Intranet access method, device, equipment and computer-readable storage medium

Abstract

The present application provides an intranet access method, device, equipment and computer-readable storage medium, which relates to the field of cloud technology; the method includes: when an application data packet containing an intranet access request and identity information generated by an application is detected, the application data packet is first encapsulated to obtain an intermediate data packet; the first encapsulation represents the encapsulation when sent to a virtual network card device; the intermediate data packet is intercepted by a full-flow proxy module; when the full-flow proxy module issues a proxy access request, the intermediate data packet is re-encapsulated to obtain an encapsulated data packet; wherein the re-encapsulation is the encapsulation when performing traffic proxy; the encapsulated data packet is forwarded to a server so that the server establishes an intranet access connection. Through the present application, the convenience of intranet access can be improved.

Description

1.1.1 Technical Field

[0002] The present application relates to cloud technology, and more particularly to an intranet access method, apparatus, device and computer-readable storage medium. 1.1.2 Background Technology

[0004] Full-size office means that you can work at work or at non-work locations, for example, you can work through the network at your residence, outdoors, etc. The premise of full-size office is that users can successfully access the intranet through the external network to interact with the resources of the intranet. In related technologies, when users use mobile terminals to request access to resources on the intranet, they must manually configure the proxy mode, which is cumbersome to configure, making intranet access less convenient. 1.1.3 Summary of the invention

[0006] The embodiments of the present application provide an intranet access method, apparatus, device and computer-readable storage medium, which can improve the convenience of intranet access.

[0007] The technical solution of the embodiment of the present application is implemented as follows:

[0008] The present application provides an intranet access method, including:

[0009] When an application data packet containing an intranet access request and identity information generated by an application is detected, the application data packet is first encapsulated to obtain an intermediate data packet; the first encapsulation represents the encapsulation when it is sent to the virtual network card device;

[0010] Using a full-flow proxy module to intercept the intermediate data packets;

[0011] When the full-flow proxy module issues a proxy access request, the intermediate data packet is re-encapsulated to obtain an encapsulated data packet; wherein the re-encapsulation is the encapsulation during the flow proxy;

[0012] The encapsulated data packet is forwarded to the server so that the server establishes an intranet access connection.

[0013] In some embodiments of the present application, the intercepting the intermediate data packet by using the full-flow proxy module includes:

[0014] The intermediate data packet transmitted according to the routing information of the full-flow proxy module is received through the full-flow proxy module.

[0015] The present application provides an intranet access method, including:

[0016] Receiving the encapsulated data packets forwarded by the terminal through the full-flow proxy module;

[0017] Decapsulating the encapsulated data packet for the first time to obtain an intermediate data packet;

[0018] Decapsulating the intermediate data packet again to obtain an application data packet, and extracting identity information from the application data packet;

[0019] When the identity information is authenticated, an intranet access connection with the terminal is established in response to the intranet access request in the application data packet.

[0020] In some embodiments of the present application, the step of decapsulating the intermediate data packet again to obtain the application data packet includes:

[0021] The routing information of the full-flow proxy module, the address of the character device, the routing information of the virtual network card device and the transport protocol header are removed in sequence from the intermediate data packet to obtain the application data packet.

[0022] An embodiment of the present application provides an intranet access device, including:

[0023] The first encapsulation module is used to encapsulate the application data packet for the first time when detecting the application data packet containing the intranet access request and identity information generated by the application program to obtain an intermediate data packet; the first encapsulation represents the encapsulation when it is sent to the virtual network card device;

[0024] A data interception module, used to intercept the intermediate data packet using a full-flow proxy module;

[0025] A re-encapsulation module, used for re-encapsulating the intermediate data packet to obtain an encapsulated data packet when the full-flow proxy module issues a proxy access request; wherein the re-encapsulation is the encapsulation when performing flow proxy;

[0026] The data sending module forwards the encapsulated data packet to the server so that the server establishes an intranet access connection.

[0027] In some embodiments of the present application, the first encapsulation module is also used to add a transport protocol header to the application data packet to obtain a first temporary data packet; add the routing information of the virtual network card device to the header of the first temporary data packet to obtain a second temporary data packet; add the address of the character device to the header of the second temporary data packet to obtain a third temporary data packet; add the routing information of the full-flow proxy module to the header of the third temporary data packet to obtain the intermediate data packet.

[0028] In some embodiments of the present application, the re-encapsulation module is also used to add a transport protocol header to the intermediate data packet to obtain a first candidate data packet; add the routing information of the server to the header of the first candidate data packet to obtain a second candidate data packet; add the physical address of the server to the header of the second candidate data packet to obtain the encapsulated data packet.

[0029] In some embodiments of the present application, the data interception module is further used to receive, through the full-flow proxy module, the intermediate data packet transmitted according to the routing information of the full-flow proxy module.

[0030] The present application embodiment provides an intranet access device, including:

[0031] A data receiving module, used to receive encapsulated data packets forwarded by the terminal through the full-flow proxy module;

[0032] The decapsulation module is used to first decapsulate the encapsulated data packet to obtain an intermediate data packet; and to decapsulate the intermediate data packet again to obtain an application data packet;

[0033] An information extraction module, used to extract identity information from the application data packet;

[0034] The connection establishing module is used to establish an intranet access connection with the terminal in response to the intranet access request in the application data packet when the identity information is authenticated.

[0035] In some embodiments of the present application, the decapsulation module is further used to remove the physical address of the server, the routing information of the server, and the transport protocol header from the encapsulated data packet in sequence to obtain the intermediate data packet.

[0036] In some embodiments of the present application, the decapsulation module is also used to remove the routing information of the full-flow proxy module, the address of the character device, the routing information of the virtual network card device and the transmission protocol header from the intermediate data packet in sequence to obtain the application data packet.

[0037] An embodiment of the present application provides a terminal, including:

[0038] A first memory, used to store executable intranet access instructions;

[0039] The first processor is used to implement the intranet access method provided by the terminal side of the embodiment of the present application when executing the executable intranet access instruction stored in the first memory.

[0040] An embodiment of the present application provides a server, including:

[0041] A second memory, used for storing executable intranet access instructions;

[0042] The second processor is used to implement the intranet access method provided by the server side of the embodiment of the present application when executing the executable intranet access instruction stored in the second memory.

[0043] An embodiment of the present application provides a computer-readable storage medium storing executable intranet access instructions, which are used to cause a first processor to execute and implement the intranet access method provided on the terminal side of the embodiment of the present application; or to cause a second processor to execute and implement the intranet access method provided on the server side of the embodiment of the present application.

[0044] The embodiment of the present application has the following beneficial effects: the terminal will first encapsulate the application data packet containing the intranet access request and identity information for the first time, so that the traffic can be sent to the virtual network card device, and then intercept and encapsulate the intermediate data packet through the full-flow proxy module, and send it to the server through the full-flow proxy module, so that the server can respond to the intranet access request based on the identity information, thereby establishing an intranet access connection. In this way, by using the full-flow proxy module to intercept the intermediate data packet and the two data encapsulation processes, unified proxy and unified forwarding of intranet access requests can be achieved, so that there is no need to distinguish whether the request is sent to the intranet or the extranet, and the intranet can be accessed without distinguishing between the intranet and the extranet, and the cumbersome manual configuration process during intranet access can be skipped, which improves the convenience of intranet access. 1.1.4 Description of the Figures

[0046] Figure 1 This is a schematic diagram of the process of encapsulation from user mode to kernel mode;

[0047] Figure 2 It is an optional architecture diagram of the intranet access system 100 provided in an embodiment of the present application;

[0048] Figure 3 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0049] Figure 4 It is a schematic diagram of the structure of the server provided in the embodiment of the present application;

[0050] Figure 5 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 1 ;

[0051] Figure 6 It is a schematic diagram of first decapsulation of an encapsulated data packet provided in an embodiment of the present application;

[0052] Figure 7It is a schematic diagram of decapsulating an encapsulated data packet again provided in an embodiment of the present application;

[0053] Figure 8 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 2 ;

[0054] Fig. 9 It is a schematic diagram of the first packaging provided by the embodiment of the present application;

[0055] Fig.10 A schematic diagram of data packet flow and encapsulation provided for an embodiment of the present application. 1.1.5 Specific implementation methods

[0057] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0058] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0059] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0061] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0062] 1) Cloud Technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0063] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and flexibly traversed. Cloud computing technology will become an important support. The background of the technical network system requires a large amount of computing and storage resources, such as video networks, picture websites and more portals. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the background system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0064] 2) Intranet refers to the office network, that is, the local area network configured within the company. In order to protect internal information from being leaked, some companies will configure a local area network to connect various devices within the company, so that devices within the company can communicate and share resources, while devices outside the company will not access internal resources.

[0065] 3) Extranet can be understood as the Internet. Any device that has the conditions to access the extranet can access the extranet at any time. Therefore, compared with the intranet, the extranet has a wider coverage. With this feature, company employees can access the company's intranet anytime and anywhere through the extranet, thus realizing remote work.

[0066] 4) Proxy service, which is responsible for forwarding network information between personal networks and the Internet, and controls and registers the forwarding. It is a bridge between personal networks and the Internet.

[0067] 5) Full-flow proxy means that all traffic is intercepted and proxied uniformly, that is, all data packets need to be sent through the same proxy. This proxy is a full-flow proxy.

[0068] 6) Data encapsulation: When data packets are transmitted between different devices using the network, in order to accurately send them to the destination and efficiently use transmission resources, the data packets will be split and packaged, and the destination address, local address and some bytes for error correction will be attached. This series of processes is data encapsulation.

[0069] More specifically, data encapsulation refers to the process of encapsulating a protocol data unit (PDU) in a set of protocol headers and protocol trailers. In the five-layer model of Transmission Control Protocol / Internet Protocol (TCP / IP) or the seven-layer model of Open System Interconnect (OSI), each layer is mainly responsible for communicating with the peer layer on other devices. Each layer can add a protocol header and a protocol trailer to its corresponding PDU. The protocol header includes information related to communication between layers.

[0070] 7) Proxy Auto Config (PAC) mode is an intelligent diversion mode that matches the websites that users want to visit according to rules. Websites that meet the rules are accessed directly, and websites that do not meet the rules are accessed through a proxy.

[0071] 8) User state, running user programs, cannot directly use system resources, nor can it change the working state of the CPU, and can only access the storage space corresponding to the application itself.

[0072] 9) Kernel state, running operating system programs and operating hardware. The kernel state CPU can access all data in the memory, including peripheral devices such as hard disks and network cards, and the CPU can also switch itself from one program to another.

[0073] Full-size office means that you can work at work or at non-work locations, for example, you can work through the network at your residence, outdoors, etc. The premise of full-size office is that users can successfully access the intranet through the extranet to interact with the intranet resources.

[0074] Mobile terminals are easy to carry, and more and more users choose to use them for office work. When users use mobile terminals to request to access intranet resources, they can use the PAC mode to request intranet resources. The PAC mode distinguishes whether the mobile terminal is in the intranet or the extranet. When it is in the intranet, it can directly access the intranet without going through a proxy; when the mobile terminal is in the extranet, the request is forwarded through the PAC proxy and the intranet resources are obtained.

[0075] In PAC mode, data packets from the application layer will establish a Socket connection through the socket library of the mobile terminal system, and then when the data packets from the application layer are sent through the Socket connection, the data packets will undergo encapsulation from user mode to kernel mode.

[0076] For example, Figure 1 This is a schematic diagram of the process of encapsulation from user mode to kernel mode. Figure 1 , the mobile terminal obtains the request at the application layer 1-1, and then separates the request body from the request header through the Socket library 1-2, and uses the request body as the data packet 1-a to be encapsulated. Then, the data packet 1-a is transmitted to the TCP / IP protocol stack 1-3, during which a TCP header 1-b is added to the header of the data packet 1-a. Next, the TCP / IP protocol stack 1-3 obtains the routing information from the routing table 1-4, and continues to transmit the data packet to the device driver 1-5. During this overload, an IP header 1-c is added to the data packet 1-a. After that, the device driver 1-5 transmits the data packet to the network interface controller (NIC) 1-6. During this process, a MAC address 1-d (Media Access Control Address) is added to the data packet 1-a, and then the data packet obtained after layers of encapsulation is sent out through the network card through the NIC.

[0077] However, when the PAC mode is used, the user must manually configure the proxy mode, and the proxy mode configuration process is relatively cumbersome. It can be seen that the intranet access method in the relevant technology cannot enable users to directly and conveniently access the intranet, thereby making the convenience of intranet access low.

[0078] The embodiments of the present application provide an intranet access method, apparatus, device and computer-readable storage medium, which can improve intranet access. The exemplary application of the intranet access device provided by the embodiments of the present application is described below. The intranet access device provided by the embodiments of the present application can be implemented as various types of terminals such as laptop computers, tablet computers, desktop computers, set-top boxes, mobile devices (for example, mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), and can also be implemented as servers. When the intranet access device is used to encapsulate application data packets, the intranet access device can be implemented as a terminal, and when the intranet access device is used to decapsulate encapsulated data packets, the intranet access device can be implemented as a server. Below, an exemplary application of the intranet access device will be described.

[0079] See also Figure 2 , Figure 2 It is an optional architecture diagram of the intranet access system 100 provided in an embodiment of the present application. To support an intranet access application, the terminal (terminal 400-1 and terminal 400-2 are shown as examples) is connected to the server 200 via the network 300. The network 300 can be a wide area network or a local area network, or a combination of the two.

[0080] Terminal 400 (an implementation of an intranet access device) is used to encapsulate the application data packet for the first time to obtain an intermediate data packet when an application data packet containing an intranet access request and identity information generated by an application is detected. The first encapsulation represents the encapsulation when it is sent to the virtual network card device. Terminal 400 uses a full-flow proxy device to intercept the intermediate data packet, and when the full-flow proxy module issues a proxy request, the intermediate data packet is re-encapsulated to obtain an encapsulated data packet, wherein the re-encapsulation is the encapsulation when performing traffic proxy. Then, terminal 400 forwards the encapsulated data packet to the server through the virtual network card device so that the server establishes an intranet access connection. Terminal 400 displays the display interface of the application in its graphical interface (graphical interface 400-11 and graphical interface 400-21 are shown as examples), and receives the user's operation on the application in the display interface of the application, which includes the operation of triggering the application to generate an intranet access request.

[0081] The server 200 is used to receive the encapsulated data packet forwarded by the terminal through the full-flow proxy module, decapsulate the encapsulated data packet for the first time to obtain the intermediate data packet, and then decapsulate the intermediate data packet again to obtain the application data packet, and extract the identity information from the application data packet. When the server 200 passes the identity information authentication, it will respond to the intranet access request in the application data packet and establish an intranet access connection with the terminal.

[0082] In some embodiments, the server 200 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present invention.

[0083] See also Figure 3 , Figure 3 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application, Figure 3 The terminal 400 shown includes: at least one first processor 410, a first memory 450, at least one first network interface 420 and a first user interface 430. The various components in the terminal 400 are coupled together via a first bus system 440. It is understood that the first bus system 440 is used to achieve connection and communication between these components. In addition to the data bus, the first bus system 440 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 3 In the figure, various buses are labeled as a first bus system 440 .

[0084] The first processor 410 may be an integrated circuit chip having signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor may be a microprocessor or any conventional processor, etc.

[0085] The first user interface 430 includes one or more first output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The first user interface 430 also includes one or more first input devices 432, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0086] The first memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The first memory 450 may optionally include one or more storage devices physically located away from the first processor 410.

[0087] The first memory 450 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The first memory 450 described in the embodiment of the present application is intended to include any suitable type of memory.

[0088] In some embodiments, the first memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0089] The first operating system 451 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0090] A first network communication module 452, used to reach other computing devices via one or more (wired or wireless) first network interfaces 420, exemplary first network interfaces 420 include: Bluetooth, Wireless Fidelity (Wi-Fi), and Universal Serial Bus (USB), etc.;

[0091] A first presentation module 453 for enabling presentation of information (e.g., a user interface for operating peripherals and displaying content and information) via one or more first output devices 431 (e.g., a display screen, a speaker, etc.) associated with the first user interface 430;

[0092] The first input processing module 454 is configured to detect one or more user inputs or interactions from one of the one or more first input devices 432 and to translate the detected inputs or interactions.

[0093] In some embodiments, the intranet access device provided in the embodiments of the present application can be implemented in software. Figure 3 The intranet access device 455 stored in the first memory 450 is shown, which can be software in the form of a program and a plug-in, etc., including the following software modules: a first packaging module 4551, a data interception module 4552, a second packaging module 4553 and a data sending module 4554. These modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0094] In other embodiments, the intranet access device 455 provided in the embodiment of the present application can be implemented in hardware. As an example, the intranet access device 455 provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the intranet access method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs) or other electronic components.

[0095] An embodiment of the present application provides a terminal, including:

[0096] A first memory, used to store executable intranet access instructions;

[0097] The first processor is used to implement the intranet access method provided by the terminal side of the embodiment of the present application when executing the executable intranet access instruction stored in the first memory.

[0098] See also Figure 4 , Figure 4is a schematic diagram of the structure of the server provided in the embodiment of the present application, Figure 4 The server 200 shown includes: at least one second processor 210, a second memory 250, at least one second network interface 220 and a second user interface 230. The various components in the server 200 are coupled together via a second bus system 240. It is understood that the second bus system 240 is used to achieve connection and communication between these components. In addition to the data bus, the second bus system 240 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the second bus system 240 is not used in the example of FIG. Figure 4 In the figure, various buses are labeled as a second bus system 240.

[0099] The second processor 210 may be an integrated circuit chip having signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor may be a microprocessor or any conventional processor, etc.

[0100] The second user interface 230 includes one or more second output devices 231 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The second user interface 230 also includes one or more second input devices 232, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0101] The second memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The second memory 250 may optionally include one or more storage devices physically located away from the second processor 210.

[0102] The second memory 250 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The second memory 250 described in the embodiment of the present application is intended to include any suitable type of memory.

[0103] In some embodiments, the second memory 250 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0104] The second operating system 251 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0105] A second network communication module 252, used to reach other computing devices via one or more (wired or wireless) second network interfaces 220, exemplary second network interfaces 220 include: Bluetooth, Wireless Fidelity (Wi-Fi), and Universal Serial Bus (USB), etc.;

[0106] A second presentation module 253 for enabling presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more second output devices 231 (e.g., a display screen, a speaker, etc.) associated with the second user interface 230;

[0107] The second input processing module 254 is configured to detect one or more user inputs or interactions from one of the one or more second input devices 232 and to translate the detected inputs or interactions.

[0108] In some embodiments, the intranet access device provided in the embodiments of the present application can be implemented in software. Figure 4 The intranet access device 255 stored in the second memory 250 is shown, which can be software in the form of a program and a plug-in, etc., including the following software modules: a data receiving module 2551, a decapsulation module 2552, an information extraction module 2553 and a connection establishment module 2554. These modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0109] In other embodiments, the intranet access device 255 provided in the embodiment of the present application can be implemented in hardware. As an example, the intranet access device 255 provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the intranet access method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs) or other electronic components.

[0110] An embodiment of the present application provides a server, including:

[0111] A second memory, used for storing executable intranet access instructions;

[0112] The second processor is used to implement the intranet access method provided by the server side of the embodiment of the present application when executing the executable intranet access instruction stored in the second memory.

[0113] The intranet access method provided in the embodiment of the present application will be explained in combination with the exemplary application and implementation of the server and terminal provided in the embodiment of the present application.

[0114] See also Figure 5 , Figure 5 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 1 , will combine Figure 5 The steps shown are explained.

[0115] S101. When a terminal detects an application data packet generated by an application program and including an intranet access request and identity information, the application data packet is first encapsulated to obtain an intermediate data packet.

[0116] The embodiment of the present application is implemented in a scenario where a user uses a terminal to access an intranet through an external network, for example, when a user accesses a company intranet through a network at his or her place of residence, or when a user accesses a company intranet through a mobile network. The terminal is installed with an application that can provide a functional interface for users to access the intranet. When the user triggers the functional interface, the application will generate a data packet containing an intranet access request and the user's identity information. This data packet is an application data packet. After the terminal detects the application data packet, it will be clear that the user has a need to access the intranet, and thus the protocol header required for transmission will be added to the application data packet to encapsulate the application data packet for the first time to obtain an intermediate data packet.

[0117] It should be noted that in the embodiment of the present application, in order to access the intranet without distinguishing between the intranet and the extranet, the terminal needs to use the virtual network card device to uniformly proxy the data packets during communication. Therefore, when the terminal encapsulates the application data packet, it is necessary to encapsulate the application data packet to send it to the virtual network card device, rather than to send it to the device driver. This encapsulation can be recorded as the first encapsulation. That is to say, in the present application, the first encapsulation represents the encapsulation when it is sent to the virtual network card device.

[0118] It is understandable that the virtual network card device is equivalent to a virtual proxy device of the terminal, which provides proxy services for the terminal. In the embodiment of the present application, the virtual network card device can be a TUN virtual device, a TAP virtual device, or other virtual devices, which is not limited in the present application.

[0119] It is understandable that the identity information can be a user ID, a user's work number, name, etc., or other identification information that can distinguish the user from others, such as a password set by the user. The intranet access request is used to indicate to the server that the user needs to access the intranet. The intranet access request can be a field, identifier, etc. agreed with the server, and this application does not limit it here.

[0120] It should be noted that the first encapsulation is to encapsulate the application data packet to make it a completed request, that is, when the application data packet is sent to the virtual network card device, some Internet Protocol (IP) information and Media Access Control Address (MAC) information are added to the header of the application data packet, so that the original application data packet is not exposed.

[0121] Furthermore, during the first encapsulation, the terminal will sequentially add a transport protocol header and MAC information to the header of the application data packet. At this time, the transport protocol header may include the address of the virtual network card device, and the MAC information is not the address of the device driver, but may be the address of a character device, so that an intermediate data packet can be encapsulated. Of course, in other embodiments of the present application, in addition to adding a transport protocol header and MAC information to the header of the application data packet, the terminal may also add a transport protocol tail to the tail of the application data packet to obtain an intermediate data packet.

[0122] S102: The terminal uses a full-flow proxy module to intercept intermediate data packets.

[0123] After the terminal encapsulates the application data packet for the first time and obtains the intermediate data packet, it will use the full-flow proxy module to intercept the intermediate data packet so that the intermediate data packet can be uniformly proxied through the full-flow proxy module later.

[0124] It should be noted that the terminal can intercept the intermediate data packet through the full-flow proxy module by adding the routing information of the full-flow proxy module in the intermediate data packet.

[0125] S103: When the full-flow proxy module issues a proxy access request, the terminal re-encapsulates the intermediate data packet to obtain an encapsulated data packet.

[0126] When the full-flow proxy module starts proxy access to the intranet, it will issue a proxy access request, and the intermediate data packet is the data body corresponding to the proxy access request. When the terminal detects the proxy access request issued by the full-flow proxy module, it will obtain the data body corresponding to the proxy access request, that is, the intermediate data packet, and then re-encapsulate the intermediate data packet, and record the re-encapsulated intermediate data packet as the final encapsulated data packet.

[0127] It should be noted that the second encapsulation is the encapsulation for traffic proxy. This encapsulation is required for full traffic proxy, so during this encapsulation, various additional information required for transmission to the server will be added to the intermediate data packet in the form of a protocol header.

[0128] That is to say, in the embodiment of the present application, the terminal encapsulates the application data packet twice from user state to kernel state. The first encapsulation enables the application data packet to be sent to the virtual network card device. When encapsulated again, the intermediate data packet is uniformly intercepted and processed by the full-flow proxy module. In this way, the traffic can be forwarded by a unified full-flow proxy, thereby enabling access to the intranet without distinguishing between the intranet and the extranet.

[0129] It is understandable that, during re-encapsulation, the terminal adds a transport protocol header and MAC information to the header of the intermediate data packet through the full-flow proxy module. At this time, the transport protocol header and MAC information both point to the server.

[0130] In the embodiment of the present application, the full-flow proxy module refers to a module that performs unified proxy for all flows.

[0131] S104: The terminal forwards the encapsulated data packet to the server, so that the server establishes an intranet access connection.

[0132] After obtaining the encapsulated data packet through two encapsulations, the terminal can forward the encapsulated data packet to the server through the full-flow proxy module, and the server receives the encapsulated data packet forwarded by the terminal through the full-flow proxy module.

[0133] It should be noted that in the embodiments of the present application, the server may receive encapsulated data packets through a virtual traffic proxy device running on its own, or may directly receive encapsulated data packets through its network card, and the present application does not limit this.

[0134] S105: The server decapsulates the encapsulated data packet for the first time to obtain an intermediate data packet.

[0135] Since the terminal encapsulates the application data packet twice to obtain the encapsulated data packet, the server also needs to decapsulate twice after receiving the encapsulated data packet to obtain the application data packet. First, the server will decapsulate the encapsulated data packet for the first time, remove the added protocol headers one by one, and obtain the intermediate data packet.

[0136] Furthermore, the implementation process of the server performing the first decapsulation on the encapsulated data packet may be as follows: the server removes the server's physical address, the server's routing information, and the transport protocol header from the encapsulated data packet in sequence to obtain an intermediate data packet.

[0137] It can be understood that the first decapsulation is the reverse process of the second encapsulation. In the first decapsulation, the server will transmit the encapsulated data packet to the upper layer according to the five-layer model of Transmission Control Protocol / Internet Protocol (TCP / IP) or the seven-layer model of Open System Interconnect (OSI). At each layer, the protocol header added by the terminal through the virtual network card device will be removed until the MAC information and transport protocol header of the first layer are completely removed, and the intermediate data packet is obtained.

[0138] Exemplarily, the present application embodiment provides a schematic diagram of first decapsulating an encapsulated data packet, see Figure 6 The encapsulated data packet has a MAC (Media Access Control Address) header 6-1, an IP header 6-2, a TCP header 6-3, and an intermediate data packet 6-4. The intermediate data packet 6-4 also has a MAC header 6-41, an IP header 6-42, a TCP header 6-43, and a data body 6-44. The server first removes the MAC header 6-1, then removes the IP header 6-2, and then removes the TCP header 6-3, until only one intermediate data packet 6-4 is left, completing the first decapsulation.

[0139] S106: The server decapsulates the intermediate data packet again to obtain an application data packet, and extracts identity information from the application data packet.

[0140] After receiving the intermediate data packet, the server will start a new round of decapsulation process, which is called re-decapsulation. At this time, the server will remove the transport protocol headers and MAC information in the intermediate data packet in a similar process to the first decapsulation, until a data body without a protocol header is obtained, which is the application data packet. It should be noted that re-decapsulation is the reverse process of the first encapsulation.

[0141] Furthermore, the process of the server decapsulating the intermediate data packet again can be: from the intermediate data packet, the routing information of the full-flow proxy module, the address of the character device, the routing information of the virtual network card device and the transmission protocol header are removed in turn to obtain the application data packet.

[0142] Exemplarily, the present application embodiment provides a schematic diagram of decapsulating an encapsulated data packet again, see Figure 7 , the server will Figure 6 The MAC header 6-41, IP header 6-42, and TCP header 6-43 in the intermediate data packet 6-4 shown are removed in sequence until the data body 6-44 is obtained. The obtained data body is the application data packet.

[0143] S107: When the server passes the identity information authentication, it responds to the intranet access request in the application data packet and establishes an intranet access connection with the terminal.

[0144] After receiving the application data packet, the server will parse the application data packet and extract the intranet access request and identity information from it. Then, the server will compare the identity information with the user's preset information to determine whether the identity information has passed the authentication, that is, whether the user is a legitimate user registered in the intranet. When the identity information is authenticated and the user is a legitimate user registered in the intranet, the server will respond to the intranet access request and establish an intranet access connection with the terminal so that the terminal can successfully access the resources in the intranet. When the identity information is not authenticated and the user is not a legitimate user registered in the intranet, the server will not respond to the intranet access request, and the terminal will not be able to access the resources in the intranet.

[0145] It is understandable that the preset information is the information used for identity authentication when the user registers in the intranet. The preset information can be the password set by the user when registering, or the work number retained by the user when registering, etc., which is not limited in this application.

[0146] When the server compares the identity information with the preset information, it can calculate the similarity between the identity information and the preset information. When the similarity is above the preset threshold, the server will confirm that the identity information has passed the authentication; when the similarity is below the preset threshold, the server will confirm that the identity information has not passed the authentication, and the terminal cannot access the intranet.

[0147] In the embodiment of the present application, the terminal will first encapsulate the application data packet containing the intranet access request and identity information for the first time, so that the traffic can be sent to the virtual network card device, and then intercept and encapsulate the intermediate data packet through the full-flow proxy module, and send it to the server through the full-flow proxy module, so that the server can respond to the intranet access request based on the identity information, thereby establishing an intranet access connection. In this way, by using the full-flow proxy module to intercept the intermediate data packet and the two encapsulation processes, it is possible to achieve unified proxy and unified forwarding of intranet access requests, so that there is no need to distinguish whether the request is sent to the intranet and the extranet, and the intranet can be accessed without distinguishing between the intranet and the extranet, and the cumbersome manual configuration process during intranet access can be skipped, which improves the convenience of intranet access.

[0148] See also Figure 8 , Figure 8 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 2 In some embodiments of the present application, the terminal performs the first encapsulation on the application data packet to obtain the intermediate data packet, that is, the specific implementation process of S101, which may include: S1011-S1014, as follows:

[0149] S1011. The terminal adds a transport protocol header to the application data packet to obtain a first temporary data packet.

[0150] When the terminal encapsulates the application data packet for the first time, it will first add a transport protocol header to the header of the application data packet through the transport layer. The application data packet obtained after adding the transport protocol header is the first temporary data packet.

[0151] S1012. The terminal adds routing information of the virtual network card device to the header of the first temporary data packet to obtain a second temporary data packet.

[0152] After receiving the first temporary data packet, the terminal will continue to transmit the first temporary data packet downward to the network layer, and then obtain the routing table maintained by the network layer, find the routing information of the virtual network card device in the routing table, and add the routing information of the virtual network card device to the header of the first temporary data packet through the network layer. In this way, the second temporary data packet is obtained.

[0153] It is understandable that a routing table is a file-like database stored in a router or networking device. The routing table stores the path to a specific network address and contains the topology information around the network. The routing table does not directly participate in the transmission of data packets, but is used to generate a pointer table that contains the transmission path selected by the routing algorithm. The routing table is usually compressed or pre-compiled to optimize hardware storage and lookup.

[0154] It should be noted that, since the routing information of the virtual network card device is added to the second temporary data packet, the operating system of the terminal will transmit the second temporary data packet to the virtual network card device based on the routing information, thereby intercepting the traffic.

[0155] S1013: The terminal adds the address of the character device to the header of the second temporary data packet to obtain a third temporary data packet.

[0156] Next, the terminal obtains the address of the character device and adds the address of the character device to the header of the second temporary data packet. The data packet to which the address of the character device is added is the third temporary data packet.

[0157] It should be noted that a character device is a device that does not contain a physical address and serves as an interface for exchanging data between user controls and kernel space.

[0158] S1014. The terminal adds the routing information of the full-flow proxy module to the header of the third temporary data packet to obtain an intermediate data packet.

[0159] The terminal obtains the routing information of the full-flow proxy module, and then adds the routing information of the full-flow proxy module to the header of the third temporary data packet. The data packet obtained at this time is the intermediate data packet.

[0160] For example, the present application provides a schematic diagram of the first packaging, see Fig. 9 After the terminal obtains the application data packet 9-1 from the application layer, it will add a transport protocol header, such as a TCP header 9-2, to the header of the application data packet to obtain a first temporary data packet, and then obtain the routing information of the virtual network card device from the routing table, and add the routing information to the header of the first temporary data packet in the form of an IP header 9-3 to obtain a second temporary data packet, and then add the address of the character device to the second temporary data packet in the form of a MAC header 9-4 to obtain a third temporary data packet, and then add the route of the full-flow proxy module to the header of the third temporary data packet in the form of an IP header 9-5. In this way, the obtained data packet is an intermediate data packet that can be intercepted by the full-flow proxy module.

[0161] In an embodiment of the present application, the terminal will sequentially add a transport protocol header, routing information of the virtual network card device, the address of the character device, and routing information of the full-flow proxy module to the application data packet to obtain an intermediate data packet, thereby achieving the first encapsulation of the application data packet.

[0162] In some embodiments of the present application, the terminal re-encapsulates the intermediate data packet to obtain an encapsulated data packet, that is, the specific implementation process of S103 may include:

[0163] S1031. The terminal adds a transport protocol header to the intermediate data packet to obtain a first candidate data packet.

[0164] S1032: The terminal adds the routing information of the server to the header of the first candidate data packet to obtain a second candidate data packet.

[0165] When the terminal re-encapsulates the intermediate data packet, it can first add a transport protocol header to the intermediate data packet through the transport layer to obtain the first candidate data packet, and then transmit the first candidate data packet to the lower layer. When passing through the network layer, it obtains the maintained routing table, and then extracts the routing information to the server from the routing table, and adds the server's routing information to the header of the first candidate data packet.

[0166] It is understandable that since the re-encapsulation is required for traffic proxy, that is, the encapsulation when the intermediate data packet is forwarded through the full traffic proxy, the additional information that needs to be added during this encapsulation is all server-related information.

[0167] S1033: The terminal adds the physical address of the server to the header of the second candidate data packet to obtain an encapsulated data packet.

[0168] Similarly, after obtaining the physical address of the server, the terminal adds the physical address of the server to the header of the second candidate data packet. In this way, the terminal completes the re-encapsulation of the intermediate data packet and obtains the encapsulated data packet.

[0169] It is understandable that the physical address of the server may be the MAC address of the server. The MAC address is used to uniquely identify a network card in the network and is burned into the network card when it is generated by the network equipment manufacturer.

[0170] In an embodiment of the present application, the terminal sequentially adds a transport protocol header, the server's routing information, and the server's physical address to the intermediate data packet, thereby completing the re-encapsulation of the intermediate data packet so that the intermediate data packet can be sent to the server.

[0171] In some embodiments of the present application, the transmission protocol header includes: any one or more of a transmission control protocol header, a user data packet protocol header, and an internet protocol header. Therefore, when the terminal adds a transmission protocol header to the application data packet, it may add one or more of a transmission control protocol header, i.e., a TCP header, a user data packet protocol header, i.e., a UDP header, and an internet protocol header, i.e., an IP header. For example, the terminal may add a TCP header to the application data packet, may add an IP header to the application data packet, or may add a TCP header and an IP header to the application data packet, and the present application does not limit this.

[0172] Similarly, when the terminal adds a transmission protocol header to the intermediate data packet, it may add one or more of a transmission control protocol header, a user data packet protocol header, and an internetwork protocol header.

[0173] In some embodiments of the present application, the terminal uses the full-flow proxy module to intercept the intermediate data packet, that is, the specific implementation process of S102 may include: S1021, as follows:

[0174] S1021. The terminal receives, through the full-flow proxy module, an intermediate data packet transmitted according to the routing information of the full-flow proxy module.

[0175] When the terminal uses the full-flow proxy mode to intercept the intermediate data packet, it actually uses the full-flow proxy module to receive the intermediate data packet transmitted by the terminal's operating system based on the routing information of the full-flow proxy module. This routing information can be added to the intermediate data packet in the form of an IP header. After receiving the intermediate data packet, the terminal's operating system will read the IP header to determine where the next hop of the intermediate data packet is, and then transmit the intermediate data packet.

[0176] In an embodiment of the present application, the terminal can receive the intermediate data packets transmitted according to its routing information through the full-flow proxy module, thereby intercepting the intermediate data packets to facilitate subsequent flow proxy for the intermediate data packets.

[0177] The following is an explanation of an exemplary application of the embodiments of the present application in a practical application scenario.

[0178] The embodiment of the present application is implemented in the scenario where the user accesses the intranet while performing full-size office work. The embodiment of the present application mainly intercepts and re-encapsulates data packets to achieve the same interception of traffic, so that the intranet resources can be freely accessed without manually configuring the Internet proxy of the system and application.

[0179] Fig.10 This is a schematic diagram of the data packet flow and encapsulation provided in the embodiment of the present application. Fig.10 , then, the encapsulation of the data packet mainly includes the following steps:

[0180] S201. The mobile terminal obtains the data packet (application data packet) in the request body of the HTTP request from APP10-1.

[0181] At this time, the mobile terminal will separate the request body and the request header and obtain the data packet from the request body.

[0182] S202, the mobile terminal transmits the data packet to the TCP / IP protocol stack 10-3 through the Socket connection 10-2 created by the system, and adds a TCP header (transmission protocol header).

[0183] S203, the TCP / IP protocol stack 10-3 of the mobile terminal transmits the data packet with the TCP header added to the TUN / TAP virtual device 10-4 (virtual network card device), and adds an IP header.

[0184] The TCP / IP protocol stack 10-3 will select each route in the routing table (i.e. Fig.10 0.0.0.0, 10.8.0.1, 10.8.0.10, 10.80.22.1, 10.80.22.13, etc.) in the TUN / TAP virtual device 10-4 (the routing information of the virtual network card device), and add the IP as the IP header. It should be noted that the first user-mode to kernel-mode traffic encapsulation is sent to the TUN / TAP virtual device 10-4, while the data encapsulation in the non-full traffic proxy mode is directly sent to the device driver without passing through the TUN / TAP virtual device 10-4.

[0185] S204, the TUN / TAP virtual device 10-4 on the mobile terminal is a data packet to which an IP header is added (a second temporary data packet), and then the MAC address of the character device 10-5 (Character Devises) is added.

[0186] Character device 10-5 is a special device that has no physical address.

[0187] S205, the full-flow proxy 10-6 (full-flow proxy module) on the mobile terminal hijacks the encapsulated data packet (intercepting the intermediate data packet through the full-flow proxy module).

[0188] During hijacking, an IP header can be added to the header of the data packet with the MAC address added (the third temporary data packet). The IP header contains the IP of the full-flow proxy 10-6 (the routing information of the full-flow proxy module), so that the data packet can be imported into the full-flow proxy 10-6.

[0189] S206, the full-flow proxy 10-6 on the mobile terminal initiates a request (proxy access request), establishes a Socket connection 10-7, and obtains the request body in the request, thereby obtaining a data packet to which the IP of the full-flow proxy 10-6 is added.

[0190] S207. Send the data packet with the IP of the full-flow proxy 10-6 added to the TCP / IP protocol stack 10-8 through the Socket connection 10-7, and add a TCP header.

[0191] S208, the mobile terminal TCP / IP protocol stack 10-8 searches the server's IP (server's routing information) from the routing table, sends a data packet with another TCP header added (the first candidate data packet) to the device driver 10-9, and adds the server's IP (server's routing information).

[0192] S209, the device driver 10-9 of the mobile terminal sends the data packet (second candidate data packet) with the IP of the server added to the NIC 10-10, and adds the MAC address of the server (physical address of the server), so that an encapsulated data packet (encapsulated data packet) is obtained.

[0193] After receiving the encapsulated data packet, the mobile terminal will forward the encapsulated data packet to the server, so that the server can decapsulate the encapsulated data packet and determine whether the mobile terminal can access the intranet.

[0194] Continue to see Fig.10 , Fig.10 The corresponding relationship between the data packet encapsulation process and the above steps is provided in the figure, that is, the request header and the request body are separated, and the request body is used as a data packet, corresponding to S201 and S206 respectively, adding a TCP header corresponds to S202 and S207, adding an IP header corresponds to S203, S205 and S208, and adding a MAC header corresponds to S204 and S209. Fig.10 It can be clearly seen that the embodiment of the present application encapsulates the data packet twice. The IP and MAC addresses of the virtual device are added during the first encapsulation. After the full-flow proxy module intercepts the data packet after the first encapsulation, the request issued by the full-flow proxy module is encapsulated again from user state to kernel state, thereby realizing the forwarding of the data packet proxy to the server to realize the request for intranet resources.

[0195] Through the above method, it is possible to encapsulate the same data packet containing the intranet request (intranet access request) without distinguishing the intranet and extranet traffic requests, avoiding the need to distinguish the intranet and extranet operations, thereby enabling users to access the intranet without configuring the system in PAC mode, thereby improving the convenience of intranet access. At the same time, the above method can also achieve intranet access for mobile terminals that do not support proxy software, thus being applicable to more scenarios.

[0196] The following is a description of an exemplary structure of the intranet access device 455 provided in the embodiment of the present application as a software module. In some embodiments, Figure 3 As shown, the software modules stored in the intranet access device 455 of the first memory 450 may include:

[0197] The first encapsulation module 4551 is used to, when detecting an application data packet generated by an application program and containing an intranet access request and identity information, perform first encapsulation on the application data packet to obtain an intermediate data packet; the first encapsulation represents the encapsulation when it is sent to the virtual network card device;

[0198] The data interception module 4552 is used to intercept the intermediate data packet using the full-flow proxy module;

[0199] The re-encapsulation module 4553 is used to re-encapsulate the intermediate data packet to obtain an encapsulated data packet when the full-flow proxy module issues a proxy access request; wherein the re-encapsulation is the encapsulation when performing flow proxy;

[0200] The data sending module 4554 forwards the encapsulated data packet to the server so that the server establishes an intranet access connection.

[0201] In some embodiments of the present application, the first encapsulation module 4551 is also used to add a transport protocol header to the application data packet to obtain a first temporary data packet; add the routing information of the virtual network card device to the header of the first temporary data packet to obtain a second temporary data packet; add the address of the character device to the header of the second temporary data packet to obtain a third temporary data packet; add the routing information of the full-flow proxy module to the header of the third temporary data packet to obtain the intermediate data packet.

[0202] In some embodiments of the present application, the re-encapsulation module 4553 is also used to add a transport protocol header to the intermediate data packet to obtain a first candidate data packet; add the routing information of the server to the header of the first candidate data packet to obtain a second candidate data packet; add the physical address of the server to the header of the second candidate data packet to obtain the encapsulated data packet.

[0203] In some embodiments of the present application, the data interception module 4552 is also used to receive the intermediate data packet transmitted according to the routing information of the full-flow proxy module through the full-flow proxy module.

[0204] The following is a description of an exemplary structure of the intranet access device 255 provided in the embodiment of the present application as a software module. In some embodiments, Figure 4 As shown, the software modules stored in the intranet access device 255 of the second memory 250 may include:

[0205] The data receiving module 2551 is used to receive the encapsulated data packets forwarded by the terminal through the full-flow proxy module;

[0206] The decapsulation module 2552 is used to first decapsulate the encapsulated data packet to obtain an intermediate data packet; and to decapsulate the intermediate data packet again to obtain an application data packet;

[0207] Information extraction module 2553, used to extract identity information from the application data packet;

[0208] The connection establishing module 2554 is used to establish an intranet access connection with the terminal in response to the intranet access request in the application data packet when the identity information is authenticated.

[0209] In some embodiments of the present application, the decapsulation module 2552 is further used to remove the physical address of the server, the routing information of the server, and the transport protocol header from the encapsulated data packet in sequence to obtain the intermediate data packet.

[0210] In some embodiments of the present application, the decapsulation module 2552 is also used to remove the routing information of the full-flow proxy module, the address of the character device, the routing information of the virtual network card device and the transmission protocol header from the intermediate data packet in sequence to obtain the application data packet.

[0211] The embodiment of the present application provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the intranet access method described in the embodiment of the present application.

[0212] An embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein executable intranet access instructions are stored. When the executable intranet access instructions are executed by a first processor, the first processor will be caused to execute the intranet access method provided on the terminal side of the embodiment of the present application; when the executable intranet access instructions are executed by a second processor, the second processor will be caused to execute the intranet access method provided on the server side of the embodiment of the present application.

[0213] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface storage, optical disk, or CD-ROM; or it may be various devices including one or any combination of the above memories.

[0214] In some embodiments, the executable intranet access instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0215] As an example, the executable intranet-accessible instructions may, but do not necessarily, correspond to a file in a file system, may be stored as part of a file storing other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0216] As an example, the executable intranet-accessible instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed at multiple sites and interconnected by a communication network.

[0217] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. An intranet access method, characterized in that: include: When an application data packet generated by an application program and containing an intranet access request and identity information is detected, a transport protocol header is added to the application data packet to obtain a first temporary data packet, routing information of a virtual network card device is added to a header of the first temporary data packet to obtain a second temporary data packet, an address of a character device is added to a header of the second temporary data packet to obtain a third temporary data packet, and routing information of a full-flow proxy module is added to a header of the third temporary data packet to obtain an intermediate data packet; Using the full-flow proxy module to intercept the intermediate data packet; When the full-flow proxy module issues a proxy access request, the intermediate data packet is re-encapsulated to obtain an encapsulated data packet; wherein the re-encapsulation is the encapsulation during the flow proxy; The encapsulated data packet is forwarded to the server so that the server establishes an intranet access connection.

2. The method according to claim 1, characterized in that The step of re-encapsulating the intermediate data packet to obtain an encapsulated data packet includes: Adding a transport protocol header to the intermediate data packet to obtain a first candidate data packet; Adding the routing information of the server to the header of the first candidate data packet to obtain a second candidate data packet; The physical address of the server is added to the header of the second candidate data packet to obtain the encapsulated data packet.

3. The method according to claim 1, characterized in that The transmission protocol header includes any one or more of a transmission control protocol header, a user data packet protocol header and an internetwork protocol header.

4. An intranet access method, characterized in that: include: Receiving the encapsulated data packets forwarded by the terminal through the full-flow proxy module; Decapsulating the encapsulated data packet for the first time to obtain an intermediate data packet; From the intermediate data packet, the routing information of the full-flow proxy module, the address of the character device, the routing information of the virtual network card device and the transport protocol header are removed in sequence to obtain an application data packet, and the identity information is extracted from the application data packet; When the identity information is authenticated, an intranet access connection with the terminal is established in response to the intranet access request in the application data packet.

5. The method according to claim 4, characterized in that The first decapsulation of the encapsulated data packet to obtain an intermediate data packet includes: The physical address of the server, the routing information of the server, and the transport protocol header are removed from the encapsulated data packet in sequence to obtain the intermediate data packet.

6. An intranet access device, characterized in that: include: The first encapsulation module is used for, when detecting an application data packet generated by an application program and containing an intranet access request and identity information, adding a transport protocol header to the application data packet to obtain a first temporary data packet, adding routing information of a virtual network card device to a header of the first temporary data packet to obtain a second temporary data packet, adding an address of a character device to a header of the second temporary data packet to obtain a third temporary data packet, and adding routing information of a full-flow proxy module to a header of the third temporary data packet to obtain an intermediate data packet; A data interception module, used to intercept the intermediate data packet using the full-flow proxy module; A re-encapsulation module, used for re-encapsulating the intermediate data packet to obtain an encapsulated data packet when the full-flow proxy module issues a proxy access request; wherein the re-encapsulation is the encapsulation when performing flow proxy; The data sending module forwards the encapsulated data packet to the server so that the server establishes an intranet access connection.

7. A terminal, characterized in that: include: A first memory, used to store executable intranet access instructions; The first processor is configured to implement the method according to any one of claims 1 to 3 when executing the executable intranet access instruction stored in the first memory.

8. A server, characterized in that: include: A second memory, used for storing executable intranet access instructions; The second processor is used to implement the method described in claim 4 or 5 when executing the executable intranet access instruction stored in the second memory.

9. A computer-readable storage medium, characterized in that: An executable intranet access instruction is stored, which is used to implement the method described in any one of claims 1 to 3 when executed by a first processor; or is used to implement the method described in claim 4 or 5 when executed by a second processor.

10. A computer program product comprising computer executable instructions, characterized in that: The computer executable instructions are used to implement the method according to any one of claims 1 to 3 when executed by a first processor; or are used to implement the method according to claim 4 or 5 when executed by a second processor.

Images