Connection method and system of intranet equipment, medium, electronic equipment and program product

Abstract

The invention discloses a connection method and system of intranet equipment, a medium, electronic equipment and a program product. The method applied to a first server deployed in an extranet comprises the following steps: in response to receiving an SSH connection task sent by a Web end, distributing the SSH connection task to a first client in an intranet, so that the first client establishes an SSH connection between the first client and a target intranet device based on the SSH connection task, establishing a first network socket connection between the first client and the first server; and sending a first response message to the Web end to enable the Web end to establish a second network socket connection with the first server. Therefore, the security of the SSH connection can be ensured, data leakage and attack are prevented, and the intranet equipment can be safely and reliably accessed and managed. Besides, the user can seamlessly manage the intranet equipment from the Web end without complicated network configuration, so that the flexibility and convenience of equipment management are greatly improved, and the user experience is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a connection method, system, medium, electronic device and program product for intranet devices. Background Art

[0002] With the development of network technology and information technology, remote management and maintenance have become an important means for modern enterprises and individual users to manage computing devices and servers. Secure Shell (SSH) is a commonly used remote management tool that provides a secure communication method. However, for users who need to manage devices in the intranet, there are some limitations to directly connecting to intranet devices through traditional SSH clients, including intranet penetration problems, security issues, and the need for a management platform. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a connection method for an intranet device, which is applied to a first server deployed in an external network, and the method comprises: in response to receiving a secure shell (SSH) connection task sent by a Web terminal, distributing the SSH connection task to a first client in the intranet, so that the first client establishes an SSH connection between the first client and a target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; and sending a first response message to the Web terminal, so that the Web terminal establishes a second network socket connection with the first server.

[0005] In a second aspect, the present disclosure provides a method for connecting an intranet device, which is applied to a first client deployed in the intranet, the method comprising: in response to obtaining a secure shell (SSH) connection task issued by a Web terminal via a first server, establishing an SSH connection between the first client and a target intranet device based on the SSH connection task, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; after establishing the SSH connection, establishing a first network socket connection between the first client and the first server, wherein after the SSH connection task is successfully issued, the Web terminal establishes a second network socket connection with the first server.

[0006] In a third aspect, the present disclosure provides a connection method for an intranet device, which is applied to a Web terminal, and the method includes: in response to receiving a secure shell (SSH) connection task, sending the SSH connection task to a first client in the intranet via a first server in the external network, so that the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; in response to receiving a first response message sent by the first server, establishing a second network socket connection between the Web terminal and the first server.

[0007] In a fourth aspect, the present disclosure provides a connection system for an intranet device, the connection system comprising: at least one Web terminal, the Web terminal being used to execute the connection method for the intranet device provided in the third aspect of the present disclosure; at least one server, the server being located in an external network, and being used to execute the connection method for the intranet device provided in the first aspect of the present disclosure; and at least one first client, wherein the first client and the intranet device are located in the same intranet, and the first client is used to execute the connection method for the intranet device provided in the second aspect of the present disclosure.

[0008] In a fifth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon. When the computer program is executed by a processing device, the computer program implements the steps of the connection method for the intranet device applied to the first server provided in the first aspect of the present disclosure, or implements the steps of the connection method for the intranet device applied to the first client provided in the second aspect of the present disclosure, or implements the steps of the connection method for the intranet device applied to the Web side provided in the third aspect of the present disclosure.

[0009] In a sixth aspect, the present disclosure provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of the connection method for the intranet device applied to the first server provided in the first aspect of the present disclosure, or implement the steps of the connection method for the intranet device applied to the first client provided in the second aspect of the present disclosure, or implement the steps of the connection method for the intranet device applied to the Web side provided in the third aspect of the present disclosure.

[0010] In a seventh aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the connection method for the intranet device applied to the first server provided in the first aspect of the present disclosure, or implements the steps of the connection method for the intranet device applied to the first client provided in the second aspect of the present disclosure, or implements the steps of the connection method for the intranet device applied to the Web side provided in the third aspect of the present disclosure.

[0011] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to a first client in the intranet via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0012] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0014] Figure 1The invention is a block diagram of a system for connecting intranet devices according to an exemplary embodiment.

[0015] Figure 2 The figure is a schematic diagram of a Web interface according to an exemplary embodiment.

[0016] Figure 3 The present invention is a flowchart showing a method for connecting an intranet device applied to a first server according to an exemplary embodiment.

[0017] Figure 4 The present invention is a process diagram of a method for connecting intranet devices according to an exemplary embodiment.

[0018] Figure 5 The present invention is an architecture diagram of an intranet device connection system according to an exemplary embodiment.

[0019] Figure 6 The figure is a schematic diagram showing an SSH connection task distribution strategy according to an exemplary embodiment.

[0020] Figure 7 It is a schematic diagram of a distributed Websocket mapper according to an exemplary embodiment.

[0021] Figure 8 The present invention is a flowchart of a method for connecting an intranet device applied to a first client according to an exemplary embodiment.

[0022] Fig. 9 The present invention is a flowchart of a method for connecting an intranet device applied to a Web terminal according to an exemplary embodiment.

[0023] Fig.10 It is a block diagram showing a connecting device for an intranet device of a first server according to an exemplary embodiment.

[0024] Fig.11 It is a block diagram showing a connection device for an intranet device applied to a first client according to an exemplary embodiment.

[0025] Fig.12 It is a block diagram of a connection device for an intranet device applied to a Web terminal according to an exemplary embodiment.

[0026] Fig.13 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0027] As discussed in the background technology, there are some limitations in directly connecting to intranet devices through traditional SSH clients, including intranet penetration problems, security issues, and the need for a management platform. For this reason, Web-based Secure Shell (WebSSH) technology came into being. WebSSH is a web application based on SSH technology that allows users to connect to SSH through a browser to achieve remote management. The emergence of WebSSH has greatly facilitated user use, but it is still a technical problem to cross the connection between the intranet and the public network.

[0028] In view of this, the present disclosure provides a connection method, system, medium, electronic device and program product for intranet devices, which can conveniently help users establish a secure SSH connection between a public network and an intranet.

[0029] Before introducing the specific implementation methods of the present application, the terms involved in the present disclosure are first explained.

[0030] Web-based applications refer to applications or services that are accessed and used through a web browser. Web-based applications do not need to be installed on user devices, but instead provide services directly through the Internet.

[0031] The SSH protocol is a relatively reliable protocol designed to provide security for remote login sessions and other network services.

[0032] Internal Network, referred to as Intranet, usually refers to a private network (LAN) within an organization or family, which is not directly connected to the Internet.

[0033] External Network, referred to as Extranet, usually refers to the Internet, which is a global public network (public network) that allows devices around the world to communicate with each other.

[0034] A Configuration Management Database (CMDB) stores detailed information about the network infrastructure, including configurations, hardware, and software assets. It provides a comprehensive repository for managing and maintaining information about the Information Technology (IT) environment.

[0035] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0036] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0037] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0038] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0039] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0040] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0041] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0042] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's information. Thus, the user can autonomously choose whether to provide information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0043] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide information to the electronic device.

[0044] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0045] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0046] The present disclosure provides a connection system for intranet devices, wherein the connection system for intranet devices may include at least one Web terminal, at least one server and at least one first client, wherein the Web terminal is connected to each server via a wide area network communication, the server is connected to each first client via a wide area network communication, and at least one intranet device is deployed in the intranet, that is, the number of the Web terminal, the server, the first client and the intranet device can be one or more. The server is located in the extranet, the first client and the intranet device are located in the same intranet, that is, in the same local area network, and the first client and the intranet device are connected via local area network communication; the first client can be a program installed on a hardware device that meets the system requirements and is located in the intranet, or it can be a hardware device deployed in the intranet, and the hardware device is different from the intranet device; the server can be a program installed on a hardware device that meets the system requirements and is located in the extranet, or it can be a hardware device deployed in the extranet.

[0047] like Figure 1 As shown, the intranet device connection system 100 may include a Web terminal 10, a server 20a, a server 20b, and a first client 30, wherein the intranet is provided with an intranet device 40a, an intranet device 40b, and an intranet device 40c.

[0048] Among them, the above-mentioned servers deployed in the external network can be rack servers, blade servers, tower servers, cabinet servers, etc.; the intranet devices can be, for example, rack servers, blade servers, tower servers, cabinet servers, etc., or terminals, such as mobile terminals.

[0049] The user can initiate an SSH connection task for the target intranet device through the Web terminal to establish an SSH connection between the Web terminal and the target intranet device, wherein the target intranet device is any intranet device in the connection system; after the Web terminal receives the SSH connection task, the SSH connection task can be sent to the first client in the intranet via the server that meets the load balancing condition; after the first client obtains the SSH connection task, based on the SSH connection task, the SSH connection between the first client and the target intranet device is established, and then the first network socket Websocket connection between the first client and the server that meets the load balancing condition is established; at the same time, after the server that meets the load balancing condition distributes the SSH connection task to the first client, it sends a first response message to the Web terminal, and after the Web terminal receives the first response message, it establishes a second Websocket connection between itself and the server that meets the load balancing condition. In this way, the Web terminal can access the target intranet device through the second Websocket long connection, the first Websocket long connection, and the SSH connection between the first client and the target intranet device in sequence.

[0050] For example, the user may select Figure 2 Select any intranet device in the intranet device list (including intranet device A1, intranet device A2, ..., intranet device An) as the target intranet device, and click the connection icon on the right. Issue an SSH connection task.

[0051] Preferably, the connection system of the intranet device may include multiple servers and multiple first clients to form a distributed system architecture. The distributed system architecture can efficiently process a large number of concurrent SSH connection requests. This design ensures the performance of the system under high load and meets the needs of enterprise-level applications. In addition, the use of a distributed architecture design makes the system have good scalability, and can easily expand the system and increase nodes according to needs to meet the growing business needs.

[0052] Figure 3 FIG. 1 is a flow chart showing a method for connecting an intranet device applied to a first server according to an exemplary embodiment. The first server is deployed in an external network, such as Figure 3 As shown, the connection method of the intranet device applied to the first server may include S101 and S102. When the connection system of the intranet device includes one server, the first server is the server in the connection system; when the connection system of the intranet device includes multiple servers (forming a server cluster), the first server is any one of the server clusters, and the server cluster is deployed in the external network.

[0053] In S101, in response to receiving a secure shell SSH connection task sent by the Web end, the SSH connection task is distributed to the first client in the intranet, so that the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server. The SSH connection task is used to instruct the establishment of an SSH connection between the Web end and the target intranet device.

[0054] In S102, a first response message is sent to the Web end, so that the Web end establishes a second network socket connection with the first server.

[0055] like Figure 4 As shown, a user can issue an SSH connection task for a target intranet device through a Web terminal, wherein the SSH connection task may include information of the target intranet device (e.g., an identifier of the target intranet device), login credentials, and the like; after receiving the SSH connection task, the Web terminal issues the SSH connection task to the first server; after receiving the SSH connection task, the first server Figure 5 As shown, the CMDB connection information of the target intranet device can be read, and the CMDB connection information can be encapsulated into the SSH connection task, and distributed to the first client in the intranet. After the SSH connection task is distributed to the first client, the first server sends a first response message to the Web end. After the Web end receives the first response message, it establishes a second Websocket connection between itself (i.e., the Web end) and the first server; after obtaining the SSH connection task, the first client can, based on the SSH connection task, Figure 5 As shown, an SSH connection request is sent to a target intranet device through an internal SSH Agent component, wherein the SSH connection request includes a login credential; after receiving the SSH connection request, the target intranet device can perform identity authentication on the Web end according to the login credential to ensure that the user can only access a specific intranet device; if the identity authentication is successful, an SSH connection response is sent to the first client; if the identity authentication fails, no SSH connection response is given or a prompt message indicating that the identity authentication failed is sent to the SSH Agent component; after receiving the SSH connection response, the SSH Agent component determines that the SSH connection between the first client and the target intranet device is successfully established. At this time, as shown in FIG. Figure 5As shown, the first client can actively initiate a Websocket connection to the first server through an internal proxy component to establish a first Websocket connection between the first client and the first server. At this point, the SSH connection between the Web client and the target intranet device is successfully established. After that, the Web client can access the target intranet device through the second Websocket long connection, the first Websocket long connection, and the SSH connection between the first client and the target intranet device in sequence.

[0056] Among them, the first client can include an SSH Agent component and a Proxy component, wherein the SSH Agent component is responsible for processing the SSH protocol authentication with the intranet device and supports multiple device negotiation algorithms, and the Proxy component is responsible for processing the forwarding of SSH channel read and write messages and initiating a unidirectional Websocket channel from the inside to the outside.

[0057] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to a first client in the intranet via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0058] The first Websocket connection can be a non-encrypted Websocket connection or an encrypted Websocket connection, i.e., a socket security (Websocket Secure, WSS) connection. Similarly, the second Websocket connection can be a non-encrypted Websocket connection or an encrypted WSS connection, such as Figure 4 shown.

[0059] Preferably, the first Websocket connection and the second Websocket connection are both WSS connections, which can provide a secure communication channel between the Web terminal and the target intranet device, prevent data from being eavesdropped during transmission, ensure reliable transmission of data from the intranet device to the browser, and improve the reliability of data communication.

[0060] In addition, after receiving the SSH connection task sent by the Web end, the first server can distribute the SSH connection task to the first client through a variety of message distribution strategies. In one embodiment, a direct distribution method can be adopted, that is, after receiving the SSH connection task sent by the Web end, the first server directly pushes it to the first client without the first client actively obtaining it.

[0061] In another implementation, a queue distribution method may be used, such as Figures 4 to 6 As shown, after receiving the SSH connection task sent by the Web end, the first server can push it to the message queue; afterwards, the first client consumes the SSH connection task in the message queue, and the first client needs to actively pull the SSH connection task from the message queue. At this time, the above S101 distributes the SSH connection task to the first client, so that the first client can establish an SSH connection between the first client and the target intranet device based on the SSH connection task, and establish a first network socket connection between the first client and the first server, which can include: pushing the SSH connection task to the message queue, so that when the first client pulls the SSH connection task from the message queue, it can establish an SSH connection between the first client and the target intranet device based on the SSH connection task, and establish a first network socket connection between the first client and the first server.

[0062] Using message queues to process and distribute SSH connection tasks can support high-concurrency SSH connection requests, while improving the system's response speed and connection task processing efficiency.

[0063] In addition, when the connection system of the intranet device includes multiple servers, in order to ensure accurate data transmission, the Websocket channels at both ends of the Web end and the first client can be managed consistently through a distributed network socket mapping relationship (Websocket Mapper), that is, for the same SSH connection task, the server connected to the Web end and the server connected to the first client are the same, wherein the Websocket Mapper is responsible for Websocket channel mapping and information forwarding in the distributed scenario multiple server node mode. Specifically, when the first server is any one of the server clusters, the above-mentioned connection method for the intranet device applied to the first server can also include the following four steps:

[0064] In response to receiving the SSH connection task, locally establishing a mapping relationship between a first task identifier of the SSH connection task and a memory address of the Web terminal;

[0065] In response to receiving a first network socket connection request sent by a first client, determining whether a second task identifier exists in a local mapping relationship, wherein the first network socket connection request includes the second task identifier;

[0066] If the second task identifier does not exist in the local mapping relationship, the second server corresponding to the second task identifier is determined according to the corresponding relationship between the task identifier and the server identifier, and then the first network socket connection request is forwarded to the second server, so that the first client and the second server establish a third network socket connection, wherein the second server belongs to the server cluster;

[0067] If the second task identifier exists in the local mapping relationship, a second response message is sent to the first client, so that the first client establishes a fourth network socket connection with the first server.

[0068] In this disclosure, Figure 4 , Figure 5 as well as Figure 7 As shown, each server in the server cluster maintains a Websocket Mapper locally, that is, a distributed Websocket Mapper. Whenever the server receives an SSH connection task sent by the Web end, it stores the mapping relationship between the task identifier of the currently received SSH connection task and the memory address of the Web end in the local Websocket Mapper.

[0069] After the SSH connection between the first client and the target intranet device is successfully established, the first client can send a network socket connection request containing a corresponding task identifier to a server in the server cluster that meets the load balancing requirements (which may be the first server or may not be the first server) in the expectation of establishing a Websocket connection with the server that meets the load balancing requirements. In this way, after receiving the first network socket connection request sent by the first client, the first server can parse the first network socket connection request to obtain the second task identifier contained therein, and then determine whether the second task identifier exists in the local Websocket Mapper; if the local Websocket Mapper has the second task identifier, it indicates that the SSH connection task corresponding to the first network socket connection request (hereinafter referred to as the current SSH connection task) is forwarded by the first server, that is, one end of the Websocket connection constructed by the Web end for the current SSH connection task is the first server. At this time, the first server can send a second response message to the first client to enable the first client to establish a fourth network socket connection with the first server; if the local Websocket Mapper does not have the second task identifier, it indicates that the current SSH connection task is not forwarded by the first server, that is, one end of the Websocket connection constructed by the Web end for the current SSH connection task is a server other than the first server in the server cluster. At this time, the remote dictionary service (Remote Dictionary) can be queried. Server, Redis) to determine the second server corresponding to the second task identifier, that is, the current SSH connection task is forwarded by the second server, that is, one end of the Websocket connection constructed by the Web end for the current SSH connection task is the second server, wherein Redis includes a correspondence between the task identifier and the server identifier (for example, the IP address of the server), wherein each server in the server cluster, after distributing the received SSH connection task to the first client, can store the task identifier and its own identifier of the SSH connection task in Redis; after determining the second server corresponding to the second task identifier, the first network socket connection request can be forwarded to the second server; after receiving the first network socket connection request, the second server sends a response message to the first client, thereby establishing a third network socket connection between the first client and the second server.

[0070] In the above implementation, the independence and traceability of each SSH connection session can be ensured by generating a unique task identifier, so that the connection session can be accurately managed and tracked to prevent session tampering and confusion.

[0071] In a possible implementation manner, when the first server is any one of the server clusters, the above-mentioned method for connecting the intranet device applied to the first server may further include the following steps:

[0072] In response to receiving the second network socket connection request forwarded by the third server in the server cluster, a third response message is sent to the first client, so that the first client establishes a fifth network socket connection with the first server.

[0073] In the present disclosure, when the third server in the server cluster determines that the local Websocket Mapper does not have the task identifier in the second network socket connection request, it determines that the server corresponding to the task identifier in the second network socket connection request is the first server based on the correspondence between the task identifier and the server identifier, which indicates that the SSH connection task corresponding to the second network socket connection request is forwarded by the first server, that is, one end of the Websocket connection constructed by the Web end for the SSH connection task corresponding to the second network socket connection request is the first server. At this time, the third server can forward the second network socket connection request to the first server; after receiving the second network socket connection request forwarded by the third server, the first server sends a third response message to the first client, thereby establishing a fifth network socket connection between the first client and the first server.

[0074] The third network socket connection can be a non-encrypted Websocket connection or an encrypted WSS connection. Similarly, the fourth network socket connection can be a non-encrypted Websocket connection or an encrypted WSS connection, and the fifth network socket connection can be a non-encrypted Websocket connection or an encrypted WSS connection.

[0075] Figure 8 FIG. 1 is a flow chart showing a method for connecting an intranet device applied to a first client according to an exemplary embodiment. The first client is deployed in an intranet, such as Figure 8 As shown, the connection method of the intranet device applied to the first client may include S201 and S202. When the connection system of the intranet device includes a first client, the first client is the first client in the connection system of the intranet device; when the connection system of the intranet device includes multiple first clients (forming a client cluster), the first client is any one of the client clusters, wherein the client is deployed in the intranet.

[0076] In S201, in response to obtaining a secure shell SSH connection task issued by the Web terminal via the first server, an SSH connection is established between the first client and the target intranet device based on the SSH connection task, where the SSH connection task is used to instruct the establishment of an SSH connection between the Web terminal and the target intranet device.

[0077] In S202, after the SSH connection is established, a first network socket connection is established between the first client and the first server, and after the SSH connection task is successfully issued, the Web end establishes a second network socket connection with the first server.

[0078] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to a first client in the intranet via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0079] Optionally, the above-mentioned method for connecting an intranet device applied to the first client may further include the following steps:

[0080] Pull the SSH connection task from the message queue, wherein the first server pushes the SSH connection task sent by the Web end to the message queue.

[0081] Optionally, establishing a first network socket connection between the first client and the first server may include:

[0082] Sending a third network socket connection request to the first server, wherein the third network socket connection request includes a first task identifier of the SSH connection task;

[0083] In response to receiving a fourth response message sent by the first server to the third network socket connection request, a first network socket connection is established between the first client and the first server.

[0084] Optionally, the above-mentioned method for connecting an intranet device applied to the first client may further include the following steps:

[0085] After establishing the first network socket connection, if a heartbeat request is received from the Web end via the second network socket connection, a heartbeat response is sent to the Web end via the first network socket connection and the second network socket connection, wherein, after establishing the second network socket connection, the Web end continues to send heartbeat requests to the first client via the second network socket connection.

[0086] In this disclosure, Figure 7 As shown, the connection system of the intranet device can execute multiple SSH connection requests concurrently. After the Web end establishes a network socket connection with the server in the external network, it is necessary to wait for the first client in the intranet to establish an SSH connection with the target intranet device. At this time, the heartbeat mechanism can be used to confirm whether the SSH connection on the first client side is ready.

[0087] Specifically, after establishing the second Websocket connection with the first server, the Web client can continuously send heartbeat requests to the first server via the second Websocket connection, and continuously monitor the heartbeat response to monitor whether the first Websocket connection between the first server and the first client is established. When the first Websocket connection between the first server and the first client is not established, the heartbeat request cannot reach the first client, and at this time, the Web client cannot receive the heartbeat response. When the first Websocket connection between the first server and the first client is established, the heartbeat request can reach the first client via the second Websocket connection and the first Websocket connection. At this time, the first client can receive the heartbeat request. Thereafter, the first client sends a heartbeat response to the Web end via the first Websocket connection and the second Websocket connection. After receiving the heartbeat response sent by the first client, the Web end indicates that the SSH connection between the Web end and the target intranet device is established, that is, waiting for the online success. At this time, a prompt message indicating that the SSH connection between the Web end and the target intranet device is successful can be generated, and the prompt message can be rendered on the Web end interface to prompt the user that the SSH connection between the Web end and the target intranet device is successful, so that the target intranet device can be maintained and managed through the browser.

[0088] In addition, in addition to using the heartbeat mechanism to confirm whether the SSH connection on the first client side is ready, a timeout mechanism can also be set. That is, if the Web side does not receive a heartbeat response within the preset time after the second Websocket connection is established, it indicates that the waiting for online access has failed. At this time, the second Websocket connection between itself and the first client can be disconnected to release the Websocket connection channel.

[0089] Optionally, the first network socket connection and the second network socket connection are both socket security WSS connections.

[0090] The specific implementation methods of each step in the method for connecting the intranet device of the first client according to the embodiment of the present disclosure have been described in detail in the method for connecting the intranet device of the first server according to the embodiment of the present disclosure, and will not be repeated here.

[0091] Fig. 9 FIG. 1 is a flow chart showing a method for connecting an intranet device applied to a Web terminal according to an exemplary embodiment. Fig. 9 As shown, the connection method of the intranet device applied to the Web side may include S301 and S302.

[0092] In S301, in response to receiving a secure shell SSH connection task, the SSH connection task is sent to the first client in the intranet via the first server in the external network, so that the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server. The SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device.

[0093] In S302, in response to receiving a first response message sent by the first server, a second network socket connection is established between the Web client and the first server.

[0094] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to the first client via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0095] Optionally, the above-mentioned method for connecting an intranet device to a Web terminal may further include the following steps:

[0096] After establishing the second network socket connection, continuously sending a heartbeat request to the first client via the second network socket connection;

[0097] In response to receiving a heartbeat response sent by the first client, a prompt message is generated to indicate that the SSH connection between the Web client and the target intranet device is successful, wherein, after establishing the SSH connection and the first network socket connection, the first client sends a heartbeat response to the Web client through the first network socket connection and the second network socket connection.

[0098] Optionally, the above-mentioned method for connecting an intranet device to a Web terminal may further include the following steps:

[0099] If the heartbeat response is not received within a preset time period after the second network socket connection is established, the second network socket connection is disconnected.

[0100] The specific implementation methods of each step in the connection method of the intranet device of the Web side according to the embodiment of the present disclosure have been described in detail in the connection method of the intranet device applied to the first server and the connection method of the intranet device applied to the first client according to the embodiment of the present disclosure, and will not be repeated here.

[0101] Fig.10 FIG. 1 is a block diagram showing a connection device for an intranet device applied to a first server according to an exemplary embodiment. Fig.10 As shown, the connecting device 400 applied to the intranet device of the first server deployed in the external network includes:

[0102] A distribution module 401 is used for distributing the secure shell (SSH) connection task sent by the Web terminal to a first client in the intranet in response to receiving the secure shell (SSH) connection task sent by the Web terminal, so that the first client can establish an SSH connection between the first client and a target intranet device based on the SSH connection task, and establish a first network socket connection between the first client and the first server, wherein the SSH connection task is used to instruct the establishment of an SSH connection between the Web terminal and the target intranet device;

[0103] The first sending module 402 is used to send a first response message to the Web terminal, so that the Web terminal establishes a second network socket connection with the first server.

[0104] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to a first client in the intranet via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0105] Optionally, the distribution module 401 is used to push the SSH connection task to the message queue, so that when the first client pulls the SSH connection task from the message queue, based on the SSH connection task, it establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server.

[0106] Optionally, the first server is any one of a server cluster, and the server cluster is deployed in the external network;

[0107] The connecting device 400 applied to the intranet device of the first server also includes:

[0108] a relationship building module, configured to establish locally a mapping relationship between a first task identifier of the SSH connection task and a memory address of the Web terminal in response to receiving the SSH connection task;

[0109] A first determining module, configured to determine whether a second task identifier exists in the mapping relationship in response to receiving a first network socket connection request sent by the first client, wherein the first network socket connection request includes the second task identifier;

[0110] A second determining module is used to determine a second server corresponding to the second task identifier according to a correspondence between a task identifier and a server identifier if the second task identifier does not exist in the mapping relationship, wherein the second server belongs to the server cluster;

[0111] A forwarding module is used to forward the first network socket connection request to the second server, so that the first client establishes a third network socket connection with the second server.

[0112] Optionally, the connecting device 400 applied to the intranet device of the first server further includes:

[0113] The second sending module is configured to send a second response message to the first client if the second task identifier exists in the mapping relationship, so that the first client establishes a fourth network socket connection with the first server.

[0114] Optionally, the connecting device 400 applied to the intranet device of the first server further includes:

[0115] The third sending module is used to send a third response message to the first client in response to receiving a second network socket connection request forwarded by the third server in the server cluster, so that the first client establishes a fifth network socket connection with the first server.

[0116] Optionally, the first network socket connection and the second network socket connection are both socket security WSS connections.

[0117] Fig.11 FIG. 1 is a block diagram showing a connection device for an intranet device applied to a first client according to an exemplary embodiment. Fig.11 As shown, the connection device 500 applied to the intranet device of the first client deployed in the intranet includes:

[0118] A first establishing module 501 is configured to establish an SSH connection between the first client and a target intranet device based on the SSH connection task in response to obtaining a secure shell SSH connection task issued by the Web terminal via the first server, wherein the SSH connection task is used to instruct to establish an SSH connection between the Web terminal and the target intranet device;

[0119] The second establishing module 502 is used to establish a first network socket connection between the first client and the first server after the SSH connection is established, wherein after the SSH connection task is successfully issued, the Web end establishes a second network socket connection with the first server.

[0120] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to a first client in the intranet via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0121] Optionally, the connecting device 500 applied to the intranet device of the first client further includes:

[0122] The pulling module is used to pull the SSH connection task from the message queue, wherein the first server pushes the SSH connection task sent by the Web client to the message queue.

[0123] Optionally, the second establishing module 502 includes:

[0124] A sending submodule, configured to send a third network socket connection request to the first server, wherein the third network socket connection request includes a first task identifier of the SSH connection task;

[0125] An establishing submodule is used to establish a first network socket connection between the first client and the first server in response to receiving a fourth response message sent by the first server to the third network socket connection request.

[0126] Optionally, the connecting device 500 applied to the intranet device of the first client further includes:

[0127] A fourth sending module is used to send a heartbeat response to the Web end through the first network socket connection and the second network socket connection if a heartbeat request sent by the Web end via the second network socket connection is received after the first network socket connection is established, wherein after the Web end establishes the second network socket connection, the Web end continuously sends the heartbeat request to the first client via the second network socket connection.

[0128] Optionally, the first network socket connection and the second network socket connection are both socket security WSS connections.

[0129] Fig.12 FIG. 1 is a block diagram of a connection device for an intranet device applied to a Web terminal according to an exemplary embodiment. Fig.12 As shown, the connection device 700 applied to the intranet device of the Web terminal includes:

[0130] The sending module 701 is used for sending the secure shell SSH connection task to the first client in the intranet via the first server in the external network in response to receiving the secure shell SSH connection task, so that the first client can establish an SSH connection between the first client and the target intranet device based on the SSH connection task, and establish a first network socket connection between the first client and the first server, wherein the SSH connection task is used to instruct the establishment of an SSH connection between the Web terminal and the target intranet device;

[0131] The third establishing module 702 is used to establish a second network socket connection between the Web client and the first server in response to receiving a first response message sent by the first server.

[0132] In the above technical solution, when a user initiates an SSH connection task for indicating the establishment of an SSH connection between the Web terminal and a target intranet device through a Web terminal, the Web terminal sends the SSH connection task to the first client via a first server in the external network; after obtaining the SSH connection task, the first client establishes an SSH connection between the first client and the target intranet device, and establishes a first network socket connection between the first client and the first server based on the SSH connection task; at the same time, after distributing the SSH connection task to the first client, the first server sends a first response message to the Web terminal, and after receiving the first response message, the Web terminal establishes a second network socket connection between itself and the first server. In this way, the Web client can access the target intranet device through the second network socket long connection, the first network socket long connection, and the SSH connection between the first client and the target intranet device in sequence. Therefore, the external network needs to access the intranet device through the first client. The first client exposes the long connection string to the external network, not the intranet device port. In this way, even if the attacker obtains the long connection string, he cannot access the intranet device, thereby ensuring the security of the SSH connection, preventing data leakage and "man-in-the-middle" attacks, and ensuring that the intranet device can be safely and reliably accessed and managed. In addition, users can initiate SSH connection requests to intranet devices from the Web client, allowing users to interact with intranet devices directly from the browser. In this way, users can seamlessly manage intranet devices from the Web client without complex network configuration, which greatly improves the flexibility and convenience of device management and improves user experience.

[0133] Optionally, the connecting device 700 for the intranet device applied to the Web terminal further includes:

[0134] a fifth sending module, configured to continuously send a heartbeat request to the first client via the second network socket connection after establishing the second network socket connection;

[0135] A generation module is used to generate prompt information indicating that the SSH connection between the Web client and the target intranet device is successful in response to receiving a heartbeat response sent by the first client, wherein after the first client establishes the SSH connection and the first network socket connection, the first client sends the heartbeat response to the Web client through the first network socket connection and the second network socket connection.

[0136] Optionally, the method further comprises:

[0137] If the heartbeat response is not received within a preset time period after the second network socket connection is established, the second network socket connection is disconnected.

[0138] The present disclosure also provides a computer-readable medium having a computer program stored thereon. When the computer program is executed by a processing device, the computer program implements the steps of the connection method for the intranet device applied to the first server provided by the present disclosure, or implements the steps of the connection method for the intranet device applied to the first client provided by the present disclosure, or implements the steps of the connection method for the intranet device applied to the Web side provided by the present disclosure.

[0139] The present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the connection method for the intranet device applied to the first server provided by the present disclosure, or implements the steps of the connection method for the intranet device applied to the first client provided by the present disclosure, or implements the steps of the connection method for the intranet device applied to the Web side provided by the present disclosure.

[0140] Reference below Fig.13 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.13 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0141] like Fig.13 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0142] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.13 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0143] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0144] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0145] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0146] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0147] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to receiving a secure shell SSH connection task sent by a Web terminal, distributes the SSH connection task to a first client in the intranet, so that the first client establishes an SSH connection between the first client and a target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; sends a first response message to the Web terminal, so that the Web terminal establishes a second network socket connection with the first server.

[0148] Alternatively, the computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to obtaining a secure shell (SSH) connection task issued by the Web terminal via the first server, establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; after establishing the SSH connection, establishes a first network socket connection between the first client and the first server, wherein, after the SSH connection task is successfully issued, the Web terminal establishes a second network socket connection with the first server.

[0149] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0150] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0151] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the first sending module may also be described as "a module for sending a first response message to the Web terminal so that the Web terminal establishes a second network socket connection with the first server".

[0152] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0153] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0154] According to one or more embodiments of the present disclosure, Example 1 provides a connection method for an intranet device, which is applied to a first server deployed in an external network, and the method includes: in response to receiving a secure shell (SSH) connection task sent by a Web terminal, distributing the SSH connection task to a first client in the intranet, so that the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; and sending a first response message to the Web terminal so that the Web terminal establishes a second network socket connection with the first server.

[0155] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, which distributes the SSH connection task to a first client in an intranet so that the first client establishes an SSH connection between the first client and a target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, including: pushing the SSH connection task to a message queue so that when the first client pulls the SSH connection task from the message queue, the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server.

[0156] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 1, wherein the first server is any one of a server cluster, and the server cluster is deployed in the external network; the method also includes: in response to receiving the SSH connection task, locally establishing a mapping relationship between a first task identifier of the SSH connection task and a memory address of the Web terminal; in response to receiving a first network socket connection request sent by the first client, determining whether a second task identifier exists in the mapping relationship, wherein the first network socket connection request includes the second task identifier; if the second task identifier does not exist in the mapping relationship, determining a second server corresponding to the second task identifier based on the correspondence between the task identifier and the server identifier, wherein the second server belongs to the server cluster; forwarding the first network socket connection request to the second server, so that the first client establishes a third network socket connection with the second server.

[0157] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, which further includes: if the second task identifier exists in the mapping relationship, sending a second response message to the first client to enable the first client to establish a fourth network socket connection with the first server.

[0158] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, which also includes: in response to receiving a second network socket connection request forwarded by a third server in the server cluster, sending a third response message to the first client so that the first client establishes a fifth network socket connection with the first server.

[0159] According to one or more embodiments of the present disclosure, Example 6 provides the method described in any one of Examples 1-5, wherein the first network socket connection and the second network socket connection are both socket secure WSS connections.

[0160] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 1, which is applied to a first client deployed in an intranet, and the method includes: in response to obtaining a secure shell (SSH) connection task issued by a Web terminal via a first server, establishing an SSH connection between the first client and a target intranet device based on the SSH connection task, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; after establishing the SSH connection, establishing a first network socket connection between the first client and the first server, wherein, after the SSH connection task is successfully issued, the Web terminal establishes a second network socket connection with the first server.

[0161] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 7, which further includes: pulling the SSH connection task from a message queue, wherein the first server pushes the SSH connection task sent by the Web client to the message queue.

[0162] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 7, wherein establishing a first network socket connection between the first client and the first server comprises: sending a third network socket connection request to the first server, wherein the third network socket connection request includes a first task identifier of the SSH connection task; and establishing the first network socket connection between the first client and the first server in response to receiving a fourth response message sent by the first server for the third network socket connection request.

[0163] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 7, which also includes: after establishing the first network socket connection, if a heartbeat request sent by the Web end via the second network socket connection is received, a heartbeat response is sent to the Web end through the first network socket connection and the second network socket connection, wherein, after establishing the second network socket connection, the Web end continues to send the heartbeat request to the first client via the second network socket connection.

[0164] According to one or more embodiments of the present disclosure, Example 11 provides the method described in any one of Examples 7-10, wherein the first network socket connection and the second network socket connection are both socket secure WSS connections.

[0165] According to one or more embodiments of the present disclosure, Example 12 provides a connection method for an intranet device, which is applied to a Web terminal, and the method includes: in response to receiving a secure shell (SSH) connection task, sending the SSH connection task to a first client in the intranet via a first server in the external network, so that the first client establishes an SSH connection between the first client and the target intranet device based on the SSH connection task, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to indicate the establishment of an SSH connection between the Web terminal and the target intranet device; in response to receiving a first response message sent by the first server, establishing a second network socket connection between the Web terminal and the first server.

[0166] According to one or more embodiments of the present disclosure, Example 13 provides the method of Example 12, which also includes: after establishing the second network socket connection, continuously sending a heartbeat request to the first client via the second network socket connection; in response to receiving a heartbeat response sent by the first client, generating a prompt message indicating that the SSH connection between the Web client and the target intranet device is successful, wherein, after establishing the SSH connection and the first network socket connection, the first client sends the heartbeat response to the Web client via the first network socket connection and the second network socket connection.

[0167] According to one or more embodiments of the present disclosure, Example 14 provides the method of Example 13, which further includes: if the heartbeat response is not received within a preset time after the second network socket connection is established, disconnecting the second network socket connection.

[0168] According to one or more embodiments of the present disclosure, Example 15 provides a connection system for an intranet device, the connection system comprising: at least one Web terminal, the Web terminal being used to execute the connection method for the intranet device described in any one of Examples 12-14; at least one server, the server being located in an external network, and being used to execute the connection method for the intranet device described in any one of Examples 1-6; and at least one first client, wherein the first client and the intranet device are located in the same intranet, and the first client is used to execute the connection method for the intranet device described in any one of Examples 7-11.

[0169] According to one or more embodiments of the present disclosure, Example 16 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-14 when executed by a processing device.

[0170] According to one or more embodiments of the present disclosure, Example 17 provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-14.

[0171] According to one or more embodiments of the present disclosure, Example 18 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-14 when executed by a processor.

[0172] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0173] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0174] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A method for connecting an intranet device, characterized in that: Applied to a first server deployed in an external network, the method includes: In response to receiving a secure shell (SSH) connection task sent by the Web client, distributing the SSH connection task to a first client in the intranet, so that the first client, based on the SSH connection task, establishes an SSH connection between the first client and a target intranet device, and establishes a first network socket connection between the first client and the first server, wherein the SSH connection task is used to instruct the establishment of an SSH connection between the Web client and the target intranet device; A first response message is sent to the Web client, so that the Web client establishes a second network socket connection with the first server.

2. The method according to claim 1, characterized in that The step of distributing the SSH connection task to a first client in the intranet so that the first client establishes an SSH connection between the first client and a target intranet device based on the SSH connection task, and establishing a first network socket connection between the first client and the first server, comprises: The SSH connection task is pushed to the message queue, so that when the first client pulls the SSH connection task from the message queue, based on the SSH connection task, an SSH connection is established between the first client and the target intranet device, and a first network socket connection is established between the first client and the first server.

3. The method according to claim 1, characterized in that The first server is any one of a server cluster, and the server cluster is deployed in the external network; The method further comprises: In response to receiving the SSH connection task, locally establishing a mapping relationship between a first task identifier of the SSH connection task and a memory address of the Web client; In response to receiving a first network socket connection request sent by the first client, determining whether a second task identifier exists in the mapping relationship, wherein the first network socket connection request includes the second task identifier; If the second task identifier does not exist in the mapping relationship, determining a second server corresponding to the second task identifier according to a corresponding relationship between a task identifier and a server identifier, wherein the second server belongs to the server cluster; The first network socket connection request is forwarded to the second server, so that the first client establishes a third network socket connection with the second server.

4. The method according to claim 3, characterized in that The method further comprises: If the second task identifier exists in the mapping relationship, a second response message is sent to the first client, so that the first client establishes a fourth network socket connection with the first server.

5. The method according to claim 3, characterized in that: The method further comprises: In response to receiving the second network socket connection request forwarded by the third server in the server cluster, a third response message is sent to the first client, so that the first client establishes a fifth network socket connection with the first server.

6. The method according to any one of claims 1 to 5, characterized in that The first network socket connection and the second network socket connection are both socket security WSS connections.

7. A method for connecting an intranet device, characterized in that: Applied to a first client deployed in an intranet, the method includes: In response to obtaining a secure shell (SSH) connection task issued by the Web client via the first server, establishing an SSH connection between the first client and the target intranet device based on the SSH connection task, wherein the SSH connection task is used to instruct the establishment of an SSH connection between the Web client and the target intranet device; After the SSH connection is established, a first network socket connection is established between the first client and the first server, wherein after the SSH connection task is successfully issued, the Web end establishes a second network socket connection with the first server.

8. The method according to claim 7, characterized in that The method further comprises: The SSH connection task is pulled from the message queue, wherein the first server pushes the SSH connection task sent by the Web client to the message queue.

9. The method according to claim 7, characterized in that: The establishing of a first network socket connection between the first client and the first server comprises: Sending a third network socket connection request to the first server, wherein the third network socket connection request includes a first task identifier of the SSH connection task; In response to receiving a fourth response message sent by the first server to the third network socket connection request, a first network socket connection is established between the first client and the first server.

10. The method according to claim 7, characterized in that The method further comprises: After establishing the first network socket connection, if a heartbeat request sent by the Web end via the second network socket connection is received, a heartbeat response is sent to the Web end via the first network socket connection and the second network socket connection, wherein, after establishing the second network socket connection, the Web end continues to send the heartbeat request to the first client via the second network socket connection.

11. The method according to any one of claims 7 to 10, characterized in that: The first network socket connection and the second network socket connection are both socket security WSS connections.

12. A method for connecting an intranet device, characterized in that: Applied to the Web side, the method includes: In response to receiving a secure shell (SSH) connection task, the SSH connection task is sent to a first client in the intranet via a first server in the external network, so that the first client can establish an SSH connection between the first client and a target intranet device based on the SSH connection task, and establish a first network socket connection between the first client and the first server, wherein the SSH connection task is used to instruct the establishment of an SSH connection between the Web client and the target intranet device; In response to receiving a first response message sent by the first server, a second network socket connection is established between the Web client and the first server.

13. The method according to claim 12, characterized in that The method further comprises: After establishing the second network socket connection, continuously sending a heartbeat request to the first client via the second network socket connection; In response to receiving a heartbeat response sent by the first client, a prompt message is generated to indicate that the SSH connection between the Web client and the target intranet device is successful, wherein, after establishing the SSH connection and the first network socket connection, the first client sends the heartbeat response to the Web client through the first network socket connection and the second network socket connection.

14. The method according to claim 13, characterized in that The method further comprises: If the heartbeat response is not received within a preset time period after the second network socket connection is established, the second network socket connection is disconnected.

15. A connection system for intranet devices, characterized in that: The connection system comprises: At least one Web terminal, the Web terminal being used to execute the method for connecting an intranet device according to any one of claims 12 to 14; At least one server, the server being located in an external network and configured to execute the method for connecting an intranet device according to any one of claims 1 to 6; At least one first client, wherein the first client and the intranet device are located in the same intranet, and the first client is used to execute the intranet device connection method according to any one of claims 7-11.

16. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 14 are implemented.

17. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 14.

18. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 14 are implemented.

Images