proxy service. By replacing the source IP address in the request, the forward proxy can prevent the target server from obtaining the real IP of the internal user and improve the security of application access. Specifically, a suitable external IP address can be dynamically assigned to each user or a group of requests. This external IP address is usually the public IP of the proxy server and can be accessed through the Internet. If the proxy server has multiple public IPs, it can be flexibly selected according to the current traffic and request characteristics.

[0049] In one embodiment of the present disclosure, the forward proxy server can be controlled based on the dynamic bypass technology. By monitoring whether the access request forwarded by the forward proxy service is forwarded successfully, it is determined whether the forward proxy is working abnormally. If the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

[0050] Specifically, the working status of the forward proxy service is judged based on the success rate and response time of the forward request. When the forward proxy service is detected to be working abnormally, the forward proxy service is shut down; whether the bypass mechanism is met is judged based on the network delay, the load of the forward proxy service and the response status of the reverse proxy service. When the bypass mechanism is met, the access request is sent directly to the reverse proxy service of the target server; and when the forward proxy service returns to normal, the forward proxy service is restarted, and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

[0051] For example, when it is detected that the response time of the forward proxy service becomes too long due to high load, Dynamic Bypass bypasses the forward proxy and allows the access request to reach the target server directly. When the forward proxy returns to normal, the forward proxy service is restarted and the request is forwarded through the forward proxy service.

[0052] It can be seen that when the network is congested or the proxy service is busy or performance is degraded, direct access can reduce request delays, ensure service continuity, and provide users with a better experience. For some frequently updated content that does not need to be cached, the client can directly obtain the latest content, improving the flexibility of resource utilization.

[0053] The reverse proxy service converts the destination IP address in the access request to the private IP address and port of the target server. In the reverse proxy, dynamic address translation technology is mainly used to dynamically convert requests from external users to the public address of the reverse proxy service to the private address of the real server in the internal network. In other words, when an external client sends a request to the public IP address of the reverse proxy service, the reverse proxy will receive the request and dynamically forward the request to the real server in the internal network according to the configured rules and algorithms. In this process, the reverse proxy service will convert the destination IP address (public IP address) in the request to the private IP address of the real service, so that the request can reach the internal server correctly.

[0054] It can be seen that dynamic address translation technology can change the source IP address or destination IP address in the request data packet. When the internal network client accesses external resources through the proxy, the proxy will replace the source IP address (that is, the client's private IP) in the request data packet sent by the client with the public IP address of the proxy service itself. This is a dynamic project, and the IP address conversion operation will be performed every time there is a new request. From a security perspective, it can hide the topology of the internal network and the real IP address of the client, and effectively prevent the external network from directly attacking the client in the internal network. From the perspective of resource utilization, for proxy services with multiple public IPs, IP addresses can be dynamically allocated according to factors such as traffic and request type, so as to make more flexible use of IP resources.

[0055] exist Figure 4 In block S406, the request result returned by the reverse proxy service is received, and the request result is forwarded to the client.

[0056] In some embodiments of the present disclosure, in order to enable the reverse proxy to effectively forward requests, in the service cluster, each server node needs to register the IP address, port number and protocol type (such as HTTP, HTTPS or TCP) of the backend application to the reverse proxy service. Application routing rules are set to route requests of different paths to the corresponding backend application servers. The reverse proxy service can forward the access request to the backend server according to the preset application routing rules, and return the request result to the client's forward proxy service.

[0057] After the backend server processes the request, it sends a response back to the reverse proxy service, which then returns the response content to the client's forward proxy service. For the client, it only interacts with the public network address of the reverse proxy service from beginning to end.

[0058] In some embodiments of the present disclosure, the reverse proxy service uses the public key of the target server to encrypt the request data and sends the encrypted request data to the target server; after receiving the encrypted request data, the target server uses the private key to decrypt the encrypted request data and obtain the original request data of the client; the target server processes the original request data to obtain the request result, encrypts the request result with the private key and returns it to the reverse proxy service; the reverse proxy service uses the public key of the target server to decrypt the encrypted request result and returns it to the forward proxy service of the client. In this way, the security and integrity of the data when it is returned to the client can be ensured.

[0059] In addition, the reverse proxy service also supports a variety of load balancing strategies, such as polling, weighted polling, least connection weight, IP binding, URL binding, etc. It distributes requests to multiple backend servers according to the preset load balancing strategy. When a backend server fails, the request will be redirected to other available servers, thereby improving the system's load balancing, availability and security.

[0060] Reference Figure 3 Combined with Figure 4 The access process shown, Figure 5 A schematic diagram of the wide area network cross-node application access request interaction process is shown.

[0061] like Figure 5 As shown, the client of node A needs to access the application system of node B. First, the forward proxy service of the client of node A can obtain the user client information (IP address, MAC address) through the user identity authentication function, identify the client IP address, and query whether the IP address is in the local IP address list by the data authentication service. After the IP address is queried, all access requests of the client are processed by data identification. Node A configures a release policy on the firewall, the proxy direction is forward proxy, the source address is the proxy service IP of node A, the destination address is the proxy service IP of node B, and the port is the application port of node B. The forward proxy service of node A receives outgoing traffic, identifies all outgoing traffic, and releases the traffic whose source IP address is the proxy service IP of the node and the destination address is the proxy service IP of other nodes.

[0062] Before forwarding the request, the forward proxy service can perform operations such as access control, content filtering, and cache matching on the request data. Specifically, the forward proxy service limits user access through policy conditions specified by the access control list (ACL). The access control list consists of multiple policy rules and can filter multiple conditions such as source address, destination address, port, access path, access time, etc. The matching order of policy rules is the same as that of firewall policy rules, and matching is performed from top to bottom; after hitting the rule, the corresponding operation is immediately executed and the matching process ends.

[0063] After allowing users to access, content filtering is performed according to user needs, supporting URL filtering, keyword filtering, file type filtering, etc. For example, blocking access to certain sensitive websites or certain keywords to implement different access restrictions and controls for different users.

[0064] After completing content filtering, the forward proxy service can match the request data with the commonly used static network content in the cache, such as pictures, script files, CSS styles, HTML files, etc. If the client has the same data request, and the server application response data does not change, the forward proxy service can return the cached data directly to the client. If there is no hit, proxy forwarding is performed.

[0065] When forwarding a request, the forward proxy service replaces the source IP address in the access request with the public IP address of the forward proxy service, and monitors whether the access request forwarded by the forward proxy service is forwarded successfully. If the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

[0066] Node B configures a release policy on the firewall, with the proxy direction as reverse proxy, the source address as the proxy service IP of node A, the destination address as the proxy service IP of node B, and the port as the application port of node B. The reverse proxy service of node B receives the incoming traffic and releases the traffic whose source IP address is the proxy service IP of other nodes and whose destination address is the proxy service IP of this node. The reverse proxy service converts the destination IP address in the access request into the private IP address and port of the target server, matches the routing table, and redirects the request to the actual internal application server according to the unique identifier of the application, and returns the request result to the forward proxy service of the client, which then forwards the request result to the client of node A.

[0067] In summary, the cooperation between the forward proxy and reverse proxy between node A and node B realizes effective traffic management and security control.

[0068] Figure 6 is a schematic block diagram of a web application access proxy device in a heterogeneous network environment according to an embodiment of the present disclosure. Figure 6 As shown, the device 600 may include a processor 610 and a memory 620 storing a computer program. When the computer program is executed by the processor 610, the device 600 may perform the following operations: Figure 4The steps of the method 400 shown. In one example, the device 600 can be a computer device or a cloud computing node. When the device 600 monitors the access request sent by the client, it can authenticate the client based on the access request, and perform access control and content filtering on the access request after the authentication is passed. The device 600 can dynamically convert the IP address in the access request and forward it to the reverse proxy service of the target server. The device 600 can receive the request result returned by the reverse proxy service and forward the request result to the client.

[0069] In some embodiments of the present disclosure, the device 600 can authenticate the client based on the client's identity authentication information in the access request, and establish a data connection with the client after the authentication is passed; wait for the client to send request data, match the request data with the policy rules specified in the access control list, and prohibit the client from accessing if the match fails; and perform content filtering on the request data according to user needs to obtain filtered request data, wherein the content filtering includes URL filtering, keyword filtering, and file type filtering.

[0070] In some embodiments of the present disclosure, the device 600 may compare the filtered request data with the pre-stored static cache data and determine the validity of the static cache data; if the filtered request data contains static cache data and the static cache data is valid, the corresponding static cache data is returned to the client, and the static cache data includes pictures, script files, CSS styles and HTML files, etc.

[0071] In some embodiments of the present disclosure, device 600 can replace the source IP address in the access request with the public IP address of the forward proxy service; monitor whether the access request forwarded by the forward proxy service is forwarded successfully, and if the forwarding fails, send the access request directly to the reverse proxy service of the target server according to the bypass mechanism.

[0072] In some embodiments of the present disclosure, the device 600 can judge the working status of the proxy service based on the success rate and response time of the forwarding request, and shut down the forward proxy service when it is detected that the forward proxy service is working abnormally; judge whether the bypass mechanism is met based on the network delay, the load of the forward proxy service and the response status of the reverse proxy service, and send the access request directly to the reverse proxy service of the target server when the bypass mechanism is met; and when the forward proxy service returns to normal, restart the forward proxy service and forward the access request to the reverse proxy service of the target server through the forward proxy service.

[0073] In some embodiments of the present disclosure, the device 600 can, in response to receiving an access request, convert the destination IP address in the access request into the private IP address and port of the target server by the reverse proxy service; based on the private IP address and port, the reverse proxy service forwards the access request to the back-end server according to preset application routing rules, and returns the request result to the client's forward proxy service; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

[0074] In some embodiments of the present disclosure, the device 600 can use the public key of the target server to encrypt request data in the reverse proxy service, and send the encrypted request data to the target server; after the target server receives the encrypted request data, it uses the private key to decrypt the encrypted request data to obtain the original request data of the client; the target server processes the original request data to obtain a request result, encrypts the request result with the private key, and returns it to the reverse proxy service; the reverse proxy service decrypts the encrypted request result with the public key of the target server and returns it to the client's forward proxy service.

[0075] In an embodiment of the present disclosure, the processor 610 may be, for example, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a processor based on a multi-core processor architecture, etc. The memory 620 may be any type of memory implemented using data storage technology, including but not limited to random access memory, read-only memory, semiconductor-based memory, flash memory, disk storage, etc.

[0076] In addition, in the embodiment of the present disclosure, the apparatus 600 may also include an input device 630, such as a keyboard, a mouse, etc., for. In addition, the apparatus 600 may also include an output device 640, such as a display, etc., for output.

[0077] In other embodiments of the present disclosure, a computer-readable storage medium storing a computer program is further provided, wherein the computer program can achieve the following when executed by a processor: Figure 4 The steps of the web application access proxy method 400 in a heterogeneous network environment are shown.

[0078] In summary, according to the web application access proxy method and device in a heterogeneous network environment of the embodiments of the present invention, users in a wide area network can remotely access the enterprise's application system at any location without installing additional software on the local device or performing complex configuration; through encrypted data transmission, identity authentication, access control, content filtering, etc., strong security protection is provided for the application system, reducing the risk of data leakage and unauthorized access, and protecting the sensitive information and assets of the enterprise.

[0079] It can be easily expanded as the scale of the enterprise expands. Whether it is to increase the number of users or application systems or to improve access speed, it can be achieved through simple configuration without large-scale system transformation, ensuring that the enterprise can flexibly expand users and applications while maintaining efficiency and security. This solution achieves high security, high availability and configuration and expansion flexibility for cross-node application access in a wide area network distributed heterogeneous environment.

[0080] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device and method according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, a program segment or an instruction, and a part of a module, a program segment or an instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0081] Unless the context clearly indicates otherwise, the singular form of the words used herein and in the appended claims includes the plural and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the words "comprise" and "include" are to be interpreted as inclusive rather than exclusive. Likewise, the terms "include" and "or" should be interpreted as inclusive, unless such interpretation is expressly prohibited herein. Where the term "example" is used herein, particularly when it is placed after a group of terms, "example" is merely exemplary and illustrative and should not be considered exclusive or comprehensive.

[0082] Further aspects and scopes of adaptability become apparent from the description provided herein. It should be understood that various aspects of the present application can be implemented individually or in combination with one or more other aspects. It should also be understood that the description and specific embodiments herein are intended for purposes of illustration only and are not intended to limit the scope of the present application.

[0083] Several embodiments of the present disclosure are described in detail above, but it is obvious that those skilled in the art can make various modifications and variations to the embodiments of the present disclosure without departing from the spirit and scope of the present disclosure. The protection scope of the present disclosure is defined by the attached claims.

Claims

1. A web application access proxy method in a heterogeneous network environment, characterized in that: The method comprises: When an access request sent by a client is monitored, the client is authenticated based on the access request, and access control and content filtering are performed on the access request after the identity authentication is passed; A reverse proxy service that dynamically converts the IP address in the access request and forwards it to the target server; and Receive the request result returned by the reverse proxy service, and forward the request result to the client.

2. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that: When an access request sent by a client is monitored, the client is authenticated based on the access request, and access control and content filtering are performed on the access request after the identity authentication is passed, including: Authenticate the client according to the identity authentication information of the client in the access request, and establish a data connection with the client after the authentication is passed; Waiting for the client to send request data, matching the request data with the policy rules specified in the access control list, and if the match fails, prohibiting the client from accessing; and If the match is successful, the request data is content filtered according to the user demand data to obtain filtered request data, wherein the content filtering includes URL filtering, keyword filtering and file type filtering.

3. The web application access proxy method in a heterogeneous network environment according to claim 2, characterized in that: When an access request sent by a client is monitored, the client is authenticated based on the access request, and after the identity authentication is passed, access control and content filtering are performed on the access request, including: Comparing the filtered request data with pre-stored static cache data, and determining the validity of the static cache data; If the filtered request data contains the static cache data and the static cache data is valid, the corresponding static cache data is returned to the client, and the static cache data includes pictures, script files, CSS styles and HTML files.

4. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that: The reverse proxy service that dynamically converts the IP address in the access request and forwards it to the target server includes: Replace the source IP address in the access request with the public IP address of the forward proxy service; Monitor whether the access request forwarded to the proxy service is forwarded successfully; and If the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

5. The web application access proxy method in a heterogeneous network environment according to claim 4 is characterized in that: The monitoring of whether the access request forwarded to the proxy service is forwarded successfully includes: According to the success rate and response time of the forwarding request, the working state of the forward proxy service is judged, and when it is detected that the forward proxy service is working abnormally, the forward proxy service is closed; Determining whether a bypass mechanism is met according to network delay, the load of the forward proxy service, and the response status of the reverse proxy service, and sending the access request directly to the reverse proxy service of the target server if the bypass mechanism is met; and When the forward proxy service returns to normal, the forward proxy service is restarted, and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

6. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that: The receiving the request result returned by the reverse proxy service and forwarding the request result to the client comprises: In response to receiving the access request, the reverse proxy service converts the destination IP address in the access request into a private IP address and port of the target server; Based on the private IP address and port, the reverse proxy service forwards the access request to the backend server according to the preset application routing rules, and returns the request result to the forward proxy service of the client; and In response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

7. The web application access proxy method in a heterogeneous network environment according to claim 6, characterized in that: The forward proxy service that forwards the access request to the backend server based on the private IP address and port according to the preset application routing rules and returns the request result to the client includes: The reverse proxy service encrypts the request data using the public key of the target server and sends the encrypted request data to the target server; After receiving the encrypted request data, the target server uses the private key to decrypt the encrypted request data to obtain the original request data of the client; Processing the original request data to obtain a request result, encrypting the request result using a private key and returning it to the reverse proxy service; and The reverse proxy service uses the public key of the target server to decrypt the encrypted request result and returns it to the forward proxy service of the client.

8. The web application access proxy method in a heterogeneous network environment according to claim 6, characterized in that: The reverse proxy service is used to distribute requests to multiple backend servers according to a preset load balancing strategy, and when a backend server fails, the request is redirected to other available backend servers.

9. A web application access proxy device in a heterogeneous network environment, characterized in that: The device comprises: at least one processor; and at least one memory storing a computer program; Wherein, when the computer program is executed by the at least one processor, the device executes the steps of the web application access proxy method in a heterogeneous network environment according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the computer program implements the steps of the web application access proxy method in a heterogeneous network environment according to any one of claims 1 to 8.

Images