Terminal remote access method, device and medium based on TCP message agent

Abstract

The present invention provides a terminal remote access method based on a TCP message proxy, comprising: configuring remote access permissions for a terminal device; establishing a persistent connection and reporting device information; upon receiving the device information, a cloud server initiates an access information acquisition request to a remote configuration server; upon receiving the access information, the remote configuration server generates and sends access information; the cloud server sends the access information and remote access instructions to the terminal device; upon receiving the access information, the terminal device executes a command to start a TCP proxy function based on the access information to establish a TCP channel between the terminal device and an SSHD server; the cloud server accesses the proxy port opened by the SSHD server and proxies the message to the terminal device's web port via the TCP channel, thereby enabling the cloud server to indirectly remotely access the terminal device's web port. The present invention also provides an electronic device and a computer storage medium, which facilitate remote maintenance of the terminal device's web by maintenance personnel.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a terminal remote access method, device and medium based on a TCP message agent. Background Art

[0002] IoT terminal devices are typically deployed within an intranet. Product function configuration is performed by directly accessing the terminal device's web interface through the intranet. This approach is suitable for simple configurations. However, more complex configurations require the guidance of professional technicians. In these cases, technicians must either be present on-site for configuration, which is labor-intensive, or perform remote configuration, first using remote desktop access to the terminal user's desktop and then connecting to the terminal device's web interface for configuration. This approach requires the terminal user to set up a remote desktop environment, which is complex and exposes the terminal user's computer information.

[0003] There are currently two common solutions for remotely accessing the intranet terminal device WEB from the extranet to perform configuration:

[0004] 1. The first method is to directly use port mapping: This method requires a fixed external network IP for stable external network access, which is generally not possible for normal users.

[0005] 2. The second method is to use TCP message agent: this method mostly requires manufacturers to implement it through self-research.

[0006] ① Self-developed solutions have a long development cycle, high implementation costs, and are not universally applicable. For companies with limited R&D expertise, these solutions are unable to quickly implement remote device web functionality and integrate TCP proxy-based remote device web solutions into their products. Consequently, they are forced to directly implement them through fixed external network mapping ports, resulting in increased maintenance costs and a poor user experience.

[0007] ② Most of these self-developed methods do not take into account the security issues of transmission during remote access between terminal devices and cloud platforms. This leads to the risk of data being intercepted when remotely accessing terminal devices for maintenance.

[0008] ③ Most solutions implement TCP proxy servers through self-research and also implement account authentication for TCP proxy clients. However, they do not consider the security issues of TCP proxy servers well and directly use fixed accounts and passwords for verification. Once the account and password are leaked from the device side, the TCP proxy server will be at risk.

[0009] Therefore, a terminal remote WEB access method is needed that not only realizes the TCP proxy function, but also realizes the TCP proxy service authentication function for security. Summary of the Invention

[0010] To solve the above problems, the present invention provides a terminal remote access method based on TCP message proxy. The terminal user only needs to authorize on the device, and the maintenance personnel can directly access the terminal device WEB for maintenance. The use of TCP proxy can solve the pain point of fixed external network IP.

[0011] The present invention is implemented by the following technical solution: The present invention provides a terminal remote access method based on TCP message agent, the method comprising the following steps:

[0012] Step 1: Configure the remote access rights of the terminal device;

[0013] Step 2: Establish a persistent connection between the terminal device and the cloud server, and report device information to the cloud server;

[0014] Step 3: After receiving the device information, the cloud server initiates an access information acquisition request to the remote configuration server;

[0015] Step 4: After receiving the access information acquisition request, the remote configuration server generates the required access information and sends it to the cloud server;

[0016] Step 5: The cloud server sends the access information and remote access instructions to the terminal device;

[0017] Step 6: After receiving the remote access instruction, the terminal device executes the start TCP proxy function command according to the access information, establishes a TCP channel between the terminal device and the sshd server, and opens the proxy port of the sshd server;

[0018] Step 7: The cloud server accesses the proxy port opened by the sshd server. The proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, thereby enabling the cloud server to indirectly remotely access the web port of the terminal device.

[0019] Furthermore, the step 2 is specifically as follows:

[0020] The terminal device establishes a long connection with the cloud server through the TCP long connection server, and reports the device information to the cloud server through the TCP long connection server.

[0021] Furthermore, the step 4 specifically includes:

[0022] Step 41: After receiving the access information acquisition request, the remote configuration server randomly generates the account number, password, and proxy port information required to establish a TCP message proxy, and records them in the database;

[0023] Step 42: The remote configuration server generates URL information according to the proxy port information and the SSHD address configured when the remote configuration server is started.

[0024] Step 43: The remote configuration server returns the account number, password, proxy port information, sshd address and url information to the cloud server.

[0025] Furthermore, the step 5 specifically includes:

[0026] Step 51: After receiving the information, the cloud server forwards the account number, password, proxy port information and sshd address to the TCP persistent connection server;

[0027] Step 52: After receiving the TCP persistent connection, the server sends the account number, password, proxy port information, sshd address and remote access instruction to the terminal device.

[0028] Furthermore, the step 6 specifically includes:

[0029] Step 61: After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function;

[0030] Step 62: The sshd server finds the corresponding sshd server according to the sshd address;

[0031] Step 63: The sshd server verifies whether the account and password sent by the terminal device are legal by comparing the account and password recorded in the database with the account and password sent by the terminal device. If the verification is successful, it means that the account and password sent by the terminal device are legal, and the TCP channel is established between the ssh client of the terminal device and the sshd port of the sshd server, and the process proceeds to step 64. If the verification fails, it means that the account and password sent by the terminal device are illegal.

[0032] Step 64: The sshd server starts the message proxy function of the corresponding proxy port according to the proxy port information;

[0033] Step 65: The corresponding account number, password and identifier in the database are marked as used, and subsequent verification using the account number, password and proxy port information is not allowed.

[0034] Furthermore, the step 7 specifically includes:

[0035] Step 71: The cloud server accesses the proxy port of the sshd server through the URL information;

[0036] Step 72: The cloud server sends a maintenance message to the proxy port of the sshd server.

[0037] Step 73: After the proxy port of the sshd server receives the maintenance message, it is transmitted to the sshd port of the sshd server, and the sshd port of the sshd server sends it to the established TCP channel, and then sent to the ssh client of the corresponding terminal device through the TCP channel, and then transmitted to the web port of the terminal device by the ssh client of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device.

[0038] Furthermore, the remote configuration server regularly clears the account number, password and proxy port information marked as used in the database.

[0039] Furthermore, the device information includes a MAC address.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the terminal remote access method based on the TCP message agent as described above is implemented.

[0041] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the terminal remote access method based on TCP message agent as described above is implemented.

[0042] The beneficial effects of the present invention are:

[0043] ① The present invention is based on the TCP proxy method to realize the remote access of the cloud server to the web port of the terminal device, without the need for on-site maintenance, which is convenient for operation and maintenance personnel to maintain remotely, with low maintenance costs and good user experience.

[0044] ② A TCP persistent connection server is used to establish a persistent connection between the terminal device and the cloud server. The data transmission process also needs to be carried out through the TCP persistent connection server. The deployed TCP persistent connection server can enable the cloud server to control the web port of the remote access terminal device, ensuring the security of transmission during remote access and avoiding the risk of data interception.

[0045] ③ When establishing a TCP message proxy, use a randomly generated account and password for verification. After successful verification, directly mark the corresponding account and password as used to ensure the security of the TCP message proxy and prevent the TCP message proxy service from being at risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 This is a flow chart of a terminal remote access method based on TCP message proxy provided by an embodiment of the present invention.

[0048] Figure 2 It is a schematic diagram of establishing a TCP channel between a terminal device and a shhd server provided by an embodiment of the present invention.

[0049] Figure 3 is a schematic diagram of an electronic device provided by an embodiment of the present invention.

[0050] Figure 4 It is a schematic diagram of a computer-readable storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention for which protection is sought, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0052] like Figure 1 As shown, an embodiment of the present invention provides a terminal remote access method based on TCP message proxy, the method comprising the following steps:

[0053] Step 1: Configure the remote access rights of the terminal device;

[0054] In this embodiment, the terminal user logs in to the web page of the terminal device, configures the remote access permission of the terminal device, and allows the operation and maintenance personnel to remotely access the web port of the terminal device.

[0055] Step 2: Establish a persistent connection between the terminal device and the cloud server, and report device information to the cloud server;

[0056] In this embodiment, step 2 is specifically as follows:

[0057] The terminal device establishes a persistent connection with the cloud server through the TCP persistent connection server, and reports the device information to the cloud server through the TCP persistent connection server. The device information includes the MAC address, which is literally translated as the Media Access Control Address, also known as the Local Area Network Address (LAN Address), and is a unique network identifier of the terminal device in the network. The TCP persistent connection server is used to establish a persistent connection between the terminal device and the cloud server, and the data transmission process also needs to be carried out through the TCP persistent connection server. The deployed TCP persistent connection server can realize the cloud server's control over the web port of the remote access terminal device, ensuring the security of transmission during remote access and avoiding the risk of data interception.

[0058] Step 3. After receiving the device information, the cloud server finds the corresponding device based on the device information. The operation and maintenance personnel initiate a remote configuration request to the cloud server based on the device information on the cloud server's web page. After receiving the request, the cloud server initiates an access information acquisition request to the remote configuration server. In this embodiment, the operation and maintenance personnel log in to the cloud server's web page, find the corresponding terminal device based on the MAC address, and initiate an access information acquisition request.

[0059] Step 4: After receiving the access information acquisition request, the remote configuration server generates access information required for remotely accessing the web port of the terminal device and sends it to the cloud server;

[0060] In this embodiment, step 4 specifically includes:

[0061] Step 41: After receiving the access information acquisition request, the remote configuration server randomly generates the account, password, and proxy port information required to establish a TCP message proxy, and records them in the database. This is to facilitate subsequent verification of the account and password and to ensure that the generated account, password, and proxy port information are unused.

[0062] Step 42: The remote configuration server generates URL information according to the proxy port information and the SSHD address configured when the remote configuration server is started.

[0063] Step 43: The remote configuration server returns the account number, password, proxy port information, sshd address and url information to the cloud server.

[0064] 1) Account and password: used for authentication when the terminal device initiates the TCP message proxy function to the sshd server;

[0065] 2) Proxy port information: used to facilitate the sshd server to open the corresponding proxy port, which is used to proxy the message to the intranet web port of the terminal device after the TCP message proxy is successfully established;

[0066] 3) sshd address: configured when the remote configuration server is started. It is the address of the sshd server that provides the TCP message proxy service function. Which sshd server to use for TCP message proxy;

[0067] 4) URL information: When the TCP message proxy is established, the address of the web port used to indirectly access the terminal device. The format is: http: / / sshd address:proxy port address

[0068] Step 5: The cloud server sends the access information and remote access instructions to the terminal device;

[0069] In this embodiment, step 5 specifically includes:

[0070] Step 51: After receiving the information, the cloud server forwards the account number, password, proxy port information and sshd address to the TCP persistent connection server;

[0071] Step 52: After receiving the TCP persistent connection, the server encapsulates the account number, password, proxy port information and sshd address, and then sends them together with the remote access instruction to the terminal device.

[0072] At this point, the cloud server has obtained the ur l information, opens a new browser page according to the ur l information, and waits for the TCP message proxy to be successfully established through polling to remotely access and maintain the web port of the terminal device.

[0073] Step 6: After receiving the remote access instruction, the terminal device executes the start TCP proxy function command according to the access information, establishes a TCP channel between the terminal device and the sshd server, and opens the proxy port of the sshd server, thus completing the establishment of the TCP message proxy;

[0074] In this embodiment, step 6 specifically includes:

[0075] Step 61: After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function;

[0076] Step 62: The sshd server finds the corresponding sshd server according to the sshd address;

[0077] Step 63: The sshd server verifies whether the account and password sent by the terminal device are legal by comparing the account and password recorded in the database with the account and password sent by the terminal device. If the verification is successful, it means that the account and password sent by the terminal device are legal, and the TCP channel is established between the ssh client of the terminal device and the sshd port of the sshd server, and the process proceeds to step 64. If the verification fails, it means that the account and password sent by the terminal device are illegal.

[0078] Step 64: The sshd server starts the message proxy function of the corresponding proxy port according to the proxy port information;

[0079] Step 65: Mark the corresponding account, password, and proxy port in the database as used. Subsequent verification using this account, password, and proxy port information is prohibited. The account and password are randomly generated and can only be used once to prevent account and password leakage, which could cause the sshd server's TCP message proxy service to provide TCP message proxy services for services that do not belong to us.

[0080] The remote configuration server regularly clears the account number, password and proxy port information marked as used in the database.

[0081] Generally, there are two ways to authenticate when the ssh client connects to the sshd port: one is based on the account and password interaction method, which requires manual input of the account and password. The other is the key method, in which the client generates a pair of keys and copies the public key to the server, and then can directly use the key for authentication. Obviously, the first method requires interactive input of the account and password and cannot meet actual needs. The second method also has problems in engineering practice. The server must store as many certificates as there are terminal devices, and this long-term authentication method poses a hidden danger to the security of the server. The present invention optimizes the first method and adds a new command line parameter -z to carry the password to remove the interaction. The command to execute to start the TCP proxy function is as follows:

[0082] ssh-vz$Password-fCNR$ProxyPort:l oca l host:$Loca lWebPort$Account@$Sshd IP

[0083] in:

[0084] $Password is the password for sshd verification issued by the TCP persistent connection server

[0085] $ProxyPort is the sshd proxy port information issued by the TCP persistent connection server

[0086] $LocalWebPort is the web port of the terminal device

[0087] $Account is the account number for sshd verification issued by the TCP persistent connection server

[0088] $Sshd IP is the sshd address sent by the TCP persistent connection server

[0089] Step 7: The cloud server accesses the proxy port opened by the sshd server. The proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, thereby enabling the cloud server to indirectly remotely access the web port of the terminal device.

[0090] In this embodiment, step 7 specifically includes:

[0091] Step 71: The cloud server accesses the proxy port of the sshd server through the URL information;

[0092] Step 72: The cloud server sends a maintenance message to the proxy port of the sshd server.

[0093] Step 73: After the proxy port of the sshd server receives the maintenance message, it is transmitted to the sshd port of the sshd server, and the sshd port of the sshd server sends it to the established TCP channel, and then sent to the ssh client of the corresponding terminal device through the TCP channel, and then transmitted to the web port of the terminal device by the ssh client of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device.

[0094] like Figure 2 As shown in the figure, when an ssh client connects to the sshd port, a TCP channel is established, supporting bidirectional communication. On the sshd server, when the ssh client connects to the sshd port, the sshd server opens a proxy port, which proxies messages sent to the proxy port to the established TCP channel for transmission to the terminal device. On the terminal device, when the ssh client connects to the sshd port, it proxies messages received through the TCP channel to the web port. The reverse is also true: data returned from the terminal device's web port is also returned to the proxy port via the TCP channel.

[0095] The IoT cloud platform terminal device remote access to the WEB based on the SSH TCP message proxy uses: cloud server, TCP persistent connection server, RemoteConfig (remote configuration) server, SSHD server, and terminal device integrated with SSH client. The working principle of each component is as follows:

[0096] 1. Cloud server: Serves as the operation portal for operation and maintenance personnel, and connects to the RemoteConfig server and TCP persistent connection server. It receives service requests from operation and maintenance personnel for remote access to the web of a specified terminal device, and opens a new browser page to remotely access the terminal device's web based on the URL information returned by the remote configuration server.

[0097] 2. RemoteConfig Server: This server connects to the cloud server. When remote access is needed on a terminal device's web interface, it receives requests from the cloud server and randomly generates a unique TCP proxy account, password, proxy port information, SSH address, and URL information for subsequent indirect access to the terminal device's web interface. It also regularly cleans up used account, password, and proxy port information.

[0098] 3. TCP persistent connection service: This service connects to the cloud server and terminal devices, receives requests from the cloud server, and controls the terminal devices to connect to the SSHD server for TCP message proxying. It receives the SSHD address, account, password, and proxy port information required for remote web access from the terminal device, then encapsulates this information and sends remote access instructions to the terminal device. Upon receiving the remote web access instructions, the terminal device uses the SSH client to connect to the SSHD port and enable the TCP message proxy function.

[0099] 4. SSHD server: The open source SSHD has been modified to receive SSH client requests from terminal devices for TCP message proxy, thus realizing the TCP message proxy function of SSHD server.

[0100] 5. Terminal Device: Following the instructions from the TCP persistent connection server, the terminal device uses an SSH client to connect to the SSHD port to enable the TCP message proxy function for the terminal device. In actual use, the terminal device interacts with the TCP persistent connection server and responds to remote web access control operations from operations and maintenance. A modified open-source SSHD server receives control signals from the TCP persistent connection server and connects to SSHD to implement the TCP proxy function.

[0101] like Figure 3 As shown, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned terminal remote access method based on TCP message agent when executing the program.

[0102] like Figure 4As shown, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the terminal remote access method based on the TCP message agent is implemented.

[0103] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A terminal remote access method based on TCP message agent, characterized in that: The method comprises the following steps: Step 1: Configure the remote access rights of the terminal device; Step 2: Establish a persistent connection between the terminal device and the cloud server, and report device information to the cloud server; Step 3: After receiving the device information, the cloud server initiates an access information acquisition request to the remote configuration server; Step 4: After receiving the access information acquisition request, the remote configuration server generates the required access information and sends it to the cloud server; Step 5: The cloud server sends the access information and remote access instructions to the terminal device; Step 6: After receiving the remote access instruction, the terminal device executes the start TCP proxy function command according to the access information, establishes a TCP channel between the terminal device and the sshd server, and opens the proxy port of the sshd server; specifically, the steps include: Step 61: After receiving the remote access instruction, the terminal device initiates a command to start the TCP proxy function; Step 62: The sshd server finds the corresponding sshd server according to the sshd address; Step 63: The sshd server verifies whether the account and password sent by the terminal device are legal by comparing the account and password recorded in the database with the account and password sent by the terminal device. If the verification is successful, it means that the account and password sent by the terminal device are legal, and the TCP channel is established between the ssh client of the terminal device and the sshd port of the sshd server, and the process proceeds to step 64. If the verification fails, it means that the account and password sent by the terminal device are illegal. Step 64: The sshd server starts the message proxy function of the corresponding proxy port according to the proxy port information; Step 65: The corresponding account, password, and identifier in the database are marked as used, and subsequent verification using the account, password, and proxy port information is not allowed; Step 7: The cloud server accesses the proxy port opened by the sshd server. The proxy port of the sshd server proxies the message to the web port of the terminal device through the TCP channel, thereby enabling the cloud server to indirectly remotely access the web port of the terminal device.

2. The terminal remote access method based on TCP message agent according to claim 1, characterized in that: The step 2 is specifically as follows: The terminal device establishes a long connection with the cloud server through the TCP long connection server, and reports the device information to the cloud server through the TCP long connection server.

3. The terminal remote access method based on TCP message agent according to claim 2, characterized in that: The step 4 specifically includes: Step 41: After receiving the access information acquisition request, the remote configuration server randomly generates the account number, password, and proxy port information required to establish a TCP message proxy, and records them in the database; Step 42: The remote configuration server generates URL information according to the proxy port information and the SSHD address configured when the remote configuration server is started; Step 43: The remote configuration server returns the account number, password, proxy port information, sshd address and URL information to the cloud server.

4. The terminal remote access method based on TCP message agent according to claim 3, characterized in that: The step 5 specifically includes: Step 51: After receiving the information, the cloud server forwards the account number, password, proxy port information and sshd address to the TCP persistent connection server; Step 52: After receiving the TCP persistent connection, the server sends the account number, password, proxy port information, sshd address and remote access instruction to the terminal device.

5. The terminal remote access method based on TCP message agent according to claim 1, characterized in that: The step 7 specifically includes: Step 71: The cloud server accesses the proxy port of the sshd server through the URL information; Step 72: The cloud server sends a maintenance message to the proxy port of the sshd server. Step 73: After the proxy port of the sshd server receives the maintenance message, it is transmitted to the sshd port of the sshd server, and the sshd port of the sshd server sends it to the established TCP channel, and then sent to the ssh client of the corresponding terminal device through the TCP channel, and then transmitted to the web port of the terminal device by the ssh client of the terminal device, so that the cloud server can indirectly access and maintain the web port of the terminal device.

6. The terminal remote access method based on TCP message agent according to claim 1, characterized in that: The remote configuration server regularly clears the account number, password and proxy port information marked as used in the database.

7. The terminal remote access method based on TCP message agent according to claim 1, characterized in that: The device information includes a MAC address.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the terminal remote access method based on TCP message agent according to any one of claims 1 to 7 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the terminal remote access method based on TCP message agent according to any one of claims 1 to 7 is implemented.

Images