A method and device for accessing business resources

Abstract

The embodiment of the present invention discloses a business resource access method and device; after the embodiment of the present invention sends a business resource access request to an access server, the business resource access request carries a resource identifier of a business resource to be accessed, and the access server can be a cloud server. The access server receives an access ticket returned by the access server and gateway information corresponding to the resource identifier, and the gateway information includes a connection sequence between gateways in a gateway cluster. Then, the historical connection records of the gateway cluster within a preset time period are obtained, and the connection sequence between the gateways is adjusted according to the historical connection records. Based on the access ticket and the gateway cluster after the connection sequence is adjusted, the business resource to be accessed is securely accessed; this scheme can greatly improve the access efficiency of business resource access.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a service resource access method and device. Background Art

[0002] In recent years, with the rapid development of Internet technology, there are more and more resources on the Internet. For some important business resources, in order to ensure the security of access, they are often only accessible within a specific range. In the absence of a domain name server, the existing method of securely accessing business resources mainly limits the network address of the access resource by deploying a gateway, such as the Internet Protocol (IP). When the address user accesses the resource, the gateway service addressing is realized through polling based on the IP address. Only when the IP address is within the IP address range set by the gateway can the resource be securely accessed through the gateway.

[0003] In the process of research and practice of the prior art, the inventor of the present invention found that when accessing business resources by polling the access address, different gateways are continuously connected through the access address until the connection position is reached. When the number of gateways is large and the performance is inconsistent, it is necessary to blindly connect one by one, which increases the connection delay of the gateway, thereby resulting in higher network delay, and therefore greatly affects the access efficiency of business resource access. Summary of the invention

[0004] The embodiment of the present invention provides a service resource access method and device, which can improve the access efficiency of service resource access.

[0005] A method for accessing business resources, comprising:

[0006] Sending a service resource access request to an access server, wherein the service resource access request carries a resource identifier of a service resource to be accessed;

[0007] Receiving the access ticket returned by the access server and the gateway information corresponding to the resource identifier, wherein the gateway information includes a connection sequence between gateways in a gateway cluster;

[0008] Obtaining historical connection records of the gateway cluster within a preset time period;

[0009] According to the historical connection records, adjusting the connection sequence between the gateways;

[0010] The service resource to be accessed is accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0011] Optionally, the embodiment of the present invention also provides another service resource access method, including:

[0012] Receiving a service resource access request sent by a service terminal, wherein the service resource access request carries a resource identifier and access information of a service resource to be accessed;

[0013] Generate an access ticket for the service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier, wherein the gateway configuration information includes candidate gateways and a connection order of the candidate gateways;

[0014] Determining, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information;

[0015] According to the current connection information of the gateway cluster, the initial connection sequence is adjusted to obtain the connection sequence between the gateways in the gateway cluster;

[0016] The access ticket and gateway information are sent to the service terminal, so that the service terminal accesses the service resource to be accessed through the gateway cluster, wherein the gateway information includes a connection sequence between gateways in the gateway cluster.

[0017] Accordingly, an embodiment of the present invention provides a service resource access device, including:

[0018] A first sending unit, configured to send a service resource access request to an access server, wherein the service resource access request carries a resource identifier of a service resource to be accessed;

[0019] A first receiving unit, configured to receive the access ticket returned by the access server and the gateway information corresponding to the resource identifier, wherein the gateway information includes a connection sequence between gateways in a gateway cluster;

[0020] An acquisition unit, used to acquire historical connection records of the gateway cluster within a preset time period;

[0021] A first adjusting unit, configured to adjust the connection sequence between the gateways according to the historical connection record;

[0022] The access unit is used to access the service resource to be accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0023] Optionally, an embodiment of the present invention also provides another service resource access device, including:

[0024] A second receiving unit, configured to receive a service resource access request sent by a service terminal, wherein the service resource access request carries a resource identifier and access information of a service resource to be accessed;

[0025] A generating unit, configured to generate an access ticket for the service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier, wherein the gateway configuration information includes candidate gateways and a connection order of the candidate gateways;

[0026] a determining unit, configured to determine, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information;

[0027] A second adjustment unit, configured to adjust the initial connection sequence according to the current connection information of the gateway cluster to obtain a connection sequence between gateways in the gateway cluster;

[0028] The second sending unit is used to send the access ticket and gateway information to the service terminal, so that the service terminal accesses the to-be-accessed service resource through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

[0029] Optionally, in some embodiments, the first adjustment unit can be specifically used to extract the connection delay of the gateway in the gateway cluster from the historical connection record; sort the connection delay to obtain the connection delay sorting result of the gateway; and adjust the connection order between the gateways according to the connection delay sorting result.

[0030] Optionally, in some embodiments, the first adjustment unit can be specifically used to determine the current connection sorting result of the gateway according to the connection order between the gateways in the gateway cluster; merge the current connection sorting result and the connection delay sorting result to obtain the target connection sorting result of the gateway; and adjust the connection order between the gateways according to the target connection sorting result.

[0031] Optionally, in some embodiments, the access unit can be specifically used to filter out a target gateway in the gateway cluster according to the connection order after the gateway is adjusted, the target gateway being a gateway connected to a business server corresponding to the business resource to be accessed; sending an access ticket and a business resource access request to the target gateway to connect to the business server through the target gateway; when the target gateway is not connected to the business server, returning to the step of filtering out the target gateway in the gateway cluster according to the connection order after the gateway cluster is adjusted, until the target gateway is connected to the business server, and accessing the business resource to be accessed through the target gateway.

[0032] Optionally, in some embodiments, the access unit can be specifically used to count the connection delay of the target gateway connecting to the business server to obtain current connection delay information of the gateway cluster; and update the historical connection record of the gateway cluster according to the current connection delay information.

[0033] Optionally, in some embodiments, the first sending unit can be specifically used to obtain access information of the business resource to be accessed, and identify the identity information of the accessing user, the resource address of the business resource to be accessed, and the process identifier of the access process in the access information; determine the resource identifier of the business resource to be accessed based on the identity information and resource address; based on the process identifier, collect the process information of the access process; and add the access information, resource identifier and process information to the business resource access request.

[0034] Optionally, in some embodiments, the first sending unit can be specifically used to obtain resource configuration information corresponding to the identity information; parse the resource configuration information to obtain licensed business resource information corresponding to the identity information; when the licensed business resource information includes the resource address, filter out the resource identifier of the business resource to be accessed in the licensed business resource information.

[0035] Optionally, in some embodiments, the second adjustment unit can be specifically used to obtain current connection information of the gateway cluster and performance configuration information of the gateways in the gateway cluster; read the number of connections and load information of the gateway in the current connection information, and determine the connection weight of the gateway based on the performance configuration information, number of connections and load information; adjust the initial connection order based on the connection weight to obtain the connection order between the gateways in the gateway cluster.

[0036] Optionally, in some embodiments, the business resource access device may further include a configuration unit, which may be specifically used to display a gateway configuration page on the configuration terminal, the gateway configuration page including an add gateway control; in response to a trigger operation for the add gateway control, display a gateway editing page on the configuration terminal, the gateway editing page including a gateway parameter input control; obtain the gateway parameters input through the gateway input parameter control to generate gateway information to be configured; and configure the gateway information to be configured using the business resource to be accessed corresponding to the resource identifier to obtain the gateway configuration information corresponding to the resource identifier.

[0037] Optionally, in some embodiments, the configuration unit can be specifically used to create a resource configuration page in the configuration terminal according to the gateway information to be configured, the resource configuration page including a resource parameter entry interface and a gateway list corresponding to the gateway information to be configured; receive resource parameters entered into the resource parameter entry interface and a gateway cluster selected in the gateway list, the resource parameters including the resource identifier; create a gateway sorting page in the configuration terminal according to the gateway cluster, the gateway sorting page including a sorting control for the gateways in the gateway cluster; determine an initial connection order between the gateways in the gateway cluster in response to a trigger operation on the sorting control; configure the service resources to be accessed corresponding to the resource identifier according to the initial connection order between the gateways, and obtain the gateway configuration information corresponding to the resource identifier.

[0038] Optionally, in some embodiments, the configuration unit can be specifically used to create a resource management page in the configuration terminal according to the gateway configuration information, the resource management page including an access user list and a licensed business resource list corresponding to the gateway configuration information; receive an access user selected in the access user list and a licensed business resource selected in the licensed business resource list; match the identity information of the access user with the licensed business resource to obtain resource configuration information corresponding to the identity information, and send the resource configuration information to the business terminal.

[0039] Optionally, in some embodiments, the business resource access device may further include a detection unit, which may be specifically used to detect the process information of the access process according to a preset detection strategy to determine the type of the access process; when the access process is a malicious process, a prompt message is sent to the business terminal, so that the business terminal terminates access to the business resource to be accessed.

[0040] In addition, an embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to implement the service resource access method provided by the embodiment of the present invention.

[0041] In addition, an embodiment of the present invention further provides a computer-readable storage medium, which stores a plurality of instructions suitable for loading by a processor to execute the steps in any one of the service resource access methods provided by the embodiments of the present invention.

[0042] In the embodiment of the present invention, after sending a business resource access request to an access server, the business resource access request carries a resource identifier of the business resource to be accessed, receives an access ticket returned by the access server and gateway information corresponding to the resource identifier, the gateway information including the connection sequence between gateways in the gateway cluster, and then obtains the historical connection records of the gateway cluster within a preset time period, adjusts the connection sequence between gateways according to the historical connection records, and accesses the business resource to be accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted; since the scheme can dynamically adjust the connection sequence between gateways in the gateway cluster according to the historical connection records of the gateway cluster, thereby reducing the connection delay of connecting to the business server through the gateways in the gateway cluster, the access efficiency of business resource access can be greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 is a scenario diagram of a service resource access method provided by an embodiment of the present invention;

[0045] Figure 2 is a schematic diagram of a scenario of a service terminal in a service resource access method provided by an embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of the overall structure of the business resource access system provided by the embodiment of the present invention.

[0047] Figure 4 This is a schematic diagram of a first process of a service resource access method provided by an embodiment of the present invention;

[0048] Figure 5 is a schematic diagram of process information of an access process provided by an embodiment of the present invention;

[0049] Figure 6 It is a schematic diagram of a process of accessing a resource to be accessed through a target gateway provided by an embodiment of the present invention;

[0050] Figure 7 is a second flow chart of the service resource access method provided by an embodiment of the present invention;

[0051] Figure 8 is a schematic diagram of a gateway configuration page provided by an embodiment of the present invention;

[0052] Fig. 9is a schematic diagram of a gateway editing page provided by an embodiment of the present invention;

[0053] Fig.10 is a schematic diagram of a resource configuration page provided by an embodiment of the present invention;

[0054] Fig.11 is a schematic diagram of a gateway sorting page provided by an embodiment of the present invention;

[0055] Fig.12 is a schematic diagram of a resource management page provided by an embodiment of the present invention;

[0056] Fig.13 It is a schematic diagram of a process flow of detecting process information provided by an embodiment of the present invention;

[0057] Fig.14 is a third flow diagram of business resource access provided by an embodiment of the present invention;

[0058] Fig.15 is a structural diagram of a first service resource access device provided by an embodiment of the present invention;

[0059] Fig.16 is a first structural diagram of a second service resource access device provided by an embodiment of the present invention;

[0060] Fig.17 is a second structural diagram of a second service resource access device provided by an embodiment of the present invention;

[0061] Fig.18 is a third structural diagram of the second service resource access device provided by an embodiment of the present invention;

[0062] Fig.19 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0064] The embodiment of the present invention provides a business resource access method, device and computer-readable storage medium. Among them, the business resource access device can be integrated in an electronic device, and the electronic device can be a server or a terminal. Specifically, the embodiment of the present invention provides a business resource access device for a first electronic device (in order to distinguish, it can be called a first business resource access device), and a business resource access device for a second electronic device (in order to distinguish, it can be called a second business resource access device). Among them, the first electronic device can be a terminal and other devices, and the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The second electronic device can be a network-side device such as a server, and the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal and the server can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0065] In an embodiment of the present invention, a first electronic device is taken as a terminal and a second electronic device is taken as a server as an example, wherein the first electronic device may be a business terminal for configuring business resources, and the second electronic device may be an access server for distinguishing business servers corresponding to business resources, to introduce a business resource access method.

[0066] For example, see Figure 1 An embodiment of the present invention provides a business resource access system including a business terminal 10, an access server 20, a gateway 30 and a business server 40 corresponding to the business resources to be accessed; the business terminal 10 and the access server 20 are connected via a network, for example, via an effective or wireless network connection, wherein the business resource access device is integrated in the business terminal, for example, in the form of a client.

[0067] Among them, the business terminal 10 can be used to send a business resource access request to the access server, the business resource access request carries the resource identifier of the business resource to be accessed, and then receive the access ticket returned by the access server and the gateway information corresponding to the resource identifier, the gateway information includes the connection sequence between gateways in the gateway cluster, and then obtain the historical connection record of the gateway cluster within a preset time period, adjust the connection sequence between the gateways according to the historical connection record, and access the business resource to be accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted. Specifically, it can be as follows Figure 2 shown.

[0068] The business resources may be understood as Internet resources stored in the business server, for example, web pages, videos, audios, or texts corresponding to a certain URL or domain name.

[0069] There are many ways for a service terminal to access a service resource to be accessed. For example, the service terminal 10 can obtain an access ticket and gateway information for accessing the service resource to be accessed from an access server, and access the service resource to be accessed based on the access ticket and gateway information. Specifically, the service terminal 10 can send a service resource access request to the access server 20; the access server can be used to:

[0070] A business resource access request sent by a business terminal is received, the business resource access request carries a resource identifier and access information of a business resource to be accessed, an access ticket for the business resource to be accessed is generated according to the access information, and gateway configuration information corresponding to the resource identifier is obtained, the gateway configuration information includes candidate gateways and a connection sequence of the candidate gateways, a gateway cluster for accessing the business resource to be accessed and an initial connection sequence between gateways in the gateway cluster are determined in the gateway configuration information according to the identity information, the initial connection sequence is adjusted according to the current connection information of the gateway cluster, the connection sequence between gateways in the gateway cluster is obtained, the access ticket and the gateway information are sent to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

[0071] Among them, for the access to business resources, the business terminal and access server are used as the business resource access system to provide a method for securely accessing business resources. It mainly provides a unified entrance for the access subject to access the business resources to be accessed through the business resource access request through the zero-trust access agent and gateway cluster. The business terminal and access server provide authentication operations for the unified entrance. Only the authenticated business resource access request can be forwarded by the zero-trust access agent to the access gateway in the gateway cluster. The actual business resource access is proxied by the access gateway, so that the access subject can understand the access object through the unified entrance and realize the access to business resources. The specific details can be as follows: Figure 3 As shown in the figure. The so-called access subject can be understood as the party that initiates access in the network, the person / device / application that accesses the intranet business resources. The corresponding access object can be the party that is accessed in the network, that is, the enterprise intranet business resources, data, development and testing environment, operation and maintenance environment, etc.

[0072] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0073] This embodiment will be described from the perspective of a first business resource access device, which can be specifically integrated in an electronic device, which can be a terminal or other device; wherein the terminal can include a tablet computer, a laptop computer, a personal computer (PC), a wearable device, a virtual reality device or other smart devices that can access business resources.

[0074] A method for accessing business resources, comprising:

[0075] A business resource access request is sent to an access server, where the business resource access request carries a resource identifier of the business resource to be accessed; an access ticket and gateway information corresponding to the resource identifier are received from the access server, where the gateway information includes a connection sequence between gateways in a gateway cluster; historical connection records of the gateway cluster within a preset time period are obtained; the connection sequence between gateways is adjusted according to the historical connection records; and the business resource to be accessed is accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0076] like Figure 4 As shown, the specific process of the business resource access method is as follows:

[0077] 101. Send a business resource access request to an access server.

[0078] The service resource access request carries the resource identifier of the service resource to be accessed.

[0079] For example, a business resource access request generated by a user through a client trigger is received, and then the business resource access request is directly sent to the access server. When the information memory carried in the business resource access request is large, the information carried in the business resource access request can also be indirectly sent to the access server, for example, the resource identifier of the business resource to be accessed, the access information, and the process information of the access process carried in the business resource access request are stored in a third-party database, the storage address is added to the business resource access request, and the business resource access request with the added storage address is sent to the access server, so that after receiving the business resource access request, the access server obtains the resource identifier of the business resource to be accessed, the access information, and the process information of the access process in the third-party database according to the storage address carried in the business resource access request.

[0080] Among them, the access server can be adapted to medium-sized enterprises, institutions and governments in a single deployment mode, or it can be adapted to large enterprise groups and multi-level vertical government e-government systems through a distributed cascade deployment mode. In order to ensure the stability of the compulsory resource access system, a zero-trust core service multi-site active solution is usually adopted. The core business and basic business in the business resource access system can be deployed in the master control node of the access server, and different businesses are deployed in different secondary nodes. The master control node realizes its own availability through cluster deployment, and the master control node of the access server realizes configuration and data synchronization with different business nodes. Among them, the master control node of the access server deploys core basic services, which can be heartbeat services, policy synchronization services, equipment management services, etc. The master control node will synchronize the configuration and data to each business node regularly. If each business node has data and configuration that need to be changed, it will notify the master control node to modify it. After the master control node is modified, it can be synchronized to each business node, which is used to realize data and configuration synchronization between each node in the access server.

[0081] Optionally, before sending the business resource access request to the access server, the resource identifier of the business resource to be accessed by the access user may be determined, and the process information of the access process to access the business resource to be accessed may be collected, and the resource identifier of the business resource to be accessed and the process information of the access process may be added to the business resource access request. Therefore, the business resource access method may further include:

[0082] Obtain access information of the business resource to be accessed, and identify the identity information of the accessing user, the resource address of the business resource to be accessed, and the process ID of the access process in the access information. According to the identity information and resource address, determine the resource ID of the business resource to be accessed. Based on the process ID, collect the process information of the access process, and add the access information, resource ID, and process information to the business resource access request. The details can be as follows:

[0083] (1) Obtain access information of the business resource to be accessed, and identify the identity information of the accessing user, the resource address of the business resource to be accessed, and the process identifier of the accessing process in the access information.

[0084] For example, when a user initiates a business resource access request for a business resource to be accessed through an application in a client, an access proxy is used to hijack the business resource access request, and access information of the business resource to be accessed is obtained in the business resource access request. For example, the access proxy initiates an authentication request to the first business resource access device to apply for an access ticket, and forwards the business resource access request to the first business resource access device, and the first business resource access device obtains the access information carried in the business resource access request. The identity information of the accessing user, the resource address of the business resource to be accessed, and the process identifier of the access process are identified in the access information. For example, the identity information of the accessing user, the source port, the source IP or domain name, etc. are identified in the access information as the identity information of the accessing user, the destination IP or domain name, and the destination port are identified in the access information as the resource address of the business resource to be accessed, and the PID of the access process corresponding to the application is identified in the access information as the process identifier.

[0085] Among them, the access proxy can be understood as hijacking device traffic through the TUN / TAP virtual network card to perform encrypted communication and achieve remote access.

[0086] (2) Determine the resource identifier of the business resource to be accessed based on the identity information and resource address.

[0087] For example, the resource configuration information corresponding to the identity information can be obtained, such as receiving the resource configuration information of the access user configured by the administrator sent by the server, and filtering out the resource configuration information corresponding to the identity information from the resource configuration information of the access user. The resource configuration information is parsed, such as identifying the list of accessible business resources corresponding to the identity information in the resource configuration information, and using the list of business resources accessible by the identity information as the permitted business resource information. When the permitted business resource information includes the resource address, the resource identifier of the business resource to be accessed is filtered out in the permitted business resource information, such as matching the destination IP, domain name or destination port of the business resource to be accessed with the destination IP, domain name or destination port of the business resource in the accessible business resource list. When the match is successful, the identity document (ID) corresponding to the successfully matched business resource is filtered out in the accessible business resource list as the resource identifier of the business resource to be accessed.

[0088] (3) Based on the process identifier, collect process information of the access process.

[0089] For example, based on the process identifier of the access process, the process information of the access process is collected. For example, the MD5 of the access process, the hash value of the access process, the process path, the last modification time of the process, copyright information, signature information and certificate chain details can be collected, where the certificate chain details include: digest algorithm, root certificate name, root certificate serial number, root certificate expiration time, intermediate certificate name, intermediate certificate serial number, intermediate certificate expiration time, signature certificate name, signature certificate serial number, signature certificate expiration time, signature status, signer name, timestamp, signature verification error information. The collected process information is used as the process information of the access process. Taking the access process A as an example, the specific process information can be as follows: Figure 5 shown.

[0090] (4) Add access information, resource identification and process information to the business resource access request.

[0091] For example, the access information, resource identification, and process information can be directly added to the business resource access request. When the access information, resource identification, and process information memory is large, the access information, resource identification, and process information can also be indirectly added to the business resource access request, for example, the access information, resource identification, and process information are stored in a third-party database, and then the storage address is added to the business resource access request.

[0092] 102. Receive the access ticket and gateway information corresponding to the resource identifier returned by the access server.

[0093] The gateway information includes the connection sequence between gateways in the gateway cluster. The access ticket may be an access credential for accessing the service resource to be accessed, and the access ticket may also include information such as the maximum number of uses of the access credential and the access validity of the access credential.

[0094] For example, after the access server receives the business resource access request sent by the first business resource access device, it verifies the access information and process information of the access user, for example, verifies the identity of the access user, verifies the hardware information and device security status of the business terminal corresponding to the first business resource access device, and detects whether the access belongs to a malicious process and whether there is a vulnerability based on the process information. When the verification is successful, the access server will send the access ticket and the gateway information corresponding to the resource identifier to the first business resource access device, and the first business resource access device can receive the access ticket and the gateway information corresponding to the resource identifier returned by the access server.

[0095] 103. Obtain historical connection records of the gateway cluster within a preset time period.

[0096] For example, a historical connection record set of all gateway connections is obtained from the access proxy device, the gateway identifier or gateway address of the gateway in the gateway cluster is read from the gateway information, and the historical connection record set of the gateway is filtered out according to the gateway identifier or gateway address. For example, the historical connection record set can be filtered out to obtain the connection record of the gateway corresponding to the gateway identifier or gateway address that is connected to the business server corresponding to the business resource to be accessed within 10 minutes, half an hour or other time period before the current time. For example, whether the gateway is successfully connected to the business server and what is the connection delay of the successfully connected gateway. In this way, the historical connection records of the gateway cluster within the preset time period can be obtained.

[0097] 104. Adjust the connection sequence between gateways according to historical connection records.

[0098] For example, the connection delays of gateways in a gateway cluster can be extracted from historical connection records, and the connection delays can be sorted to obtain the connection delay sorting results of the gateways. According to the connection delay sorting results, the connection order between the gateways can be adjusted, as follows:

[0099] (1) Extract the connection delay of the gateways in the gateway cluster from the historical connection records.

[0100] For example, the connection delay of each gateway in the gateway cluster connecting to the business resource to be accessed within a preset time period is extracted from the historical connection record. For example, the connection delay generated by the gateway connecting to the business server corresponding to the business resource to be accessed within 10 minutes, half an hour or other time period is extracted from the historical connection record. The connection delay can be the delay from the time the gateway starts connecting to the business server to the time it successfully connects to the business server.

[0101] (2) Sort the connection delays to obtain the connection delay sorting result of the gateway.

[0102] For example, the connection delays of the gateways in the gateway cluster are sorted. For example, the connection delays of the gateways are sorted according to the length of the connection delay. For example, taking the gateway cluster including three gateways A, B and C, the connection delay of gateway A is 50ms, the connection delay of gateway B is 10ms, and the connection delay of gateway C is 30ms. The connection delays of the three gateways are sorted in order of the shorter the connection delay, the higher the ranking. The connection delay sorting result of the gateways can be that the connection delay of gateway B ranks first, the connection delay of gateway C ranks second, and the connection delay of gateway A ranks third.

[0103] (3) According to the connection delay sorting results, the connection order between gateways is adjusted.

[0104] For example, according to the connection sequence between gateways in the gateway cluster, the current connection ranking result of the gateway is determined. For example, taking the gateway cluster including three gateways A, B and C, and the connection sequence between the gateways is gateway A-gateway B-gateway C as an example, it can be determined that the current connection of gateway A ranks first, the current connection of gateway B ranks second, and the current connection of gateway C ranks third. The current connection ranking result and the connection delay ranking result are merged. For example, the current connection ranking result and the connection delay ranking result are assigned coefficients in order from front to back. For example, the ranking coefficient corresponding to the first ranking is 1, the ranking coefficient corresponding to the second ranking is 2, and the ranking coefficient corresponding to the third ranking is 3. The ranking coefficients corresponding to the current connection ranking results and the connection delay ranking results of gateways A, gateway B and gateway C are added together, and the sum of the ranking coefficients of gateways A, gateway B and gateway C can be obtained respectively. Then sort the ranking coefficients of gateway A, gateway B and gateway C. For example, the one with the lower sum of ranking coefficients is ranked first. For example, taking gateway A as an example, gateway A is ranked third in the connection delay ranking result, and the corresponding ranking coefficient is 3. It is ranked first in the current connection delay ranking result, and the corresponding ranking coefficient is 1. The ranking coefficient of gateway A is 4. In the same way, the sum of the ranking coefficients of gateway B can be calculated to be 3, and the ranking coefficient of gateway C is 5. The target connection ranking result of the gateway can be obtained as gateway B ranks first, gateway A ranks second, and gateway C ranks third. According to the target connection ranking result, the connection order between gateways is adjusted. For example, taking the current connection order as gateway A-gateway B-gateway C, the current connection order can be adjusted to gateway B-gateway A-gateway C, and the connection to the service server is connected in this order.

[0105] 105. Access the service resource to be accessed based on the access ticket and the gateway cluster after adjusting the connection order.

[0106] For example, the target gateway can be selected from the gateway cluster according to the connection sequence adjusted by the gateway cluster, and an access ticket and a business resource access request can be sent to the target gateway to connect to the business server through the target gateway. When the target gateway is not connected to the business server, the process returns to the step of selecting the target gateway from the gateway cluster according to the connection sequence adjusted by the gateway cluster until the target gateway is connected to the business server, and the business resource to be accessed is accessed through the target gateway. The details can be as follows:

[0107] (1) According to the connection order after the gateway adjustment, select the target gateway in the gateway cluster.

[0108] The target gateway is a gateway connected to a service server corresponding to the service resource to be accessed.

[0109] For example, according to the adjusted connection order of the gateways, the gateway with the highest order in the connection order is used as the target gateway. For example, if the connection order is gateway A-gateway B-gateway C, gateway A is used as the target gateway to connect to the business server first. If gateway A fails to connect successfully, gateway B is used as the target gateway. If gateway B still fails to connect successfully, gateway C is used as the target gateway.

[0110] (2) Send an access ticket and a business resource access request to the target gateway to connect to the business server through the target gateway.

[0111] For example, taking gateway A as the target gateway and the gateway address as "14.215.177.40:2900", the access ticket, business resource access request and gateway address are sent to the access proxy through the ticket response. The access proxy connects to the target gateway corresponding to the gateway address "14.215.177.40:2900" and forwards the access ticket and business resource access request to the target gateway. The target gateway sends the access ticket to the access server for verification. When the access ticket verification passes, the target gateway forwards the business resource access request to the business server to connect to the business server.

[0112] (3) When the target gateway is not connected to the business server, return to the step of selecting the target gateway in the gateway cluster according to the connection order adjusted by the gateway cluster until the target gateway is connected to the business server, and access the business resource to be accessed through the target gateway.

[0113] For example, when the target gateway is connected to a business server, the step of filtering out the target gateway in the gateway cluster according to the connection order adjusted by the gateway cluster is returned. For example, when gateway A is not connected to the business server, the step of filtering out the target gateway in the gateway cluster is returned, and gateway B ranked second in the connection order is used as the target gateway, and the business server is connected through gateway B. If gateway B is still not connected to the business server, gateway C ranked next to gateway B is used as the target gateway to connect to the business server until a gateway connected to the business server exists in the gateway cluster. For example, when the target gateway is connected to the business server, the business server sends the resource to be accessed to the access agent through the target gateway according to the business resource access request, and the access agent forwards the resource to be accessed to the first business resource access device, so that the first business resource access device accesses the resource to be accessed. The specific access process can be as follows: Figure 6 shown.

[0114] Among them, if all gateways in the gateway cluster fail to connect to the business server for the first time, then the second round of polling can be started. For example, taking the gateway cluster including gateway A, gateway B and gateway C as an example, if gateway A, gateway B and gateway C are not connected to the business server in the first round of connection, then the second round of connection can be started in the connection order until the target gateway is connected to the business server.

[0115] Optionally, when the target gateway is connected to the service server and accesses the resource to be accessed through the service server, statistics may be collected on the connection delay between the target gateway and the service server. Therefore, the service resource access method further includes:

[0116] The connection delay of the target gateway to the service server is counted to obtain the current connection delay information of the gateway cluster, and the historical connection record of the gateway cluster is updated according to the current connection delay information.

[0117] For example, the connection delay of the target gateway can be counted by the access agent when the target gateway is connected to the service server. For example, the connection delay of each gateway in the gateway cluster connecting to the service server can be counted. After the statistics are completed, the current connection delay information of the gateway cluster can be obtained. Then, the access agent can send it to the first service resource access device immediately or periodically. According to the current connection delay information, the historical connection record of the gateway cluster is updated. For example, the current connection delay information of the gateway cluster that is connected to the service server is added to the historical connection record of the gateway cluster within a preset time period to update the historical connection record of the gateway cluster. After the historical connection record of the gateway cluster is updated, when the same service server is connected through the gateway cluster next time, the current connection order between the gateways in the gateway cluster can be adjusted according to the updated historical connection record, and the service server corresponding to the service resource to be accessed can be connected through the gateway cluster according to the adjusted connection order.

[0118] From the above, it can be seen that after the embodiment of the present invention sends a business resource access request to the access server, the business resource access request carries the resource identifier of the business resource to be accessed, receives the access ticket returned by the access server and the gateway information corresponding to the resource identifier, and the gateway information includes the connection order between the gateways in the gateway cluster. Then, the historical connection records of the gateway cluster within a preset time period are obtained, and the connection order between the gateways is adjusted according to the historical connection records. Based on the access ticket and the gateway cluster after the connection order is adjusted, the business resource to be accessed is accessed; because the scheme can dynamically adjust the connection order between the gateways of the gateway cluster according to the historical connection records of the gateway cluster, thereby reducing the connection delay of connecting to the business server through the gateways in the gateway cluster, the access efficiency of business resource access can be greatly improved.

[0119] According to the method described in the above embodiment, the following is further described in detail with examples.

[0120] In this embodiment, it will be described from the perspective of the second business resource access device. The second business resource access device can be specifically integrated in an electronic device, with the electronic device as the access server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms.

[0121] A method for accessing business resources, comprising:

[0122] A business resource access request sent by a business terminal is received, the business resource access request carries a resource identifier and access information of a business resource to be accessed, an access ticket for the business resource to be accessed is generated according to the access information, and gateway configuration information corresponding to the resource identifier is obtained, the gateway configuration information includes candidate gateways and a connection sequence of the candidate gateways, a gateway cluster for accessing the business resource to be accessed and an initial connection sequence between gateways in the gateway cluster are determined in the gateway configuration information according to the identity information, the initial connection sequence is adjusted according to the current connection information of the gateway cluster, the connection sequence between gateways in the gateway cluster is obtained, the access ticket and the gateway information are sent to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

[0123] like Figure 7 As shown, the specific process of the business resource access method is as follows:

[0124] 201. Receive a service resource access request sent by a service terminal.

[0125] The service resource access request carries the resource identifier and access information of the service resource to be accessed.

[0126] For example, a business resource access request sent by a business terminal can be directly received, and the resource identifier and access information of the business resource to be accessed carried in the business resource access request can be obtained. When the memory occupied by the resource identifier and access information of the business resource to be accessed is large, the resource identifier and access information of the business resource to be accessed carried in the business resource access request can be indirectly obtained. For example, the business terminal stores the resource identifier and access information of the business resource to be accessed in a third-party database, adds the storage address to the business resource access request, and the second business resource access device extracts the storage address from the received business resource access request, and obtains the resource identifier and access information of the business resource to be accessed in the third-party database according to the storage address.

[0127] 202. Generate an access ticket for the service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier.

[0128] The gateway configuration information includes candidate gateways and the connection order of the candidate gateways. The gateway configuration information may include candidate gateway information corresponding to each service resource that can access the service resource, and the connection order between the candidate gateways.

[0129] For example, the access information is verified, and after the verification is passed, the access credential of the business resource to be accessed corresponding to the access information and the number of accesses and access time limit of the access credential can be generated according to the preset access policy, and these can be used as the access ticket of the business resource to be accessed. The gateway configuration information corresponding to the resource identifier is obtained, for example, according to the preset access policy, the gateway configuration information corresponding to the resource identifier is filtered out in the gateway configuration information set.

[0130] Optionally, before obtaining the gateway configuration information corresponding to the resource identifier, the gateway connected to the business server corresponding to the business resource to be accessed may also be configured. Therefore, the business resource access method further includes:

[0131] A gateway configuration page is displayed on the configuration terminal, and the gateway configuration page includes an add gateway control. In response to a trigger operation for adding the gateway control, a gateway editing page is displayed on the configuration terminal, and the gateway editing page includes a gateway parameter input control. Gateway parameters input through the gateway parameter input control are obtained to generate gateway information to be configured, and the gateway information to be configured is configured using a to-be-accessed business resource corresponding to the resource identifier, so as to obtain the gateway configuration information corresponding to the resource identifier.

[0132] Among them, the response is used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed can be in real time or have a set delay. Unless otherwise specified, there is no restriction on the order of execution of the multiple operations executed.

[0133] Among them, the configuration terminal can be a terminal connected to the second business resource access device. The business resource access administrator configures the gateway configuration information and resource configuration information through the configuration terminal, and stores the configured gateway configuration information and resource configuration information as access policies in the first business resource access device and the second business resource access device.

[0134] For example, when the configuration terminal displays the gateway configuration page, the gateway configuration page can be as follows: Figure 8 As shown in FIG. 1 , the gateway configuration page includes a gateway add control and may also include information about the gateways that have been added. In response to a trigger operation for adding a gateway control, a gateway edit page is displayed on the configuration terminal. The gateway edit page may be as follows: Fig. 9 As shown, the gateway editing page includes a gateway parameter input control and a determination control, and there can be multiple gateway parameter input controls. The gateway parameters entered through the gateway parameter input control are obtained. The gateway parameters may include various types of parameters, such as the gateway name, gateway setting parameters, and the local address interval corresponding to the gateway that is allowed to be accessed. The gateway setting parameters may include the connection address and port information of the gateway, etc. The local address interval that is allowed to be accessed may be an IP address interval consisting of the starting address to the end address of the IP segment of the service terminal that can access the service server through the gateway. The local address interval that is allowed to be accessed may include one or more. In response to the trigger operation for the determination control, the gateway configuration page is returned. At this time, the gateway information that has been added in the gateway configuration page already includes the gateway added this time. Based on these gateways that have been added, the gateway information to be configured can be generated.

[0135] Among them, for the configuration of the gateway, multiple gateways can be configured at the same time to form a gateway cluster. The administrator can configure the server IP or domain name and port deployed by each gateway service through the configuration terminal. At the same time, the IP segment that gives priority access to the gateway can be configured. This information is used as the gateway parameter. When connecting or accessing the gateway in the future, only the access user whose export IP of the business terminal matches the corresponding IP segment can access or connect to the gateway.

[0136] In one embodiment, the to-be-accessed service resource corresponding to the resource identifier is used to configure the to-be-configured gateway information, and the gateway configuration information corresponding to the resource identifier is obtained. For example, according to the to-be-configured gateway information, a resource configuration page is created in the configuration terminal. The resource configuration page can be as follows Fig.10As shown, the resource configuration page includes a resource parameter entry interface and a gateway list corresponding to the gateway information to be configured. The resource parameter entry interface may include multiple entry interfaces. Resource parameters may include the resource identifier of the resource to be accessed, the access category, and when the administrator selects the access category as IP, the type of IP may be selected. For example, it may be a specified IP or IP segment. When the administrator selects the access category as domain name, it is only necessary to enter the domain name information of the business resource. Resource parameters may also include port information of the business terminal for accessing the business resource to be accessed. The gateway list may include information such as the gateway name and gateway address of all or part of the gateways that have been added on the gateway configuration page. Receive the resource parameters entered in the resource parameter entry interface and the gateway cluster selected in the gateway list. Based on the gateway cluster, a gateway sorting page is created in the configuration terminal. The gateway sorting page may be as follows: Fig.11 As shown, the gateway sorting page may include a sorting control for the gateways in the gateway cluster, and the sorting control may include an ascending control and a descending control. The ascending control may increase the connection priority or connection order of the gateway, and the descending control may decrease the connection priority or connection order of the gateway. In response to a trigger operation on the sorting control, the initial connection order between the gateways in the gateway cluster is determined. For example, in response to an administrator's trigger operation on the ascending control or the descending control, the initial connection order of each gateway in the gateway cluster can be determined. According to the initial connection order between the gateways, the to-be-accessed business resources corresponding to the resource identifier are configured. For example, the to-be-accessed resources corresponding to the resource identifier are associated with the gateway cluster, and the gateway cluster corresponding to each to-be-accessed resource and the initial connection order between the gateways in the gateway cluster can be obtained, and this information is used as the gateway configuration information corresponding to the resource identifier.

[0137] Optionally, after the gateway information to be configured is configured using the service resource to be accessed corresponding to the resource identifier and the gateway configuration information corresponding to the resource identifier is obtained, the access user corresponding to the service resource is configured according to the gateway configuration information. Therefore, the service resource access method further includes:

[0138] According to the gateway configuration information, a resource management page is created in the configuration terminal. The resource management page includes an access user list and a licensed business resource list corresponding to the gateway configuration information, receives an access user selected in the access user list and a licensed business resource selected in the licensed business resource list, matches the identity information of the access user with the licensed business resource to obtain resource configuration information corresponding to the identity information, and sends the resource configuration information to the business terminal.

[0139] For example, based on the configured gateway configuration information, create a resource management page in the configuration terminal. The resource management page is as follows: Fig.12As shown, it may include an access user list and a permitted business resource list, wherein the access user list may include multiple access users or access user groups, and the access users in the access user group may configure the same resource configuration information. The access users selected by the administrator in the access user list and the permitted business resources selected in the permitted business resource list are received, and the permitted business resources corresponding to each identity information are determined according to the identity information of the access users selected by the administrator. At this time, the business resources accessible to each access user or access user group can be obtained, and this information is used as the resource configuration information corresponding to the access user or the identity information of the access user, and the resource configuration information is sent to the business terminal. For example, the business terminal can periodically send a configuration information acquisition request to the second business resource access device through the heartbeat service, and receive the gateway configuration information periodically sent by the second business resource access device and the resource configuration information of the current access user as the preset access policy. The business terminal encrypts and stores the preset access policy.

[0140] 203. Determine, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information.

[0141] For example, the local address of the service terminal can be identified in the identity information, for example, the exit IP of the access user accessing the service resource to be accessed through the service terminal can be identified in the identity information. Then, the gateway whose local address is in the accessible local address interval configured in the gateway is selected from the candidate gateways as the gateway for accessing the service resource to be accessed. For example, if the exit IP address interval configured in the candidate gateway is 1.1.0.1-100.100.100.100, if the exit IP of the service terminal is 80.15.00.20, it can be determined that the exit IP address is within the IP address interval, and the candidate gateway can be the gateway for connecting to the service server corresponding to the service resource to be accessed. If the exit IP of the service terminal is 192.16.00.12, it can be determined that the exit IP address is not within the IP address interval, and the candidate gateway cannot be used as the gateway for connecting to the service server. Cluster deployment can be adopted for gateways and access servers. Therefore, there are generally multiple gateways for accessing the service resource to be accessed, and these gateways can be formed into a gateway cluster. According to the connection order between gateways in these gateway clusters configured by the administrator, the initial connection order between gateways in the gateway cluster can be determined. For example, there are 4 candidate gateways, namely Gateway A, Gateway B, Gateway C and Gateway D, and their connection order is Gateway A-Gateway B-Gateway C-Gateway D. The selected gateway cluster includes Gateway A, Gateway B and Gateway D. Then the initial connection order between gateways in the gateway cluster can be Gateway A-Gateway B-Gateway D.

[0142] 204. Adjust the initial connection sequence according to the current connection information of the gateway cluster to obtain the connection sequence between the gateways in the gateway cluster.

[0143] For example, the current connection information of the gateway cluster and the performance configuration information of the gateways in the gateway cluster are obtained. For example, the number of connections and computing loads of the gateways in the gateway cluster that are currently connected to the business server can be obtained, and the number of connections and computing loads are used as the current connection information of the gateway cluster. The CPU model, memory performance and other information of each gateway in the gateway cluster can also be obtained, and this information is used as the performance configuration information of the gateway. The number of connections and load information of the gateway are read from the current connection information, and the connection weight of the gateway is determined based on the performance configuration information, the number of connections and the load information. For example, a default connection weight can be pre-configured for each gateway in the gateway cluster, and the default connection weight can be a positive integer within a range. The factors that affect the default weight are mainly performance configuration, number of connections and computing load, etc. Then, the weight range of performance configuration is set to 1-100, the weight range of connection number is set to 1-100, and the weight range of computing load is set to 1-100. The higher the performance configuration, the higher the connection weight assigned, the larger the number of connections, the lower the connection weight assigned, and the larger the computing load, the lower the connection weight assigned. By comparing the performance configuration, number of connections and computing load of each gateway, the connection weights assigned by the performance configuration, number of connections and computing load of each gateway in the gateway cluster can be determined. The connection weights assigned by the performance configuration, number of connections and computing load can be accumulated to obtain the connection weight of each gateway in the gateway cluster. According to the connection weight, the initial connection order is adjusted to obtain the connection order between gateways in the gateway cluster. For example, the larger the connection weight of the gateway, the greater the priority of the connection service server of the gateway, and the higher the connection order. The connection weight of each gateway can be compared separately. Based on the comparison result, the initial connection order of the gateway is adjusted to obtain the connection order between gateways in the gateway cluster.

[0144] 205. Send the access ticket and gateway information to the service terminal, so that the service terminal accesses the service resource to be accessed through the gateway cluster.

[0145] The gateway information includes the connection sequence between gateways in the gateway cluster.

[0146] For example, the access ticket and gateway information may be directly sent to the service terminal, so that after receiving the access ticket and gateway information, the service terminal connects to the gateway in the gateway cluster through the access proxy, obtains the service resources to be accessed returned by the gateway, and accesses the service resources to be accessed.

[0147] Optionally, the service resource access request sent by the service terminal may also carry process information of the access process. The second service resource access device may also detect the access process. Therefore, the service resource access method further includes:

[0148] According to the preset detection strategy, the process information of the access process is detected to determine the type of the access process. When the access process is a malicious process, a prompt message is sent to the business terminal, so that the business terminal terminates the access to the business resource to be accessed.

[0149] For example, after receiving the process information of the access process, the second business resource access device can perform detection according to the preset detection strategy to determine the type of the access process. It can also periodically send file inspection requests to the threat intelligence cloud check service or various anti-virus engines. The file inspection request carries the process information of the access process. Then, it receives the detection results returned by the threat intelligence cloud check service or various anti-virus engines, and determines the type of the access process based on the detection results. When the access process is a malicious process, a prompt message is sent to the business terminal to prompt the business terminal that the access process is a malicious process. After the business terminal determines that the access process is a malicious process, it stops accessing the business resources to be accessed. Specifically, it can be as follows: Fig.13 shown.

[0150] As can be seen from the above, this embodiment receives a business resource access request sent by a business terminal, and the business resource access request carries a resource identifier and access information of the business resource to be accessed. According to the access information, an access ticket for the business resource to be accessed is generated, and the gateway configuration information corresponding to the resource identifier is obtained. The gateway configuration information includes candidate gateways and the connection order of the candidate gateways. According to the identity information, the gateway cluster used to access the business resource to be accessed and the initial connection order between the gateways in the gateway cluster are determined in the gateway configuration information. According to the current connection information of the gateway cluster, the initial connection order is adjusted to obtain the connection order between the gateways in the gateway cluster, and the access ticket and the gateway information are sent to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster. The gateway information includes the connection order between the gateways in the gateway cluster. Since the scheme can adjust the initial connection order between the gateways in the gateway cluster according to the current connection information of the gateway cluster, thereby reducing the connection delay of connecting to the gateways in the gateway cluster, the access efficiency of business resource access can be greatly improved.

[0151] According to the method described in the above embodiment, the following is further described in detail with examples.

[0152] In this embodiment, the first business resource access device is integrated in the business terminal, and the business terminal may include an access client and a proxy client. The second business resource access device is integrated in the access server. The administrator configures the business resource access policy by configuring the terminal to connect to the access server. The business resource access policy includes gateway configuration and resource configuration information. After the configuration is completed, based on the access policy, the business terminal accesses the business resources to be accessed through the access client and the proxy client. The application scenario of accessing business resources can be illustrated by taking zero-trust office as an example.

[0153] (I) Configure terminal configuration access policy.

[0154] S1. Configure the terminal and gateway configuration information.

[0155] For example, the configuration terminal displays a gateway configuration page, which includes a gateway add control and may also include gateway information that has been added. In response to a trigger operation for adding a gateway control, a gateway edit page is displayed on the configuration terminal, which includes a gateway parameter input control and a confirmation control. The gateway name, gateway setting parameters, and the local IP address range for permitted access corresponding to the gateway that are input through the gateway parameter input control are obtained. In response to a trigger operation for the confirmation control, the gateway configuration page is returned. At this time, the gateway information that has been added in the gateway configuration page already includes the gateway added this time. Based on these gateways that have been added, the gateway information to be configured can be generated.

[0156] In some embodiments, according to the gateway information to be configured, the access server creates a resource configuration page in the configuration terminal. The resource parameter input interface may include multiple input interfaces, and the resource parameters may include the resource identifier of the resource to be accessed, the access category, and when the administrator selects the access category as IP, the type of IP may be selected, for example, it may be a specified IP or IP segment, and the resource parameters may also include the port information of the service terminal accessing the service resource to be accessed, etc. The gateway list may include information such as the gateway name and gateway address of all or part of the gateways that have been added in the gateway configuration page. The resource parameters entered in the resource parameter input interface and the gateway cluster selected in the gateway list are received. According to the gateway cluster, a gateway sorting page is created in the configuration terminal, and the gateway sorting page includes an ascending control and a descending control. In response to the administrator's triggering operation on the ascending control or the descending space, the initial connection order of each gateway in the gateway cluster can be determined, and the resource to be accessed corresponding to the resource identifier is associated with the gateway cluster, so that the gateway cluster corresponding to each resource to be accessed and the initial connection order between the gateways in the gateway cluster can be obtained, and these information are used as the gateway configuration information corresponding to the resource identifier.

[0157] S2. Configure the terminal to configure resource configuration information.

[0158] For example, according to the configured gateway configuration information, a resource management page is created in the configuration terminal. The resource management page may include an access user list and a permitted business resource list. The gateway configuration information corresponding to the permitted business resources in the permitted business resource list is sent as a business resource access policy to the access user or user group in the access user list, and the configuration of the resource configuration information can be completed. For example, the access user selected by the administrator in the access user list and the permitted business resource selected in the permitted business resource list are received. According to the identity information of the access user selected by the administrator, the permitted business resource corresponding to each identity information is determined. At this time, the business resources that each access user or access user group can access can be obtained, and this information is used as the resource configuration information corresponding to the access user or the identity information of the access user. The access server encrypts the gateway configuration information and resource configuration information as a business resource access policy through the configuration terminal and stores it locally in the access server. The business terminal can periodically send a configuration information acquisition request to the access server through the heartbeat service, and receive the gateway configuration information and the resource configuration information of the current access user periodically sent by the access server as a business resource access policy.

[0159] (ii) The business terminal accesses the business resources to be accessed through the access server and gateway cluster according to the business resource access policy.

[0160] like Fig.14 As shown, a method for accessing business resources, the specific process can be as follows:

[0161] 301. A service terminal sends a service resource access request to an access server.

[0162] For example, the business terminal generates a business resource access request through the access client trigger, and sends the business resource access request directly to the access server. When the information carried in the business resource access request is large in memory, the business terminal can also store the information carried in the business resource access request in a third-party database, add the storage address to the business resource access request, and send the business resource access request with the added storage address to the access server.

[0163] Optionally, before the business terminal sends a business resource access request to the access server, the access user can log in to the access client in the business terminal and can log in by scanning a QR code or the account and password process corresponding to the identity information. After successful login, the business terminal identifies the resource configuration information corresponding to the identity information in the resource configuration information, and displays the trusted software details issued by the administrator on the business terminal based on the resource configuration information. It can also display the resource configuration information such as business resources or business systems that the access user corresponding to the identity information can access through trusted software or applications on the business terminal. When the access user accesses the resource to be accessed through trusted software, the access client can be triggered to generate a business resource access request. At this time, the business resource access request can include access information of the business resource to be accessed. The business terminal determines the resource identifier of the business resource to be accessed and the process information of the access process through the access information, and adds the access information, resource identifier and process information to the business resource access information. The details can be as follows:

[0164] (1) The service terminal obtains access information of the service resource to be accessed, and identifies the identity information of the accessing user, the resource address of the service resource to be accessed, and the process identifier of the access process in the access information.

[0165] For example, when a user initiates a business resource access request for a resource to be accessed through a trusted application, the proxy client hijacks the business resource access request, initiates an authentication request to the access client to apply for an access ticket, and forwards the business resource access request to the access client. The access client obtains the access information carried in the business resource access request, identifies the access user's identity, source port, source IP or domain name in the access information as the access user's identity information, identifies the destination IP or domain name, and destination port in the access information as the resource address of the business resource to be accessed, and identifies the PID of the access process corresponding to the application in the access information as the process identifier.

[0166] (2) The service terminal determines the resource identifier of the service resource to be accessed based on the identity information and the resource address.

[0167] For example, the business terminal filters out the resource configuration information corresponding to the access user identity information in the business resource access policy, and the resource configuration information includes the business site corresponding to the business resource configured by the administrator and the accessible business resource information, and matches the destination IP, domain name or destination port of the business resource to be accessed with the destination IP, domain name or destination port of the business resource in the accessible business resource list. When the match is successful, the configuration information of the business site corresponding to the business resource is filtered out to obtain the ID corresponding to the successfully matched business resource. The configuration information of the business site corresponding to the business resource can be as follows:

[0168]

[0169] Among them, "areaid" identifies a unique business site corresponding to a business resource in a zero-trust business access policy. For example, in the above example, "areaid" is 1, which identifies the business site corresponding to the business resource named "tencent OA", and "areaid" is 2, which identifies the business site corresponding to the business resource named "internal pv". In a zero-trust business resource access policy, "areaid" are all different.

[0170] (3) The business terminal accesses the process information of the process based on the process ID.

[0171] For example, the business terminal collects the MD5 of the access process, the hash value of the access process, the process path, the last modification time of the process, copyright information, signature information and certificate chain details according to the process PID of the access process, and uses the collected process information as the process information of the access process.

[0172] (4) The business terminal adds access information, resource identification, and process information to the business resource access request.

[0173] For example, the business terminal can directly add access information, resource identification and process information to the business resource access request. When the access information, resource identification and process information memory is large, the access information, resource identification and process information can also be stored in a third-party database, and then the storage address is added to the business resource access request.

[0174] Among them, part of the code of the business resource access request after adding the access information, resource identifier and process information can be as follows:

[0175]

[0176]

[0177] 302. The access server receives a service resource access request sent by the service terminal.

[0178] For example, the access server can directly receive the business resource access request sent by the business terminal, and obtain the resource identifier and access information of the business resource to be accessed in the business resource access request. When the resource identifier and access information of the business resource to be accessed occupy a large amount of memory, the business terminal stores the resource identifier and access information of the business resource to be accessed in a third-party database, adds the storage address to the business resource access request, and the access server extracts the storage address from the received business resource access request, and obtains the resource identifier and access information of the business resource to be accessed in the third-party database based on the storage address.

[0179] 303. The access server generates an access ticket for the service resource to be accessed according to the access information, and obtains gateway configuration information corresponding to the resource identifier.

[0180] For example, the access server verifies the access information. After the verification is passed, the access credential of the business resource to be accessed corresponding to the access information and the number of accesses and access time limit of the access credential can be generated according to the preset access policy, and these can be used as the access ticket of the business resource to be accessed. According to the business resource access policy, the gateway configuration information corresponding to the resource identifier is filtered out from the gateway configuration information set. The gateway configuration information can be a specific candidate gateway list located by the resource identifier "areaid" and the connection order between the candidate gateways in the candidate gateway list.

[0181] 304. The access server determines, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information.

[0182] For example, the access server identifies the egress IP of the access user through the service terminal to access the service resource to be accessed in the identity information. Then, the gateway whose local address is in the accessible local address range configured in the gateway is selected from the candidate gateways as the gateway to access the service resource to be accessed. The gateway and the access server can be deployed in a cluster. Therefore, there are generally multiple gateways to access the service resource to be accessed, and these gateways can be formed into a gateway cluster. According to the connection order between the gateways in these gateway clusters by the administrator, the initial connection order between the gateways in the gateway cluster can be determined.

[0183] 305. The access server adjusts the initial connection sequence according to the current connection information of the gateway cluster to obtain the connection sequence between the gateways in the gateway cluster.

[0184] For example, the access server can obtain the number of connections and computing loads of the gateways in the gateway cluster that are currently connected to the business server, and can also obtain the performance configuration information such as the CPU model and memory performance of each gateway in the gateway cluster. The performance configuration information, number of connections and computing load between each gateway in the gateway cluster are compared respectively, and the connection weight of each gateway is allocated according to the comparison result. The allocation rule can be that the higher the performance configuration, the higher the connection weight allocated, the larger the number of connections, the lower the connection weight allocated, and the larger the computing load, the lower the connection weight allocated. The connection weight allocated by the performance configuration, number of connections and computing load is accumulated to obtain the connection weight of each gateway in the gateway cluster. The larger the connection weight of the gateway, the greater the priority of the gateway to connect to the business server, and the higher the connection order. The connection weight of each gateway can be compared respectively, and the initial connection order of the gateway is adjusted based on the comparison result to obtain the connection order between the gateways in the gateway cluster.

[0185] 306. The access server sends the access ticket and gateway information to the service terminal, so that the service terminal accesses the service resource to be accessed through the gateway cluster.

[0186] For example, the access server directly sends the access ticket and gateway information to the service terminal, so that after receiving the access ticket and gateway information, the service terminal connects to the gateway in the gateway cluster through the access proxy to obtain the service resources to be accessed returned by the gateway. The gateway information may include the connection order between gateways in the gateway cluster.

[0187] Optionally, the business resource access request may also carry the process information of the access process. Therefore, the detection can be performed according to the preset detection strategy to determine the type of the access process. It is also possible to regularly send a file inspection request to the threat intelligence cloud check service or various anti-virus engines. The file inspection request carries the process information of the access process. Then, the detection results returned by the threat intelligence cloud check service or various anti-virus engines are received, and the type of the access process is determined based on the detection results. When the access process is a malicious process, a prompt message is sent to the business terminal to prompt the business terminal that the access process is a malicious process. After the business terminal determines that the access process is a malicious process, it stops accessing the business resources to be accessed.

[0188] Optionally, the access server can also authenticate the access ticket sent by the gateway. When the access ticket is in normal status and is issued by the access server, it can be determined that the access ticket authentication is passed and the authentication is returned to the gateway. At this time, the gateway can connect to the business server.

[0189] 307. The service terminal receives the access ticket and gateway information corresponding to the resource identifier returned by the access server.

[0190] For example, the access client in the service terminal may directly receive the access ticket and the gateway information corresponding to the resource identifier returned by the access server, and return the access ticket and the gateway information as a ticket response to the proxy client in the service terminal.

[0191] 308. The service terminal obtains historical connection records of the gateway cluster within a preset time period.

[0192] For example, the access client obtains a set of historical connection records of all gateways from the proxy client, reads the gateway identifier or gateway address of the gateway in the gateway cluster from the gateway information, and filters out the historical connection record information of each gateway within a preset time period from the set of historical connection records of the gateway based on the gateway identifier or gateway address, such as whether the gateway is successfully connected to the business server and what the connection delay of the successfully connected gateway is, and uses this information as the historical connection record of the gateway cluster within the preset time period.

[0193] 309. The service terminal adjusts the connection sequence between gateways according to the historical connection records.

[0194] For example, the access client of the service terminal can extract the connection delay of the gateways in the gateway cluster from the historical connection records, sort the connection delays, obtain the connection delay sorting results of the gateways, and adjust the connection order between the gateways according to the connection delay sorting results, which can be as follows:

[0195] (1) The service terminal extracts the connection delay of the gateway in the gateway cluster from the historical connection records.

[0196] For example, the access client of the service terminal extracts the connection delay generated by the gateway connecting to the service server corresponding to the service resource to be accessed within 10 minutes, half an hour or other time period from the historical connection record. The connection delay can be the delay time from the gateway starting to connect to the service server to successfully connecting to the service server.

[0197] (2) The service terminal sorts the connection delays and obtains the connection delay sorting result of the gateway.

[0198] For example, the access client of the service terminal sorts the connection delay of the gateway according to the length of the connection delay. For example, taking the gateway cluster including three gateways A, B and C, the connection delay of gateway A is 50ms, the connection delay of gateway B is 10ms, and the connection delay of gateway C is 30ms, the connection delays of the three gateways are sorted in order of the shorter the connection delay, the higher the ranking. The connection delay sorting result of the gateways can be that the connection delay of gateway B ranks first, the connection delay of gateway C ranks second, and the connection delay of gateway A ranks third.

[0199] (3) The service terminal adjusts the connection sequence between gateways according to the connection delay sorting result.

[0200] For example, the access client of the service terminal determines the current connection ranking result of the gateway according to the connection order between the gateways in the gateway cluster, and merges the current connection ranking result and the connection delay ranking result. For example, the current connection ranking result and the connection delay ranking result are assigned coefficients in order from front to back. For example, the ranking coefficient corresponding to the first ranking is 1, the ranking coefficient corresponding to the second ranking is 2, and the ranking coefficient corresponding to the third ranking is 3. The ranking coefficients corresponding to the current connection ranking results and the connection delay ranking results of gateways A, B, and C are added together, and the sum of the ranking coefficients of gateways A, B, and C can be obtained respectively. The ranking coefficients of gateways A, B, and C are then sorted. For example, the lower the sum of the ranking coefficients, the higher the front, and the target connection ranking result of the gateway can be obtained. According to the target connection ranking result, the connection order between gateways is adjusted.

[0201] 310. The service terminal selects a target gateway from the gateway cluster according to the connection sequence adjusted by the gateway.

[0202] For example, the access client of the service terminal uses the gateway with the highest order in the connection sequence as the target gateway according to the connection sequence after the gateway adjustment. For example, if the connection sequence is gateway A-gateway B-gateway C, gateway A is used as the target gateway to connect to the service server first. If gateway A fails to connect successfully, gateway B is used as the target gateway. If gateway B still fails to connect successfully, gateway C is used as the target gateway.

[0203] 311. The service terminal sends an access ticket and a service resource access request to the target gateway to connect to the service server through the target gateway.

[0204] For example, the access client of the business terminal sends the gateway address of the target gateway to the proxy client. The proxy client first initiates an Https request to the access gateway, with a ticket in the credential information (Authorization) header field. After receiving the request, the target gateway parses the ticket in the header field and verifies the ticket with the access server. If the verification is successful, the access gateway successfully establishes a connection with the proxy client, and then the proxy client forwards the business resource access request to the target gateway. The target gateway forwards the business resource access request to the business server to connect to the business server. If the access ticket verification fails, the connection terminal between the proxy client and the target gateway is the access client that directly sends the business resource access request to the business server corresponding to the business resource to be accessed.

[0205] 312. When the target gateway is not connected to the business server, the business terminal returns to the step of selecting the target gateway from the gateway cluster according to the connection sequence adjusted by the gateway cluster until the target gateway is connected to the business server, and accesses the business resource to be accessed through the target gateway.

[0206] For example, taking a gateway cluster including gateway A, gateway B and gateway C, and the connection order between the three gateways is gateway A-gateway B-gateway C, when gateway A is not connected to the business server, return to the step of filtering out the target gateway in the gateway cluster, and use gateway B ranked second in the connection order as the target gateway to connect to the business server through gateway B. If gateway B is still not connected to the business server, gateway C ranked next to gateway B is used as the target gateway to connect to the business server until there is a gateway connected to the business server in the gateway cluster. When the target gateway is connected to the business server, the business server sends the resource to be accessed to the proxy client through the target gateway according to the business resource access request, and the proxy client forwards the resource to be accessed to the access client, thereby enabling the business terminal to access the resource to be accessed.

[0207] Optionally, when the target gateway is connected to the business server and accesses the resource to be accessed through the business server, the proxy client can also count the connection delay of the target gateway when the target gateway is connected to the business server. After the statistics are completed, the current connection delay information of the gateway cluster can be obtained. The proxy client sends the current connection delay information to the access client segment. The access client adds the current connection delay information of the gateway cluster that is connected to the business server in the historical connection record of the gateway cluster within the preset time period to update the historical connection record of the gateway cluster. When the same business server is connected through the gateway cluster next time, the current connection order between the gateways in the gateway cluster can be adjusted according to the updated historical connection record, and the business server corresponding to the business resource to be accessed can be connected through the gateway cluster according to the adjusted connection order.

[0208] As can be seen from the above, in the embodiment of the present invention, after the service terminal sends a service resource access request to the access server, and the service resource access request carries the resource identifier of the service resource to be accessed, the access server receives the service resource access request sent by the service terminal, and the service resource access request carries the resource identifier and access information of the service resource to be accessed. According to the access information, an access ticket for the service resource to be accessed is generated, and gateway configuration information corresponding to the resource identifier is obtained, the gateway configuration information includes candidate gateways and the connection order of the candidate gateways, and according to the identity information, the initial connection order between the gateway cluster used to access the service resource to be accessed and the gateways in the gateway cluster is determined in the gateway configuration information, and the initial connection order is adjusted according to the current connection information of the gateway cluster to obtain the gateway. The connection order between gateways in the cluster, the access ticket and gateway information are sent to the business terminal. After the business terminal receives the access ticket and gateway information corresponding to the resource identifier returned by the access server, the gateway information includes the connection order between gateways in the gateway cluster. Then, the historical connection records of the gateway cluster within a preset time period are obtained, and the connection order between gateways is adjusted according to the historical connection records. Based on the access ticket and the gateway cluster after the connection order is adjusted, the business resources to be accessed are accessed; since the scheme can dynamically adjust the connection order between gateways in the gateway cluster according to the current connection information and historical connection records of the gateway cluster, thereby reducing the connection delay of connecting to the business server through the gateway in the gateway cluster, the access efficiency of business resource access can be greatly improved.

[0209] In order to better implement the above method, an embodiment of the present invention also provides a business resource access device (i.e., a first business resource access device), which can be integrated in a terminal, and the terminal can include a tablet computer, a laptop computer and / or a personal computer, etc.

[0210] For example, Fig.15 As shown, the first service resource access device may include a first sending unit 401, a first receiving unit 402, an acquiring unit 403, a first adjusting unit 404 and an accessing unit 405, as follows:

[0211] (1) a first sending unit 401;

[0212] The first sending unit 401 is configured to send a service resource access request to an access server, where the service resource access request carries a resource identifier of a service resource to be accessed.

[0213] For example, the first sending unit 401 may be specifically configured to receive a service resource access request generated by an access user through a client, and then directly send the service resource access request to the access server.

[0214] (2) a first receiving unit 402;

[0215] The first receiving unit 402 is configured to receive the access ticket and gateway information corresponding to the resource identifier returned by the access server, where the gateway information includes a connection sequence between gateways in the gateway cluster.

[0216] For example, the first receiving unit 402 may be specifically configured to directly receive the access ticket and gateway information corresponding to the resource identifier returned by the access server.

[0217] (3) Acquisition unit 403;

[0218] The acquisition unit 403 is used to acquire the historical connection records of the gateway cluster within a preset time period.

[0219] The acquisition unit 403 can be specifically used to obtain a set of historical connection records of all gateway connections from the access proxy device, read the gateway identifier or gateway address of the gateway in the gateway cluster from the gateway information, and filter out the historical connection record of each gateway within a preset time period from the set of historical connection records of the gateway based on the gateway identifier or gateway address.

[0220] (4) a first adjustment unit 404;

[0221] The first adjusting unit 404 is configured to adjust the connection sequence between gateways according to the historical connection records.

[0222] For example, the first adjustment unit 404 can be specifically used to extract the connection delays of gateways in the gateway cluster from the historical connection records, sort the connection delays, obtain the connection delay sorting results of the gateways, and adjust the connection order between the gateways according to the connection delay sorting results.

[0223] (5) access unit 405;

[0224] The access unit 405 is used to access the service resource to be accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0225] For example, access unit 405 can be specifically used to filter out a target gateway in the gateway cluster according to the connection order adjusted by the gateway cluster, send an access ticket and a business resource access request to the target gateway to connect to the business server through the target gateway. When the target gateway is not connected to the business server, return to the step of filtering out the target gateway in the gateway cluster according to the connection order adjusted by the gateway cluster until the target gateway is connected to the business server, and access the business resources to be accessed through the target gateway.

[0226] In specific implementation, the above units can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units can refer to the previous method embodiments, which will not be repeated here.

[0227] From the above, it can be seen that in this embodiment, after the first sending unit 401 sends a business resource access request to the access server, the business resource access request carries the resource identifier of the business resource to be accessed, and the first receiving unit 402 receives the access ticket returned by the access server and the gateway information corresponding to the resource identifier, and the gateway information includes the connection order between gateways in the gateway cluster. Then, the acquisition unit 403 obtains the historical connection records of the gateway cluster within a preset time period, and the first adjustment unit 404 adjusts the connection order between gateways according to the historical connection records. The access unit 405 accesses the business resource to be accessed based on the access ticket and the gateway cluster after the connection order is adjusted; because this scheme can dynamically adjust the connection order between gateways in the gateway cluster according to the historical connection records of the gateway cluster, thereby reducing the connection delay of connecting to the business server through the gateways in the gateway cluster, and therefore, the access efficiency of business resource access can be greatly improved.

[0228] In order to better implement the above method, an embodiment of the present invention also provides a business resource access device (ie, a second business resource access device), which can be integrated in a server, which can be a single server or a server cluster composed of multiple servers.

[0229] For example, Fig.16 As shown, the second service resource access device may include a second receiving unit 501, a generating unit 502, a determining unit 403, a second adjusting unit 504 and a second sending unit 505, as follows:

[0230] (1) a second receiving unit 501;

[0231] The second receiving unit 501 is configured to receive a service resource access request sent by a service terminal, where the service resource access request carries a resource identifier and access information of a service resource to be accessed.

[0232] For example, the second receiving unit 501 may be specifically configured to directly receive a service resource access request sent by a service terminal, and obtain the resource identifier and access information of the service resource to be accessed carried in the service resource access request.

[0233] (2) generating unit 502;

[0234] A generating unit 502 is used to generate an access ticket for a service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier, the gateway configuration information including candidate gateways and a connection order of the candidate gateways;

[0235] For example, the generation unit 502 can be specifically used to verify the access information. After the verification is passed, the access credentials of the business resources to be accessed, the number of accesses of the access credentials, and the access time limit, etc. corresponding to the access information can be generated according to the preset access policy. These can be used as access tickets for the business resources to be accessed. In addition, according to the preset access policy, the gateway configuration information corresponding to the resource identifier can be filtered out in the gateway configuration information set.

[0236] (3) determining unit 503;

[0237] The determining unit 503 is used to determine, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information.

[0238] For example, determination unit 503 can be specifically used to identify the local address of the service terminal in the identity information, and select the gateway whose local address is in the accessible local address range configured in the gateway from the candidate gateways as the gateway for accessing the service resources to be accessed, and the initial connection order between the gateways in the gateway cluster can be determined according to the connection order between the gateways in the gateway cluster configured by the administrator.

[0239] (4) a second adjustment unit 504;

[0240] The second adjusting unit 504 is configured to adjust the initial connection sequence according to the current connection information of the gateway cluster to obtain a connection sequence between gateways in the gateway cluster.

[0241] For example, the second adjustment unit 504 can be specifically used to obtain the current connection information of the gateway cluster and the performance configuration information of the gateways in the gateway cluster, determine the connection weight of the gateway based on the performance configuration information, the number of connections and the load information, and adjust the initial connection order based on the connection weight to obtain the connection order between the gateways in the gateway cluster.

[0242] (5) a second sending unit 505;

[0243] The second sending unit 505 is used to send the access ticket and gateway information to the service terminal, so that the service terminal accesses the service resource to be accessed through the gateway cluster. The gateway information includes the connection sequence between gateways in the gateway cluster.

[0244] For example, the second sending unit 505 can be specifically used to directly send the access ticket and gateway information to the business terminal, so that after receiving the access ticket and gateway information, the business terminal connects to the gateway in the gateway cluster through the access proxy, obtains the business resources to be accessed returned by the gateway, and accesses the business resources to be accessed.

[0245] Optionally, the second service resource access device may further include a configuration unit 506, such as Fig.17 As shown, the details are as follows:

[0246] The configuration unit 506 is used to configure a preset access policy through a configuration terminal. The preset access policy may include gateway configuration information and resource configuration information.

[0247] For example, the configuration unit 506 can be specifically used to display a gateway configuration page on the configuration terminal, the gateway configuration page includes an add gateway control, and in response to a trigger operation for adding a gateway control, display a gateway editing page on the configuration terminal, the gateway editing page includes a gateway parameter input control, obtain the gateway parameters input through the gateway input parameter control to generate the gateway information to be configured, use the service resources to be accessed corresponding to the resource identifier to configure the gateway information to be configured, and obtain the gateway configuration information corresponding to the resource identifier. According to the gateway configuration information, create a resource management page on the configuration terminal, the resource management page includes an access user list and a permitted service resource list corresponding to the gateway configuration information, receive an access user selected in the access user list and a permitted service resource selected in the permitted service resource list, match the identity information of the access user with the permitted service resource to obtain the resource configuration information corresponding to the identity information, and send the resource configuration information to the service terminal.

[0248] Optionally, the second service resource access device may further include a detection unit 507, such as Fig.18 As shown, the specific details can be as follows:

[0249] The detection unit 507 is used to detect the process information of the access process to determine the type of the access process.

[0250] For example, the detection unit 507 can be specifically used to detect the process information of the access process according to a preset detection strategy to determine the type of the access process. When the access process is a malicious process, a prompt message is sent to the business terminal so that the business terminal terminates access to the business resources to be accessed.

[0251] As can be seen from the above, in this embodiment, after the second receiving unit 501 receives the business resource access request sent by the business terminal, the business resource access request carries the resource identifier and access information of the business resource to be accessed, and the generating unit 502 generates an access ticket for the business resource to be accessed according to the access information, and obtains the gateway configuration information corresponding to the resource identifier, the gateway configuration information includes the candidate gateway and the connection order of the candidate gateway, and according to the identity information, the determining unit 503 determines the gateway cluster used to access the business resource to be accessed and the initial connection order between the gateways in the gateway cluster in the gateway configuration information, the second adjusting unit 504 adjusts the initial connection order according to the current connection information of the gateway cluster, and obtains the connection order between the gateways in the gateway cluster, and the second sending unit 505 sends the access ticket and the gateway information to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster, and the gateway information includes the connection order between the gateways in the gateway cluster. Since the scheme can adjust the initial connection order between the gateways in the gateway cluster according to the current connection information of the gateway cluster, and reduce the connection delay of connecting the gateway in the gateway cluster to the business server, the access efficiency of the business resource access can be greatly improved.

[0252] The embodiment of the present invention further provides an electronic device, such as Fig.19 As shown, it shows a schematic diagram of the structure of an electronic device involved in an embodiment of the present invention, specifically:

[0253] The electronic device may include components such as a processor 601 with one or more processing cores, a memory 602 with one or more computer-readable storage media, a power supply 603, and an input unit 604. Those skilled in the art will appreciate that Fig.19 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0254] The processor 601 is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 602, and calling data stored in the memory 602, the processor 601 performs various functions of the electronic device and processes data, thereby performing overall detection of the electronic device. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 601.

[0255] The memory 602 can be used to store software programs and modules. The processor 601 executes various functional applications and data processing by running the software programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.

[0256] The electronic device also includes a power supply 603 for supplying power to each component. Preferably, the power supply 603 can be logically connected to the processor 601 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 603 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0257] The electronic device may further include an input unit 604, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0258] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 601 in the electronic device will load the executable files corresponding to the processes of one or more application programs into the memory 402 according to the following instructions, and the processor 601 will run the application programs stored in the memory 602, thereby realizing various functions, as follows:

[0259] A business resource access request is sent to an access server, where the business resource access request carries a resource identifier of the business resource to be accessed; an access ticket and gateway information corresponding to the resource identifier are received from the access server, where the gateway information includes a connection sequence between gateways in a gateway cluster; historical connection records of the gateway cluster within a preset time period are obtained; the connection sequence between gateways is adjusted according to the historical connection records; and the business resource to be accessed is accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0260] or

[0261] A business resource access request sent by a business terminal is received, the business resource access request carries a resource identifier and access information of a business resource to be accessed, an access ticket for the business resource to be accessed is generated according to the access information, and gateway configuration information corresponding to the resource identifier is obtained, the gateway configuration information includes candidate gateways and a connection sequence of the candidate gateways, a gateway cluster for accessing the business resource to be accessed and an initial connection sequence between gateways in the gateway cluster are determined in the gateway configuration information according to the identity information, the initial connection sequence is adjusted according to the current connection information of the gateway cluster, the connection sequence between gateways in the gateway cluster is obtained, the access ticket and the gateway information are sent to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

[0262] The specific implementation of the above operations can be found in the previous embodiments and will not be described in detail here.

[0263] From the above, it can be seen that after the embodiment of the present invention sends a business resource access request to the access server, the business resource access request carries the resource identifier of the business resource to be accessed, receives the access ticket returned by the access server and the gateway information corresponding to the resource identifier, and the gateway information includes the connection order between the gateways in the gateway cluster. Then, the historical connection records of the gateway cluster within a preset time period are obtained, and the connection order between the gateways is adjusted according to the historical connection records. Based on the access ticket and the gateway cluster after the connection order is adjusted, the business resource to be accessed is accessed; because the scheme can dynamically adjust the connection order between the gateways of the gateway cluster according to the historical connection records of the gateway cluster, thereby reducing the connection delay of connecting to the business server through the gateways in the gateway cluster, the access efficiency of business resource access can be greatly improved.

[0264] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0265] To this end, an embodiment of the present invention provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any of the service resource access methods provided in the embodiments of the present invention. For example, the instructions can execute the following steps:

[0266] A business resource access request is sent to an access server, where the business resource access request carries a resource identifier of the business resource to be accessed; an access ticket and gateway information corresponding to the resource identifier are received from the access server, where the gateway information includes a connection sequence between gateways in a gateway cluster; historical connection records of the gateway cluster within a preset time period are obtained; the connection sequence between gateways is adjusted according to the historical connection records; and the business resource to be accessed is accessed based on the access ticket and the gateway cluster after the connection sequence is adjusted.

[0267] or

[0268] A business resource access request sent by a business terminal is received, the business resource access request carries a resource identifier and access information of a business resource to be accessed, an access ticket for the business resource to be accessed is generated according to the access information, and gateway configuration information corresponding to the resource identifier is obtained, the gateway configuration information includes candidate gateways and a connection sequence of the candidate gateways, a gateway cluster for accessing the business resource to be accessed and an initial connection sequence between gateways in the gateway cluster are determined in the gateway configuration information according to the identity information, the initial connection sequence is adjusted according to the current connection information of the gateway cluster, the connection sequence between gateways in the gateway cluster is obtained, the access ticket and the gateway information are sent to the business terminal, so that the business terminal accesses the business resource to be accessed through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

[0269] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0270] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0271] Since the instructions stored in the computer-readable storage medium can execute the steps in any business resource access method provided in the embodiments of the present invention, the beneficial effects that can be achieved by any business resource access method provided in the embodiments of the present invention can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0272] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above-mentioned business resource access or business resource access configuration.

[0273] The above is a detailed introduction to a business resource access method, device and computer-readable storage medium provided in an embodiment of the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for accessing business resources, characterized in that: Applied to business terminals, including: Sending a service resource access request to an access server, wherein the service resource access request carries a resource identifier of a service resource to be accessed; Receiving the access ticket returned by the access server and the gateway information corresponding to the resource identifier, wherein the gateway information includes a connection sequence between gateways in a gateway cluster; Obtaining the historical connection records of the gateway cluster within a preset time period, including: obtaining a historical connection record set of all gateway connections from an access proxy device, reading a gateway identifier or a gateway address of a gateway in the gateway cluster from the gateway information, and filtering out a historical connection record of each gateway within the preset time period from the historical connection record set of the gateway according to the gateway identifier or the gateway address, wherein the historical connection record includes a connection delay of the gateway in the gateway cluster; According to the historical connection records, adjusting the connection sequence between the gateways; According to the adjusted connection order of the gateways, a target gateway is selected from the gateway cluster, where the target gateway is a gateway connected to a service server corresponding to the service resource to be accessed; Sending an access ticket and a service resource access request to the target gateway to connect to the service server through the target gateway; When the target gateway is not connected to the business server, return to the step of selecting a target gateway from the gateway cluster according to the connection order adjusted according to the gateway cluster until the target gateway is connected to the business server, and access the business resource to be accessed through the target gateway.

2. The service resource access method according to claim 1, characterized in that: The step of adjusting the connection sequence between the gateways according to the historical connection record includes: Extracting the connection delay of the gateways in the gateway cluster from the historical connection records; Sorting the connection delays to obtain a connection delay sorting result of the gateway; According to the connection delay sorting result, the connection sequence between the gateways is adjusted.

3. The service resource access method according to claim 2, characterized in that: The step of adjusting the connection sequence between the gateways according to the connection delay sorting result includes: Determining a current connection sorting result of the gateway according to a connection sequence between gateways in the gateway cluster; Merging the current connection sorting result and the connection delay sorting result to obtain the target connection sorting result of the gateway; The connection sequence between the gateways is adjusted according to the target connection sorting result.

4. The service resource access method according to claim 1, characterized in that: After accessing the service resource to be accessed through the target gateway, the method further includes: Collecting statistics on the connection delay between the target gateway and the service server to obtain current connection delay information of the gateway cluster; The historical connection records of the gateway cluster are updated according to the current connection delay information.

5. The service resource access method according to claim 1, characterized in that: Before sending the service resource access request to the access server, the method further includes: Acquire access information of the service resource to be accessed, and identify the identity information of the accessing user, the resource address of the service resource to be accessed, and the process identifier of the access process in the access information; Determine the resource identifier of the service resource to be accessed according to the identity information and the resource address; Based on the process identifier, collecting process information of the access process; The access information, resource identifier and process information are added to the business resource access request.

6. The service resource access method according to claim 5, characterized in that: The determining, according to the identity information and the resource address, the resource identifier of the service resource to be accessed includes: Obtain resource configuration information corresponding to the identity information; Parsing the resource configuration information to obtain the licensed business resource information corresponding to the identity information; When the permitted service resource information includes the resource address, the resource identifier of the service resource to be accessed is screened out from the permitted service resource information.

7. A method for accessing business resources, characterized in that: Applicable to access the server, including: Receiving a service resource access request sent by a service terminal, wherein the service resource access request carries a resource identifier and access information of a service resource to be accessed; Generate an access ticket for the service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier, wherein the gateway configuration information includes candidate gateways and a connection order of the candidate gateways; Determining, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster according to the identity information; According to the current connection information of the gateway cluster, the initial connection sequence is adjusted to obtain the connection sequence between the gateways in the gateway cluster; The access ticket and gateway information are sent to the service terminal, so that the service terminal accesses the service resource to be accessed through the gateway cluster, wherein the gateway information includes a connection sequence between gateways in the gateway cluster.

8. The service resource access method according to claim 7, characterized in that: The adjusting the initial connection sequence according to the current connection information of the gateway cluster to obtain the connection sequence between gateways in the gateway cluster includes: Obtaining current connection information of the gateway cluster and performance configuration information of gateways in the gateway cluster; Reading the number of connections and load information of the gateway in the current connection information, and determining the connection weight of the gateway according to the performance configuration information, the number of connections and the load information; The initial connection sequence is adjusted according to the connection weights to obtain a connection sequence between gateways in the gateway cluster.

9. The service resource access method according to claim 7, characterized in that: Before obtaining the gateway configuration information corresponding to the resource identifier, the method further includes: Displaying a gateway configuration page on the configuration terminal, the gateway configuration page including adding a gateway control; In response to a trigger operation for adding a gateway control, displaying a gateway editing page on the configuration terminal, the gateway editing page including a gateway parameter input control; Obtaining gateway parameters input through the gateway input parameter control to generate gateway information to be configured; The to-be-configured gateway information is configured using the to-be-accessed service resource corresponding to the resource identifier to obtain the gateway configuration information corresponding to the resource identifier.

10. The service resource access method according to claim 9, characterized in that: The configuring the to-be-configured gateway configuration by using the to-be-accessed service resource corresponding to the resource identifier to obtain the gateway configuration information corresponding to the resource identifier includes: According to the gateway information to be configured, creating a resource configuration page in the configuration terminal, the resource configuration page including a resource parameter input interface and a gateway list corresponding to the gateway information to be configured; Receiving resource parameters entered by the resource parameter entry interface and a gateway cluster selected from the gateway list, the resource parameters including the resource identifier; According to the gateway cluster, creating a gateway sorting page in the configuration terminal, the gateway sorting page including sorting controls of gateways in the gateway cluster; In response to a trigger operation on the sorting control, determining an initial connection order between gateways in the gateway cluster; According to the initial connection sequence between the gateways, the to-be-accessed service resources corresponding to the resource identifiers are configured to obtain gateway configuration information corresponding to the resource identifiers.

11. The service resource access method according to claim 9, characterized in that: The method further comprises: configuring the to-be-configured gateway information by using the to-be-accessed service resource corresponding to the resource identifier, and obtaining the gateway configuration information corresponding to the resource identifier; Creating a resource management page in the configuration terminal according to the gateway configuration information, the resource management page including an access user list and a list of permitted service resources corresponding to the gateway configuration information; Receiving an access user selected in the access user list and a permitted service resource selected in the permitted service resource list; The identity information of the accessing user is matched with the permitted service resources to obtain resource configuration information corresponding to the identity information, and the resource configuration information is sent to the service terminal.

12. The service resource access method according to claim 7, characterized in that: The service resource access request also carries process information of the access process, and also includes: According to a preset detection strategy, the process information of the access process is detected to determine the type of the access process; When the access process is a malicious process, a prompt message is sent to the service terminal, so that the service terminal terminates the access to the service resource to be accessed.

13. A service resource access device, characterized in that: include: A first sending unit, configured to send a service resource access request to an access server, wherein the service resource access request carries a resource identifier of a service resource to be accessed; A first receiving unit, configured to receive the access ticket returned by the access server and the gateway information corresponding to the resource identifier, wherein the gateway information includes a connection sequence between gateways in a gateway cluster; An acquisition unit, used to acquire the historical connection records of the gateway cluster within a preset time period, including: acquiring a historical connection record set of all gateway connections from an access proxy device, reading a gateway identifier or a gateway address of a gateway in the gateway cluster from the gateway information, and filtering out a historical connection record of each gateway within the preset time period from the historical connection record set of the gateway according to the gateway identifier or the gateway address, wherein the historical connection record includes a connection delay of the gateway in the gateway cluster; A first adjusting unit, configured to adjust the connection sequence between the gateways according to the historical connection record; An access unit is used to filter out a target gateway in the gateway cluster according to the connection order adjusted by the gateway, the target gateway being a gateway connected to a business server corresponding to the business resource to be accessed, and to send an access ticket and a business resource access request to the target gateway to connect to the business server through the target gateway. When the target gateway is not connected to the business server, the step of filtering out the target gateway in the gateway cluster according to the connection order adjusted by the gateway cluster is returned until the target gateway is connected to the business server, and the business resource to be accessed is accessed through the target gateway.

14. A service resource access device, characterized in that: include: A second receiving unit, configured to receive a service resource access request sent by a service terminal, wherein the service resource access request carries a resource identifier and access information of a service resource to be accessed; A generating unit, configured to generate an access ticket for the service resource to be accessed according to the access information, and obtain gateway configuration information corresponding to the resource identifier, wherein the gateway configuration information includes candidate gateways and a connection order of the candidate gateways; A determination unit, for determining, in the gateway configuration information, a gateway cluster for accessing the service resource to be accessed and an initial connection sequence between gateways in the gateway cluster, for the identity information; A second adjustment unit, configured to adjust the initial connection sequence according to the current connection information of the gateway cluster to obtain a connection sequence between gateways in the gateway cluster; The second sending unit is used to send the access ticket and gateway information to the service terminal, so that the service terminal accesses the to-be-accessed service resource through the gateway cluster, and the gateway information includes a connection sequence between gateways in the gateway cluster.

15. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to execute the steps in the business resource access method according to any one of claims 1 to 12.

16. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps in the business resource access method according to any one of claims 1 to 12 are implemented.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the service resource access method according to any one of claims 1 to 12.

Images