Proxy service processing method, system

Abstract

The embodiment of the present application relates to the technical field of Internet, and discloses a proxy service processing method and system.In the present application, the proxy service processing method comprises the following steps: a second proxy server receives an access request sent by a user equipment, and the access request carries identity information of the user equipment; the second proxy server redirects the access request to a first proxy server according to the identity information, wherein the identity information is generated by the first proxy server; the second proxy server receives a response message of the access request returned by the first proxy server, and returns the response message to the user equipment.The proxy service processing method can improve the availability of the proxy service.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Internet technology, and in particular to a proxy service processing method and system. Background Technology

[0002] A proxy server, also simply called a proxy, is an intermediary between a personal network and an Internet service provider. Figuratively speaking, it's a relay station for network information, responsible for forwarding legitimate network information and controlling and registering the forwarding. As an intermediary program that acts as both a server and a client, a proxy server is primarily used to forward network access requests from client systems. However, a proxy server doesn't simply forward requests to the real Internet server; it can also identify users and, for the security of web applications, hide the application's original domain name through domain name substitution.

[0003] However, in order to achieve domain name replacement, each proxy server has a mapping table between the proxy domain name and the original domain name. Since the mapping table stored on each proxy server may be different, if a user requests a different proxy server, the domain name replacement may be incorrect, resulting in the request not responding normally. Therefore, the availability of the proxy service is low. Summary of the Invention

[0004] The purpose of this invention is to provide a proxy service processing method and system that can improve the availability of proxy services.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a proxy service processing method, comprising: a second proxy server receiving an access request sent by a user equipment, the access request carrying the user equipment's identification information; the second proxy server redirecting the access request to a first proxy server based on the identification information, wherein the identification information is generated by the first proxy server; and the second proxy server receiving a response message of the access request returned by the first proxy server and returning the response message to the user equipment.

[0006] Embodiments of the present invention also provide a proxy service processing system, including a first proxy server and a second proxy server; wherein, the second proxy server is used to receive an access request sent by a user equipment, the access request carrying the user equipment's identity identification information, the second proxy server redirects the access request to the first proxy server according to the identity identification information, receives the response message of the access request returned by the first proxy server, and returns the response message to the user equipment; the first proxy server is used to generate identity identification information.

[0007] The proxy service processing method of the present invention receives access requests sent by user equipment through a second proxy server. Since the access request carries the user equipment's identity information, which is generated by a first proxy server and used to verify the user equipment's access permissions to the application, there is a corresponding relationship between the identity information and the first proxy server. The second proxy server can redirect the access request to the first proxy server based on the identity information. The first proxy server verifies the access request and provides proxy service processing. The second proxy server receives the response message of the access request returned by the first proxy server and returns the response message to the user equipment. Therefore, even if the access request is assigned to any proxy server in the proxy service system, it can be redirected to the first proxy server that generated its identity information for proxy service processing, thereby responding to the user's access request. This reduces the situation where the user equipment has to log in again on the second proxy server or the request cannot be responded to, thus improving the availability of the proxy service.

[0008] Furthermore, the generation of identity information by the first proxy server includes: the first proxy server receiving a login request sent by the user device, verifying the login request, and generating identity information for the user device if the verification passes. In this application, by receiving a login request sent by the user device, verifying the login request, and if the verification passes, the first proxy server generates identity information for the user device. This identity information can be used to verify the user device's access permissions to the application when the user device initiates an access request. When the login request verification fails, the first proxy server does not generate identity information for this user device. In this case, the user device is an unverified device, and subsequent access requests from this user device will not be redirected to the first proxy server. Thus, the security of the proxy service processing is ensured through login request verification.

[0009] In addition, after generating identity information for the user equipment, the first proxy server also sends the first IP address and identity information corresponding to its own server to the identity database, so that the identity database can receive and store the first IP address and identity information accordingly. The second proxy server redirects the access request to the first proxy server according to the identity information, including: the second proxy server redirects the access request to the first proxy server according to the identity information and the first IP address obtained in advance from the identity database. In this application, the first proxy server also sends the first IP address and identity information corresponding to its own server to the identity database, so that the identity database can receive and store the first IP address and identity information accordingly. The second proxy server can redirect the access request to the first proxy server according to the identity information and the first IP address obtained in advance from the identity database. Since the IP address and the corresponding identity information are stored in the identity database, the second proxy server can query the first IP address of the first proxy server corresponding to the identity information, and at the same time, it is convenient to maintain the correspondence between identity information and IP address, thereby improving the processing efficiency of the proxy service.

[0010] Furthermore, after obtaining the first IP address from the identity database, the second proxy server also associates and stores the first IP address with identity information locally. The second proxy server obtains the first IP address pre-obtained from the identity database in the following way: the second proxy server obtains the first IP address based on the identity information and the mapping relationship between the identity information and the first IP address stored locally. In this application, after obtaining the first IP address from the identity database, the second proxy server associates and stores the first IP address with identity information locally. Therefore, when it is necessary to obtain the first IP address based on the identity information, it is not necessary to query the identity database again; a query can be performed locally to redirect the access request, saving identity database query resources of the proxy service system.

[0011] In addition, the identity database periodically or in real-time probes the service status of the first proxy server based on the first IP address; the second proxy server confirms the service status of the first proxy server by: obtaining the probe results from the identity database based on the first IP address; and confirming the service status of the first proxy server based on the probe results to ensure that the first proxy server is in a normal state before the access request is reset. In this application, by having the identity database probe the service status, the second proxy server does not need to probe the service status of the first proxy server, saving the computing resources and probe time consumed by the second proxy server in probing the first proxy server. These computing resources and probe time can then be used to provide other proxy services to user devices, thereby improving the service efficiency of the proxy service system.

[0012] Furthermore, after the verification is passed, the method further includes: the first proxy server generating a second proxy domain name for the user device's accessible applications, associating and storing the second proxy domain name with the pre-stored original domain name of the application, and returning the second proxy domain name and the identity information to the user device, so that the user device can generate the access request based on the second proxy domain name. In this application, the first proxy server generates a second proxy domain name for the user device's accessible applications, associates and stores the second proxy domain name with the pre-stored original domain name of the application, and returns the second proxy domain name and the identity information to the user device. This allows the user device to know the second proxy domain name and the identity information, enabling the user device to generate an access request for the second proxy domain name and carry the identity information in the access request. Subsequently, the association between the second proxy domain name and the pre-stored original domain name of the application can be used to determine the application that the access request actually wants to access, and the user device can verify whether it has access rights to the application based on the identity information.

[0013] Furthermore, after obtaining the response from the application corresponding to the original domain name, the method further includes: the first proxy server replacing the original domain name in the application's response with the domain name of the second proxy domain name associated with the original domain name, thereby obtaining the response message; the first proxy server returning the response message to the second proxy server. In this application, by having the first proxy server replace the original domain name in the application's response with the domain name of the second proxy domain name associated with the original domain name, and then returning the response message to the second proxy server, the first proxy server also provides proxy services for the application's response content. That is, the proxy services between the user device and the application's origin server are all handled by the first proxy server, which can further improve the availability of the proxy service. Attached Figure Description

[0014] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0015] Figure 1 This is a flowchart illustrating the steps of a proxy service processing method according to an embodiment of the present invention. Figure 1 ;

[0016] Figure 2 This is a flowchart illustrating the steps of a proxy service processing method according to an embodiment of the present invention. Figure 2 ;

[0017] Figure 3 This is a schematic diagram of the proxy service processing system structure provided according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details are presented in the various embodiments of the present invention to facilitate a better understanding of this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for ease of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined with and referenced by each other without contradiction.

[0019] Embodiments of the present invention relate to a proxy service processing method, such as... Figure 1 As shown, it includes:

[0020] Step 101: The second proxy server receives an access request sent by the user equipment, and the access request carries the user equipment's identity information.

[0021] Step 102: The second proxy server redirects the access request to the first proxy server based on the identity information, wherein the identity information is generated by the first proxy server.

[0022] Step 103: The second proxy server receives the response message of the access request returned by the first proxy server and returns the response message to the user equipment.

[0023] The proxy service processing method of the present invention is applied to a proxy service system. The proxy service system consists of numerous proxy servers and Domain Name System (DNS) servers. The user equipment and the application server to be accessed communicate through the proxy service system. After the request sent by the user equipment is resolved by the DNS server, the request is assigned to a proxy server in the proxy service system for processing. After the proxy server performs proxy processing (such as domain name replacement), the request is forwarded to the application.

[0024] With the rise of interactive web applications, these applications need to manage sessions and identify users. User identification can be achieved through cookies, session IDs, tokens, and other information. Web proxies (i.e., proxy servers) also use this information to identify users. For web application security, proxies can hide the application's original domain name through domain name replacement. To ensure proxy reliability, multiple proxies can be configured into a highly available system. However, this approach has the following problems:

[0025] 1) After a user logs in and authenticates on the proxy, the proxy will assign a corresponding cookie to each user's device. This cookie will only be stored on the proxy that the user is logged in to, and will not be stored on other proxies. Therefore, other proxies cannot identify the user through this cookie.

[0026] 2) In order to achieve application stealth, the origin domain name needs to be replaced with the proxy domain name. The proxy will have a mapping table between the proxy domain name and the origin domain name. The mapping table of each proxy may be different. Therefore, if the user requests a different proxy, a replacement error may occur, resulting in the request not responding normally.

[0027] The proxy service processing method in this embodiment receives access requests sent by user devices through a second proxy server. Since the access request carries the user device's identity information, which is generated by the first proxy server and used to verify the user device's access permissions to the application, there is a corresponding relationship between the identity information and the first proxy server. The second proxy server can redirect the access request to the first proxy server based on the identity information. The first proxy server verifies the access request and provides proxy service processing. The second proxy server receives the response message of the access request returned by the first proxy server and returns the response message to the user device. Therefore, even if the access request is assigned to any proxy server in the proxy service system, it can be redirected to the first proxy server that generated its identity information for proxy service processing, thereby responding to the user's access request. This reduces the situation where the user device has to log in again on the second proxy server or the request cannot be responded to, thus improving the availability of the proxy service.

[0028] The following details the implementation of the proxy service processing method in this application. The following content is only for the convenience of understanding and is not necessary for implementing this solution.

[0029] In step 101, the second proxy server receives an access request sent by the user device, which carries the user device's identity information. This identity information can be a cookie, session ID, token, or similar data. The identity is generated by the proxy server and can be used to identify the correspondence between the user device and the proxy server that generated it. It can also be used by the proxy server to verify the user device's access permissions to the application. The user device can be an electronic device such as a computer, mobile phone, or tablet.

[0030] A proxy service processing system includes at least a first proxy server and a second proxy server. Different proxy servers can be assigned to handle proxy services for different applications. When a DNS server receives an access request from a user device, it typically assigns a proxy server based on the IP address of the user device (e.g., based on geographical location, ISP, etc.). Since the user device's IP address may change with each request, the DNS server's proxy server assignment will also change accordingly. For example, an access request carrying identity information generated by the first proxy server might be assigned to the second proxy server. To distinguish between the proxy server that generated the identity information and the proxy server currently receiving the access request, both the first and second proxy servers are used. It can be understood that the first and second proxy servers are any one of the proxy servers in the proxy service processing system.

[0031] The access request sent by the user equipment carries the proxy domain name. The DNS server is configured with a mapping between the wildcard domain name of the proxy domain name and the IP address of the proxy server. For example, if the proxy domain name is b.com, then the wildcard domain name of the proxy domain name is *.b.com. When the user equipment initiates an access request, the DNS server resolves the proxy domain name according to the access request and returns a domain name resolution result carrying the IP address of the proxy server. The user equipment then sends the access request to the proxy server according to the IP address of the proxy server. For example, if the DNS server returns a second domain name resolution result carrying a second IP address, which is the IP address of a second proxy server, then the user equipment sends the access request to the second proxy server according to the second IP address.

[0032] In step 102, the second proxy server redirects the access request to the first proxy server based on the identity information, which is generated by the first proxy server. For example, the identity information is generated by the first proxy server when the user device first sends a request to the application (i.e., the application's origin server), and there is a corresponding relationship between the identity information and the first proxy server. The first proxy server is the proxy server assigned by the DNS server to handle this request when the user device first sends a request to the application. After receiving the access request, the first proxy server performs proxy processing on the access request and then sends it to the origin server. In one embodiment, after generating the identity information, the first proxy server can also synchronize the identity information to each proxy server in the proxy service system.

[0033] In one example, identity information is generated as follows: The first proxy server receives a login request from the user device, verifies the login request, and if the verification passes, generates identity information for the user device. The login request is the user's login request to the application, such as a username and password, or IP login. After successful verification, the first proxy server generates identity information for the user device, such as cookie information, and then returns the cookie information and the login response to the user device.

[0034] For web application security, proxy servers can hide the application's original domain name through domain name replacement. For example, the original domain name of application M might be a.com, which is not publicly disclosed. What is publicly disclosed is the proxy domain name (called the first proxy domain name), which is the domain name of the first proxy server, such as b.com. When a user device wants to access an application, that is, before sending a login request, it sends a domain name resolution request for the first proxy domain name, such as b.com, to the DNS server through its browser. The first proxy domain name is a pre-defined publicly disclosed proxy domain name for the application. For example, the first proxy domain name could be the official website homepage of application M, where application M is an application under the homepage. In response to this domain name resolution request, the DNS server returns a first domain name resolution result carrying a first IP address, which is the IP address of the first proxy server. The user device then sends the login request to the first proxy server based on the first IP address.

[0035] In this embodiment, by receiving and verifying a login request sent by a user device, if the verification passes, the first proxy server generates identity information for the user device. Conversely, if the verification fails, the first proxy server does not generate identity information for the user device, rendering it an unverified device. Subsequent access requests from this user device will not be redirected to the first proxy server. This ensures the security of the proxy service processing through login request verification. The identity information is used by the proxy server to verify whether the user device is already logged in and its access permissions to the application when the user device sends an access request to the proxy server.

[0036] In one example, after successful verification, the first proxy server generates a second proxy domain name for the user device's accessible applications. This second proxy domain name is then associated with and stored in conjunction with the pre-stored original domain name of the application. The second proxy domain name and identity information are returned to the user device, allowing the user device to generate an access request based on the second proxy domain name. The second proxy domain name can be the domain address corresponding to the page the user logs in to. For example, if the login page's domain name is the first proxy domain name b.com, then the second proxy domain name could be Xbcom. The user device can then obtain the next domain address selected by the user based on the logged-in page and generate a corresponding access request, which includes the second proxy domain name.

[0037] In this embodiment, the first proxy server generates a second proxy domain name for the user device's accessible applications, associates and stores the second proxy domain name with the pre-stored original domain name of the application, and returns the second proxy domain name and the identity information to the user device. The user device can then obtain the second proxy domain name and the identity information, and generate an access request for the second proxy domain name accordingly, carrying the identity information in the access request.

[0038] In one example, in response to an access request redirected to the first proxy server, the first proxy server confirms the user device's access permissions to the application based on the identity information, replaces the second proxy domain name carried in the access request with the original domain name, and obtains the response from the application corresponding to the original domain name.

[0039] The first proxy server can use pre-stored permission information to check whether the user using this user device has access permissions to the application corresponding to the access request. If so, it replaces the second proxy domain name carried in the access request with the original domain name and obtains the response from the application corresponding to the original domain name. If an unauthorized access message is received, the response indicates "no permission, access denied." If the user does not have access permissions to the application corresponding to the access request, an unauthorized access message is returned to the user, and the response indicates "no permission, access denied."

[0040] In this embodiment, by verifying the login request, the user device's identity can be verified once, ensuring that subsequent access requests are sent by a trusted user device, thereby guaranteeing access security. Confirming the user device's access permissions to the application based on the identity information allows for a second layer of permission authentication. By classifying permissions into levels and assigning different access ranges to different permissions, the access range of different user devices is further restricted, thus providing an additional layer of authentication during the access process. For example, only access requests sent by user devices granted access permissions can be proxied. Therefore, verification based solely on identity information is sufficient to ensure access security while saving the proxy server's computing resources. Replacing the second proxy domain name carried in the access request with the original domain name converts the second proxy domain name in the access request into an original domain name recognizable by the origin server, allowing the origin server to respond to the access request.

[0041] Furthermore, after obtaining the response from the application corresponding to the original domain name, the first proxy server replaces the original domain name in the application's response with the domain name of the second proxy domain name associated with the original domain name, and then obtains the response message. The first proxy server then returns the response message to the second proxy server.

[0042] In this embodiment, the first proxy server replaces the original domain name in the application's response with a second proxy domain name associated with the original domain name, obtaining a response message. The first proxy server then returns the response message to the second proxy server, which also provides proxy services for the application's response content. This means that the proxy service between the user device and the application's origin server is handled by the first proxy server, further improving the availability of the proxy service. In another embodiment, the application's response may contain other domain names besides the original domain name. The first proxy server not only replaces the original domain name but also dynamically generates corresponding new proxy domain names based on these other domain names. In other words, all domain names in the application's response are replaced with proxy domain names, facilitating proxy services for subsequent access to these domain names by the user device.

[0043] In one example, after generating identity information for the user device, the first proxy server also sends its corresponding first IP address and identity information to the identity database. The identity database receives and stores the first IP address and identity information accordingly. The second proxy server redirects access requests to the first proxy server based on the identity information in the following way: the second proxy server redirects access requests to the first proxy server based on the identity information and the first IP address obtained in advance from the identity database. The identity database can be a dedicated server in the proxy service system for storing identity information. The identity database can store the mapping between the IP address and identity information of each proxy server. A proxy server's IP address may correspond to one or more identity information entries, or it may not correspond to any identity information entry.

[0044] In this embodiment, the first proxy server also sends the first IP address and identity information corresponding to the server to the identity database, so that the identity database can receive and store the first IP address and identity information accordingly. The second proxy server can redirect the access request to the first proxy server according to the identity information and the first IP address obtained in advance from the identity database. Since the identity database stores IP addresses and corresponding identity information, the second proxy server can query the first IP address of the first proxy server corresponding to the identity information, and at the same time, it is convenient to maintain the correspondence between identity information and IP address, thereby improving the processing efficiency of the proxy service.

[0045] In one example, the second proxy server does not store the first IP address and identity information. Whenever the second proxy server needs to query the identity information and its corresponding proxy server IP address, it queries the identity database.

[0046] In another example, after obtaining the first IP address from the identity database, the second proxy server also associates the first IP address with identity information and stores it locally. The second proxy server obtains the first IP address pre-obtained from the identity database in the following way: based on the identity information, the second proxy server retrieves the first IP address from the locally stored mapping between identity information and the first IP address.

[0047] In this embodiment, after obtaining the first IP address from the identity database, the second proxy server associates the first IP address with the identity identification information and stores it locally. Therefore, when it is necessary to obtain the first IP address based on the identity identification information, it is not necessary to query the identity database again. Instead, it can query locally to redirect the access request, thus saving identity database query resources of the proxy service system.

[0048] In one example, before the second proxy server redirects the access request to the first proxy server based on the identity information, the second proxy server also checks the service status of the first proxy server. If the service status of the first proxy server is normal, the second proxy server redirects the access request to the first proxy server. If the service status of the first proxy server is abnormal, the second proxy server notifies the user device to log in again, and subsequently the second proxy server handles the user device's login request and access request.

[0049] For example, the second proxy server can send probe messages to the first proxy server before redirecting access requests to the first proxy server, or periodically send heartbeat packets with the first proxy server to probe the service status of the first proxy server.

[0050] In this embodiment, the second proxy server detects the status of the first proxy server before redirection. If the first proxy server is abnormal, it can directly notify the user device to log in again on the second proxy server, instead of ineffectively redirecting the access request to the first proxy server with an abnormal status. Therefore, it can reduce access latency caused by invalid redirection and improve access efficiency.

[0051] Furthermore, the identity database can periodically or in real-time probe the service status of the first proxy server based on the first IP address. When the second proxy server needs to confirm the service status of the first proxy server, it can obtain the probe results from the identity database based on the first IP address and confirm the service status of the first proxy server based on the probe results, so as to ensure that the first proxy server is in a normal state before the access request is reset.

[0052] In this embodiment, by detecting the service status through the identity database, the second proxy server does not need to detect the service status of the first proxy server, thus saving the computing resources and detection time consumed by the second proxy server in detecting the first proxy server. The second proxy server can then use these computing resources and detection time to provide other proxy services to the user device, thereby improving the service efficiency of the proxy service system.

[0053] In step 103, the second proxy server receives the response message of the access request returned by the first proxy server and returns the response message to the user equipment.

[0054] In one example, the proxy service system consists of a proxy server, a DNS server, and an identity database. The DNS server provides intelligent DNS services, while the proxy server includes a proxy module, a cookie storage module, a domain name mapping table, and a user permission module.

[0055] Specifically, the DNS server can be configured with the IP address of the proxy server corresponding to the proxy domain name, and can return the address of the nearest proxy server based on the IP address, geographical location, and ISP information of the user device carried in the request containing the proxy domain name corresponding to the application. The proxy module is used to proxy user requests and responses, verify user login information, authenticate the user's identity on the user device, and generate a cookie value for the user device as its identity identifier. When the proxy server receives an access request carrying a cookie not generated by its own proxy server, it will redirect the request to the proxy server corresponding to the cookie. It can also dynamically generate proxy domain names for the origin server based on user permissions, enabling application invisibility. The cookie storage module stores information such as the cookie, username, and expiration time corresponding to its own proxy server, as well as information such as the cookie, username, proxy IP, and expiration time corresponding to other proxy servers. The domain name mapping table stores the correspondence between proxy domain names and the original domain name of the application; the proxy module performs domain name replacement based on the domain name mapping table. It replaces the domain names in the messages received by the proxy server according to the domain name correspondence in the domain name mapping table. The user permission module stores the application access permissions for each user device; the proxy module determines whether a request sent by a user device is an unauthorized access based on user permissions. The identity database is used to store all user cookies, usernames, and their corresponding proxy service IPs; if a proxy service cannot find a cookie locally, it can look it up in the identity database.

[0056] To make the proxy service processing method of the present invention clearer, a specific embodiment is used for further explanation below, such as... Figure 2 As shown, the proxy service processing methods include:

[0057] Suppose the original domain name of application M is a.com, and the first proxy domain name is b.com. The first proxy domain name is publicly available, while the original domain name is hidden through the first proxy domain name. Users make requests and operations using their own devices.

[0058] Step 1: When a user enters the first proxy domain name https: / / b.com / login in their browser, a login request containing the first proxy domain name is sent. The browser will then send a domain name resolution request to the DNS server based on this request.

[0059] Step 2: The DNS server stores the IP addresses corresponding to the wildcard domain *.b.com of the first proxy domain, namely the first IP address (IP A1) of the first proxy server and the second IP address (IP A2) of the second proxy server. The DNS server assigns a nearby proxy server (based on geographical location, ISP, etc.), such as the first proxy server, based on the IP address of the user device sending the request, and then sends the first proxy server's IP address (IP A1) to the user.

[0060] Step 3: After the user's browser obtains the first IP address (IP A1), it will send the login request to the first proxy server.

[0061] Step 4: After receiving the login request, the proxy module of the first proxy server verifies the username and password carried in the request. If the verification is successful, a cookie value identifying the user's identity is generated as the user device's identity information, and the cookie value is sent to the cookie storage module of the first proxy server for storage; if the verification fails, a login error message is returned.

[0062] Step 5: After the cookie storage module of the first proxy server saves the user's cookie and username, it sends the username, cookie, and the IP address A1 of the first proxy server to the identity database.

[0063] Step 6: The proxy module of the first proxy server queries the user's permissions module to see if the user has permissions for application M, and then dynamically generates a second proxy domain name Xbcom for application M.

[0064] Step 7: The proxy module of the first proxy server stores the correspondence between Xbcom and a.com in the domain name mapping table.

[0065] Step 8: The proxy module of the first proxy server returns the second proxy domain name Xbcom of the M application and the user's cookie value to the user.

[0066] Step 9: When a user accesses the second proxy domain Xbcom of the M application, the browser will send a domain name resolution request to the DNS server.

[0067] Step 10: The DNS server assigns a nearby proxy server (based on geographical location, ISP, etc.) based on the IP address of the requesting user's device. Since the IP address of the user's device may change with each request, the DNS server's assignment result may change accordingly. For example, for the user's request to access application M, the DNS server responds to the user with the IP address A2 of the second proxy server.

[0068] Step 11: After the user's browser obtains the IP address A2 of the second proxy server, it sends the access request to the second proxy server.

[0069] Step 12: After receiving the access request, the proxy module of the second proxy server verifies the cookie value carried in the request by querying the cookie storage module of the second proxy server. If the cookie does not exist, it accesses the identity database to perform a cookie query.

[0070] Step 13: If the cookie is stored in the identity database, return the IP address A1 of the first proxy server corresponding to the cookie to the second proxy server; otherwise, return a message indicating that the cookie does not exist.

[0071] Step 14: If the proxy module of the second proxy server receives the IP address A1 of the first proxy server from the identity database, it can directly redirect the access request to the first proxy server. Simultaneously, it can store the cookie, username, and IP address A1 in the cookie storage module for quick subsequent retrieval, eliminating the need to access the identity database each time. If the identity database does not provide a result, it determines that the user is not logged in and returns a message to the user's device indicating that the user's identity information does not exist, prompting the user to log in again. Before redirecting the access request, the service status of the first proxy server can be determined based on the probe results. If the first proxy server malfunctions (downtime, network outage, etc.), the second proxy server will require the user to log in again. The probe can be initiated periodically or in real-time by the identity database, and the probe results can be sent synchronously when the identity database sends the IP address A1 of the first proxy server to the second proxy server.

[0072] Step 15: After receiving the redirected access request, the proxy module of the first proxy server checks the cookie carried in the request by querying the cookie storage module of the first proxy server. If the cookie exists, it returns the username corresponding to the cookie; if the cookie does not exist, it returns that the user identity information does not exist.

[0073] Step 16: The proxy module of the first proxy server obtains the correspondence between Xbcom and a.com, as well as the corresponding M application, by querying the domain name mapping table.

[0074] Step 17: The proxy module of the first proxy server queries the user permission module of the first proxy server. If it finds that the user has permission for application M, it returns success; otherwise, it returns unauthorized access.

[0075] Step 18: After receiving the success message, the proxy module of the first proxy server will replace the domain name, replacing Xbcom and a.com in the request, and then send the access request back to the origin (i.e., send it to the origin server of application M); if an unauthorized access message is received, the response will be that there is no permission and access is not possible.

[0076] Step 19: After the origin server responds to the request, the proxy module of the first proxy server replaces all the domain names in the response message (if there are other domain names besides a.com, the proxy module will dynamically generate new proxy domain names for these domain names and save them to the domain name mapping table), and returns the replaced message to the second proxy server, which then returns it to the user.

[0077] This embodiment employs a highly available proxy service processing system comprised of multiple proxy servers. Users log in to the nearest proxy server via DNS server domain name resolution. This proxy server contains user identity information and the mapping relationship between the origin server and the proxy. Subsequently, if a user request is routed to another proxy server, that server will redirect the request to the proxy server where the user logged in. If the currently logged-in proxy service malfunctions, other proxy servers will allow the user to log in again on that same proxy service. This embodiment's proxy system achieves high availability.

[0078] Embodiments of the present invention also relate to a proxy service processing system, such as... Figure 3 As shown, it includes:

[0079] First proxy server 301, second proxy server 302;

[0080] The second proxy server 302 is used to receive access requests sent by user equipment. The access requests carry the identity information of the user equipment. The second proxy server 302 redirects the access requests to the first proxy server 301 according to the identity information, receives the response message of the access request returned by the first proxy server 301, and returns the response message to the user equipment.

[0081] The first proxy server 301 is used to generate identity information.

[0082] It is not difficult to see that this embodiment is a system embodiment corresponding to the above embodiments, and this embodiment can be implemented in conjunction with the above embodiments. The relevant technical details mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

Claims

1. A proxy service processing method, applied to a proxy service cluster comprising multiple peer proxy servers, characterized in that, include: The second proxy server receives an access request sent by the user equipment, the access request carrying the identity information of the user equipment; The second proxy server identifies the first proxy server that generated the identity information based on the identity information, and redirects the access request to the first proxy server so that the first proxy server can perform proxy service processing on the access request; wherein, the identity information is generated by the first proxy server when the user device logs in for the first time and sent to the user device; The second proxy server receives the response message of the access request returned by the first proxy server and returns the response message to the user equipment; After the first proxy server generates the identity identification information for the user equipment, the first proxy server also sends the first IP address corresponding to its own server and the identity identification information to the identity database, so that the identity database can receive and store the first IP address and the identity identification information accordingly. The second proxy server redirects the access request to the first proxy server based on the identity information, including: The second proxy server redirects the access request to the first proxy server based on the identity information and the first IP address obtained in advance from the identity database.

2. The proxy service processing method according to claim 1, characterized in that, The identity information generated by the first proxy server includes: The first proxy server receives the login request sent by the user equipment, verifies the login request, and if the verification is successful, generates the identity information for the user equipment.

3. The proxy service processing method according to claim 1, characterized in that, After obtaining the first IP address from the identity database, the second proxy server also associates the first IP address with the identity information and stores it locally; The second proxy server obtains the first IP address, which has been pre-retrieved from the identity database, in the following manner: The second proxy server obtains the first IP address from the locally stored correspondence between the identity information and the first IP address based on the identity information.

4. The proxy service processing method according to claim 1, characterized in that, Before the second proxy server redirects the access request to the first proxy server based on the identity information, the method further includes: The second proxy server confirms the service status of the first proxy server; Redirecting the access request to the first proxy server includes: If the first proxy server is in normal service status, the second proxy server will redirect the access request to the first proxy server.

5. The agent service processing method according to claim 4, characterized in that, The identity database periodically or in real-time detects the service status of the first proxy server based on the first IP address. The second proxy server confirms the service status of the first proxy server, including: Based on the first IP address, obtain the detection result from the identity database; The service status of the first proxy server is confirmed based on the detection results.

6. The proxy service processing method according to claim 2, characterized in that, After the verification passes, the method further includes: The first proxy server generates a second proxy domain name for the user device's accessible applications, associates and stores the second proxy domain name with the pre-stored original domain name of the application, and returns the second proxy domain name and the identity information to the user device so that the user device can generate the access request based on the second proxy domain name.

7. The agent service processing method according to claim 6, characterized in that, The method further includes: In response to the access request redirected to the first proxy server, the first proxy server confirms the user device's access rights to the application based on the identity information, replaces the second proxy domain name carried in the access request with the original domain name, and obtains the response of the application corresponding to the original domain name.

8. The agent service processing method according to claim 7, characterized in that, After obtaining the response from the application corresponding to the original domain name, the method further includes: The first proxy server replaces the original domain name in the application's response with the second proxy domain name associated with the original domain name, and then obtains the response message. The first proxy server returns the response message to the second proxy server.

9. The agency service processing method according to any one of claims 6 to 8, characterized in that, Before sending the login request, the user equipment also sends a domain name resolution request for the first proxy domain name to the DNS server; wherein, the first proxy domain name is a preset proxy domain name publicly disclosed by the application, and the login request is generated based on the first proxy domain name; In response to the DNS server returning a first domain name resolution result carrying the first IP address, the user equipment sends the login request to the first proxy server based on the first IP address.

10. The proxy service processing method according to claim 9, characterized in that, Before sending the access request, the user equipment sends a domain name resolution request for the second proxy domain name to the DNS server; If the DNS server returns a second domain name resolution result carrying a second IP address, where the second IP address is the IP address of the second proxy server, then the user equipment sends the access request to the second proxy server based on the second IP address.

11. A proxy service processing system, characterized in that, Includes a first proxy server, a second proxy server, and a peer-to-peer proxy server cluster of the first and second proxy servers; The second proxy server is configured to receive an access request sent by a user equipment, the access request carrying the user equipment's identity information, identify the first proxy server that generated the identity information, redirect the access request to the first proxy server according to the identity information, receive the response message of the access request returned by the first proxy server, and return the response message to the user equipment. The first proxy server is used to generate the identity information when the user device logs in for the first time, and send it to the user device; After the first proxy server generates the identity identification information for the user equipment, the first proxy server also sends the first IP address corresponding to its own server and the identity identification information to the identity database, so that the identity database can receive and store the first IP address and the identity identification information accordingly. The second proxy server redirects the access request to the first proxy server based on the identity information, including: The second proxy server redirects the access request to the first proxy server based on the identity information and the first IP address obtained in advance from the identity database.

Images