Private network resource configuration method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides a method, device, electronic device and storage medium for resource configuration of a private network. The method for resource configuration of a private network includes: receiving a resource request for a private network sent by a user terminal, the resource request including an identifier of the private network; obtaining a local port corresponding to the private network on a server based on the identifier, and sending the resource request to an intranet penetration client through the local port, the intranet penetration client processes the resources of the private network for the user terminal through a private network proxy service, wherein the intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection to the local port. The embodiment of the present invention realizes the unified security operation and maintenance management of virtual machines or network equipment resources of private networks, especially numerous private networks, and has the advantages of high security and low cost.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a resource configuration method, device, electronic equipment and storage medium for a private network. Background Art

[0002] The use of cloud services is increasing. For example, for enterprises, a large number of servers originally in the intranet environment have been migrated to the cloud and provided services in the form of virtual machines. However, exposing virtual machines on the cloud to the Internet poses a security risk. To this end, cloud service providers provide a private network VPC (Virtual Private Cloud) solution, which can divide cloud virtual machines into a subnet and control Internet access rules through firewalls. This ensures that the server is protected from security attacks on the Internet. In order to ensure the reliability of services, enterprises often choose to use remote multi-mode redundancy, that is, they purchase virtual machines from different cloud service providers at the same time, and each of them has a VPC subnet. For scenarios with multiple VPC subnets or a group company with multiple remote server rooms, the method used for secure unified operation and maintenance is usually to expose the login port of virtualized resources in the VPC subnet, add a bastion host IP (Internet Protocol Address) whitelist on the firewall, and then use the bastion host to uniformly control all virtualized resources. This method requires that all virtualized resources in the VPC must have public IP addresses, which is costly. In addition, many group company server rooms cannot provide many public IP addresses for use, so it is less feasible. Summary of the invention

[0003] In view of the problems in the prior art, embodiments of the present invention provide a method, device, electronic device and storage medium for configuring resources in a private network.

[0004] Specifically, the embodiment of the present invention provides the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention provides a resource configuration method for a private network, which is applied to a server, and the resource configuration method includes:

[0006] receiving a resource request of a private network sent by a user terminal, wherein the resource request includes an identifier of the private network;

[0007] Based on the identifier, a local port corresponding to the private network on the server is obtained, and the resource request is sent to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service.

[0008] The intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection with the local port.

[0009] Furthermore, the server is deployed with a private network server.

[0010] The receiving of the private network resource request sent by the user terminal comprises: the private network server receiving the private network resource request based on the websocket protocol sent by the user terminal through the browser,

[0011] The obtaining of the local port corresponding to the private network on the server based on the identifier includes: the private network server obtaining the local port corresponding to the private network based on the identifier, and forwarding the resource request to the local port.

[0012] Further, the server is deployed with an intranet penetration server, and the resource request is sent to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, including:

[0013] The intranet penetration server listens to the local port, and when the resource request is received at the local port, the resource request is sent to the intranet penetration client through the communication tunnel, so that the intranet penetration client forwards the resource request to the private network proxy service. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0014] Furthermore, the private network proxy service performs private network login authentication from the private network server through the OAuth2 (Open Authorization 2.0) protocol.

[0015] In a second aspect, an embodiment of the present invention provides a resource configuration method for a private network, which is applied to a private network. The resource configuration method includes:

[0016] Receiving a resource request for a private network sent by an intranet penetration server through a local port of a server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by a user terminal to a private network server and sent by the private network server to the local port;

[0017] processing resources of the private network for the user terminal according to the resource request,

[0018] Among them, the intranet penetration server and the private network server are deployed on the server.

[0019] Furthermore, the private network is deployed with an intranet penetration client and a private network proxy service.

[0020] The receiving of the private network resource request sent by the intranet penetration server through the local port of the server comprises: the intranet penetration client receives the private network resource request sent by the intranet penetration server through the local port of the server through a communication tunnel, wherein the intranet penetration client establishes a private communication tunnel with a long connection with the intranet penetration server in advance;

[0021] The processing of the resources of the private network for the user terminal according to the resource request includes: the intranet penetration client forwarding the resource request to the private network proxy service, the private network proxy service obtaining the private network login authentication from the private network server according to the resource request, and processing the resources of the private network for the user terminal after the login authentication is successful.

[0022] In a third aspect, an embodiment of the present invention provides a resource configuration device for a private network, which is applied to a server, and the resource configuration system includes:

[0023] The private network server is used to receive a resource request of the private network sent by the user terminal, the resource request including an identifier of the private network, obtain a local port corresponding to the private network based on the identifier, and forward the resource request to the local port;

[0024] The intranet penetration server is used to monitor the local port and send the resource request to the intranet penetration client deployed in the private network when the resource request is received at the local port, so that the intranet penetration client forwards the resource request to the private network proxy service deployed in the private network. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0025] In a fourth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the resource configuration method for a private network as described in the first aspect or the second aspect are implemented.

[0026] In a fifth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the resource configuration method for a private network as described in the first aspect or the second aspect.

[0027] In a sixth aspect, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program, which, when executed by a processor, implements the steps of the private network resource configuration method as described in the first aspect or the second aspect.

[0028] It can be seen from the above technical solutions that the resource configuration method, device, electronic device and storage medium of the private network provided by the embodiment of the present invention receives the resource request of the private network sent by the user terminal, obtains the local port corresponding to the private network on the server based on the identifier, and sends the resource request to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, and realizes the unified security operation and maintenance management of virtual machines or network equipment resources of private networks, especially numerous private networks. There is no need for the private network to expose the public network IP, thereby avoiding the risk of being invaded, improving the security of the private network, and, especially in the case of many private networks, it is not necessary to configure a public network IP for each private network, effectively reducing costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 A flowchart of a method for configuring resources in a private network provided by an embodiment of the present invention;

[0031] Figure 2 A flowchart of a method for configuring resources in a private network provided by another embodiment of the present invention;

[0032] Figure 3 A structural block diagram of a resource configuration device for a private network provided by an embodiment of the present invention;

[0033] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] Figure 1 FIG. 1 is a flow chart showing a method for configuring resources in a private network according to an embodiment of the present invention. Figure 1 As shown, the resource configuration method of the private network provided by the embodiment of the present invention is applied to the server, and the resource configuration method of the private network includes the following steps:

[0036] Step 101: receiving a resource request of a private network sent by a user terminal, where the resource request includes an identifier of the private network.

[0037] In one embodiment of the present invention, the server is deployed with a private network server, and the receiving of the private network resource request sent by the user terminal includes: the private network server receives the private network resource request based on the websocket protocol (i.e., a protocol for full-duplex communication on a single TCP connection) sent by the user terminal through a browser.

[0038] Step 102: Based on the identifier, obtain the local port corresponding to the private network on the server, and send the resource request to the intranet penetration client through the local port, so that the intranet penetration client can process the resources of the private network for the user terminal through the private network proxy service, wherein the intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection with the local port.

[0039] In one embodiment of the present invention, obtaining the local port corresponding to the private network on the server based on the identifier includes: the private network server obtains the local port corresponding to the private network based on the identifier, and forwards the resource request to the local port.

[0040] In this example, the server is deployed with an intranet penetration server, which sends the resource request to the intranet penetration client through the local port so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, including: the intranet penetration server listens to the local port, and when the resource request is received at the local port, sends the resource request to the intranet penetration client through the communication tunnel, so that the intranet penetration client forwards the resource request to the private network proxy service, the private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0041] In the above example, the private network proxy service performs private network login authentication from the private network server through the OAuth2 protocol, for example.

[0042] In the above description, the private network is VPC, that is, a private network on the public cloud.

[0043] The server is called the central control server, the intranet penetration server is called the intranet penetration server unit, the private network server is called the central control service unit, the intranet penetration client is called the VPC intranet penetration client unit, and the private network proxy service is called the VPC operation and maintenance proxy service unit. In other words, the central control server is deployed with the intranet penetration server unit and the central control service unit; the private network VPC is deployed with the VPC intranet penetration client unit and the VPC operation and maintenance proxy service unit.

[0044] like Figure 2 As shown, a resource configuration method for a private network is applied to a private network, and the resource configuration method includes:

[0045] S201: receiving a resource request for a private network sent by an intranet penetration server through a local port of a server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by a user terminal to a private network server and sent by the private network server to the local port;

[0046] S202: Processing the resources of the private network for the user terminal according to the resource request, wherein the intranet penetration server and the private network server are deployed on the server.

[0047] In one embodiment of the present invention, a private network is deployed with an intranet penetration client and a private network proxy service, and the receiving of a resource request for the private network sent by the intranet penetration server through the local port of the server includes: the intranet penetration client receives the resource request for the private network sent by the intranet penetration server through the local port of the server through a communication tunnel, wherein the intranet penetration client has previously established a long-connected private communication tunnel with the intranet penetration server; and processing the resources of the private network for the user terminal according to the resource request includes: the intranet penetration client forwards the resource request to the private network proxy service, the private network proxy service obtains private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0048] The following describes in detail the resource configuration of the private network VPC in conjunction with the interaction between the private network VPC and the central control server.

[0049] The VPC intranet penetration client unit establishes a long connection with the intranet penetration service unit on the central control server in advance through a socket (i.e., a communication tunnel), and uses the OAuth2 protocol to complete identity authentication to the central control service unit. Among them, the socket connection established between the VPC intranet penetration client unit and the intranet penetration service unit mainly plays the role of a communication tunnel. Using the OAuth2 protocol for identity authentication can prevent the intranet penetration service unit from being maliciously attacked, thereby improving its security. In addition, the VPC intranet penetration client unit can be flexibly authorized and access controlled in the central control service unit.

[0050] The intranet penetration server unit listens to the local port on the central control server and forwards the traffic of the local port to the socket connection established with the VPC intranet penetration client unit, that is, sends it to the above-mentioned communication tunnel. In this example, the local port that the intranet penetration server unit listens to on the central control server can only be accessed locally, avoiding scanning and malicious attacks due to the exposure of the local port to the Internet, thereby improving its security. The traffic forwarding of the local port must ensure that it is transferred to the correct VPC intranet penetration client unit. Therefore, when the socket is established, the local port and the socket (that is, the communication tunnel) need to be mapped.

[0051] After the above preparations are completed, when the user terminal configures resources and calls resources for a private network VPC, the user terminal cannot directly access the private network VPC through the Internet, but sends a resource request to the central control service unit, that is, the central control service unit receives the operation and maintenance VPC resource request (i.e., resource request) sent by the user terminal through the browser, such as the websocket protocol-based operation and maintenance VPC resource request (i.e., resource request). In this example, the browser of the user terminal can be any browser that supports the websocket protocol. Since the central control service unit does not need to process the websocket request, it only needs to provide a websocket proxy service to forward the websocket request to the local port monitored by the intranet penetration service unit.

[0052] The central control service unit uses the VPC unique identifier (i.e., the private network identifier) ​​carried in the resource request to find the local port corresponding to the private network VPC from the local port mapping relationship, and uses the reverse proxy technology to forward the websocket request to the local port. In this example, the websocket request carries the VPC unique identifier, and it is necessary to ensure that the resources operated by the current resource request belong to the private network VPC. Based on the VPC unique identifier, the central control service unit finds the local port corresponding to the private network VPC from the mapping relationship between the local port and the private network VPC saved in the intranet penetration service unit, and then uses the nginx reverse proxy technology to forward the websocket request to the local port.

[0053] The intranet penetration server unit forwards the traffic of the local port to the socket connection established with the VPC intranet penetration client unit. It should be noted that when the local port monitored by the intranet penetration server unit receives data, it is forwarded to the socket connection established between the local port and the VPC intranet penetration client unit. At the same time, when the intranet penetration server unit receives data from the socket connection established with the VPC intranet penetration client unit, it is forwarded to the local port mapped to the socket connection established with the VPC intranet penetration client unit. Thus, the data will be returned to nginx and transmitted back to the browser of the user terminal.

[0054] The VPC intranet penetration client unit receives the operation and maintenance VPC resource request forwarded from the intranet penetration server unit. In this example, a long connection is established between the VPC intranet penetration client unit and the intranet penetration server unit. This long connection can act as a communication tunnel. When data reaches the intranet penetration server unit, it will be forwarded to the VPC intranet penetration client unit, and when data reaches the VPC intranet penetration client unit, it will be forwarded to the intranet penetration server unit.

[0055] The VPC intranet penetration client unit forwards the traffic of the local port to the service port of the VPC operation and maintenance proxy service unit through the port forwarding technology. Specifically, the VPC intranet penetration client unit forwards the received data to the service port of the VPC operation and maintenance proxy service unit without processing the data.

[0056] After receiving the resource request, the VPC operation and maintenance agent service unit requests the login information and authentication information pre-set for the operated and maintained resource from the central control service unit. The login information includes the resource address, port, and protocol, and the authentication information includes the login name and password. Specifically, the VPC operation and maintenance agent service unit, as the core operation and maintenance agent service, is the unit that ultimately processes the user's operation and maintenance resource request. When receiving a websocket request for an operation and maintenance resource, it first establishes a connection with the websocket, receives the request parameters passed by the websocket connection, and requests the login information and authentication information of the resource from the central control service unit based on the operation and maintenance resource ID in the parameters. The login information and authentication information of the resource can be preset or provided in the central control service unit with corresponding management functions, and entered by the administrator. At the same time, when initiating a request, OAuth2 is also required for identity authentication. Only when the authentication is passed can the request respond to data normally.

[0057] The VPC operation and maintenance proxy service unit uses the login information and authentication information to initiate a remote login request to the resources in the VPC. In this example, the VPC operation and maintenance proxy service unit needs to complete resource login according to the resource remote login protocol and can use the corresponding remote login method, including but not limited to SSH, TELNET, VNC, RDP and other protocols.

[0058] When the VPC operation and maintenance agent service unit successfully logs in to the resource, it can save the current login connection in the memory and map it with the websocket connection. Among them, the resource login connection is generally a long connection, which is related to the login protocol. After the login is successful, the login connection needs to be mapped to the websocket connection to ensure that the traffic can be forwarded normally in the two connections.

[0059] The VPC operation and maintenance agent service unit continuously reads data from the login connection and forwards it to the websocket connection mapped to it. Specifically, the login connection object is the desktop service or character shell service of the resource, and the received data is generally desktop graphics drawing data or character display data. Here, it is necessary to perform protocol analysis and processing on the various types of login protocol data received, and convert them into custom protocol data to facilitate subsequent unified identification and processing on the browser side.

[0060] The browser terminal of the user terminal continuously receives websocket connection data, and the front-end data processing unit draws the resource desktop in the browser according to the remote desktop protocol and CSS3 2D graphics rendering technology. In this example, the browser terminal of the user terminal receives data from the websocket connection, can identify the data according to the custom protocol, and call the front-end graphics rendering technology related API according to the identified instructions to complete the graphics drawing work.

[0061] The user terminal can operate the mouse and keyboard on the browser resource desktop, and the front-end data processing unit converts the operation into custom protocol data and sends it to the websocket connection. That is, the websocket connection can receive input data from the user terminal, including but not limited to mouse and keyboard operations, and keyboard operations include single keys and complex combination keys.

[0062] The VPC operation and maintenance proxy service unit receives user operation data from the websocket connection and forwards the data to the mapped resource login connection. Specifically, the VPC operation and maintenance proxy service unit receives user operation data from the websocket connection, and also needs to perform data protocol parsing, and converts it into corresponding operation instruction data according to the current login resource protocol and sends it to the resource login connection mapped to the websocket. Thus, the user terminal realizes the operation and maintenance management of the private network VPC.

[0063] According to the resource configuration method of the private network of the embodiment of the present invention, by receiving the resource request of the private network sent by the user terminal, obtaining the local port corresponding to the private network on the server based on the identifier, and sending the resource request to the intranet penetration client through the local port, the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, and realizes the unified security operation and maintenance management of virtual machines or network equipment resources of private networks, especially numerous private networks. There is no need to expose the public network IP of the private network, thereby avoiding the risk of being invaded, improving the security of the private network, and, especially in the case of numerous private networks, it is not necessary to configure the public network IP for each private network, effectively reducing the cost.

[0064] Figure 3 FIG. 1 is a schematic diagram showing the structure of a resource configuration device for a private network provided by an embodiment of the present invention. Figure 3 As shown, the private network resource configuration device provided in this embodiment is applied to a server, including: a private network server 31 and an intranet penetration server 32, wherein:

[0065] The private network server 31 is used to receive a private network resource request sent by a user terminal, the resource request including an identifier of the private network, obtain a local port corresponding to the private network based on the identifier, and forward the resource request to the local port;

[0066] The intranet penetration server 32 is used to monitor the local port, and when the resource request is received at the local port, the resource request is sent to the intranet penetration client deployed in the private network, so that the intranet penetration client forwards the resource request to the private network proxy service deployed in the private network. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0067] According to the private network resource configuration device of the embodiment of the present invention, by receiving the private network resource request sent by the user terminal, obtaining the local port corresponding to the private network on the server based on the identifier, and sending the resource request to the intranet penetration client through the local port, the intranet penetration client processes the private network resources for the user terminal through the private network proxy service, thereby realizing the unified security operation and maintenance management of virtual machines or network equipment resources of private networks, especially numerous private networks. There is no need to expose the public network IP of the private network, thereby avoiding the risk of being invaded, improving the security of the private network, and, especially in the case of numerous private networks, it is not necessary to configure a public network IP for each private network, effectively reducing the cost.

[0068] According to one embodiment of the present invention, the server is deployed with a private network server.

[0069] The receiving of the private network resource request sent by the user terminal comprises: the private network server receiving the private network resource request based on the websocket protocol sent by the user terminal through the browser,

[0070] The obtaining of the local port corresponding to the private network on the server based on the identifier includes: the private network server obtaining the local port corresponding to the private network based on the identifier, and forwarding the resource request to the local port.

[0071] According to one embodiment of the present invention, the server is deployed with an intranet penetration server, and the resource request is sent to the intranet penetration client through the local port so that the intranet penetration client processes the resources of the private network for the user terminal through a private network proxy service, including:

[0072] The intranet penetration server listens to the local port, and when the resource request is received at the local port, the resource request is sent to the intranet penetration client through the communication tunnel, so that the intranet penetration client forwards the resource request to the private network proxy service. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

[0073] According to one embodiment of the present invention, the private network proxy service performs private network login authentication from the private network service end through the OAuth2 protocol.

[0074] Since the private network resource configuration device provided in the embodiment of the present invention can be used to execute the private network resource configuration method described in the above embodiment, its working principle and beneficial effects are similar, so they are not described in detail here. For specific contents, please refer to the introduction of the above embodiment.

[0075] In this embodiment, it should be noted that the various modules in the device of the embodiment of the present invention can be integrated into one or deployed separately. The above modules can be combined into one module or further divided into multiple sub-modules.

[0076] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see Figure 4 , the electronic device specifically includes the following contents: a processor 401, a memory 402, a communication interface 403 and a communication bus 404;

[0077] The processor 401, the memory 402, and the communication interface 403 communicate with each other via the communication bus 404;

[0078] The processor 401 is used to call the computer program in the memory 402. When the processor executes the computer program, all steps of the above-mentioned private network resource configuration method are implemented. For example, when the processor executes the computer program, the following process is implemented: receiving a private network resource request sent by a user terminal, the resource request includes an identifier of the private network; obtaining a local port corresponding to the private network on the server based on the identifier, and sending the resource request to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, wherein the intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection with the local port; or, receiving a private network resource request sent by the intranet penetration server through the local port of the server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by the user terminal to the private network server and sent by the private network server to the local port; processing the resources of the private network for the user terminal according to the resource request, wherein the intranet penetration server and the private network server are deployed on the server.

[0079] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0080] Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, all steps of the above-mentioned private network resource configuration method are implemented. For example, when the processor executes the computer program, the following process is implemented: receiving a resource request for a private network sent by a user terminal, the resource request including an identifier of the private network; obtaining a local port corresponding to the private network on the server based on the identifier, and sending the resource request to an intranet penetration client through the local port, so that the intranet penetration client can provide a resource request to the user terminal through a private network proxy service. The end processes the resources of the private network, wherein the intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection with the local port; or, receives a resource request for the private network sent by the intranet penetration server through the local port of the server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by the user terminal to the private network server and sent by the private network server to the local port; processes the resources of the private network for the user terminal according to the resource request, wherein the intranet penetration server and the private network server are deployed on the server.

[0081] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0082] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, all steps of the above-mentioned private network resource configuration method are implemented. For example, when the processor executes the computer program, the following process is implemented: receiving a private network resource request sent by a user terminal, the resource request including an identifier of the private network; obtaining a local port corresponding to the private network on the server based on the identifier, and sending the resource request to an intranet penetration client through the local port, so that the intranet penetration client processes the private network for the user terminal through a private network proxy service; The method comprises the following steps: receiving the resources of a network having an intranet penetration client and the private network proxy service being deployed in the private network, and the intranet penetration client pre-establishing a private communication tunnel having a long connection with the local port; or receiving a resource request of a private network sent by an intranet penetration server through a local port of a server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by a user terminal to a private network server and sent by the private network server to the local port; and processing the resources of the private network for the user terminal according to the resource request, wherein the intranet penetration server and the private network server are deployed on the server.

[0083] It can be understood that the detailed functions and extended functions that can be executed by the computer program can refer to the description of the above embodiments.

[0084] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0085] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. Those of ordinary skill in the art may understand and implement them without creative effort.

[0086] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the traffic audit method described in each embodiment or some parts of the embodiment.

[0087] In addition, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0088] In addition, in the present invention, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for configuring resources in a private network, characterized in that: Applied to a server, the resource configuration method includes: receiving a resource request of a private network sent by a user terminal, wherein the resource request includes an identifier of the private network; Based on the identifier, a local port corresponding to the private network on the server is obtained, and the resource request is sent to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service. Among them, the intranet penetration client and the private network proxy service are deployed in the private network, and the intranet penetration client pre-establishes a private communication tunnel with a long connection with the local port. Among them, the local port listened by the intranet penetration client on the server can only be accessed locally. When establishing the communication tunnel, it is necessary to map the local port and the communication tunnel.

2. The method for configuring resources in a private network according to claim 1, characterized in that: The server is deployed with a private network server. The receiving of the private network resource request sent by the user terminal comprises: the private network server receiving the private network resource request based on the websocket protocol sent by the user terminal through the browser, The obtaining of the local port corresponding to the private network on the server based on the identifier includes: the private network server obtaining the local port corresponding to the private network based on the identifier, and forwarding the resource request to the local port.

3. The method for configuring resources in a private network according to claim 2, characterized in that: The server is deployed with an intranet penetration server, and the resource request is sent to the intranet penetration client through the local port, so that the intranet penetration client processes the resources of the private network for the user terminal through the private network proxy service, including: The intranet penetration server listens to the local port, and when the resource request is received at the local port, the resource request is sent to the intranet penetration client through the communication tunnel, so that the intranet penetration client forwards the resource request to the private network proxy service. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful.

4. The method for configuring resources in a private network according to claim 3, characterized in that: The private network proxy service performs private network login authentication from the private network service end through the OAuth2 protocol.

5. A method for configuring resources in a private network, characterized in that: Applied to a private network, the resource configuration method includes: Receiving a resource request for a private network sent by an intranet penetration server through a local port of a server, wherein the resource request includes an identifier of the private network, and the resource request is a resource request sent by a user terminal to a private network server and sent by the private network server to the local port; processing resources of the private network for the user terminal according to the resource request, Among them, the intranet penetration server and the private network server are deployed on the server, wherein the private network is deployed with an intranet penetration client, and the intranet penetration client pre-establishes a long-connected private communication tunnel with the intranet penetration server; the local port listened by the intranet penetration client on the server can only be accessed locally, and when establishing a communication tunnel, it is necessary to map the local port and the communication tunnel.

6. The method for configuring resources in a private network according to claim 5, characterized in that: The private network is deployed with a private network proxy service, The receiving of the private network resource request sent by the intranet penetration server through the local port of the server comprises: the intranet penetration client receiving the private network resource request sent by the intranet penetration server through the local port of the server through the communication tunnel; The processing of the resources of the private network for the user terminal according to the resource request includes: the intranet penetration client forwarding the resource request to the private network proxy service, the private network proxy service obtaining the private network login authentication from the private network server according to the resource request, and processing the resources of the private network for the user terminal after the login authentication is successful.

7. A resource configuration device for a private network, characterized in that: Applied to a server, the resource configuration system comprises: The private network server is used to receive a resource request of the private network sent by the user terminal, the resource request including an identifier of the private network, obtain a local port corresponding to the private network based on the identifier, and forward the resource request to the local port; The intranet penetration server is used to listen to the local port, and when the local port receives the resource request, the resource request is sent to the intranet penetration client deployed in the private network, so that the intranet penetration client forwards the resource request to the private network proxy service deployed in the private network. The private network proxy service obtains the private network login authentication from the private network server according to the resource request, and processes the resources of the private network for the user terminal after the login authentication is successful. The local port listened by the intranet penetration client on the server can only be accessed locally. When establishing a communication tunnel, it is necessary to map the local port with the communication tunnel.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the resource configuration method for a private network according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the resource configuration method of the private network according to any one of claims 1 to 6 is implemented.

10. A computer program product, the computer program product comprising a computer program, characterized in that: When the computer program is executed by a processor, the resource configuration method of the private network according to any one of claims 1 to 6 is implemented.

Images