Communication methods, computer-readable storage media, and communication systems for enterprise intranets

Abstract

This application provides a communication method, computer-readable storage medium, and communication system for an enterprise intranet. The method includes: a server receiving an access request sent by a target client; communication between the server and the target client via a target network tunnel, whereby the target network tunnel is a communication tunnel used within the enterprise's internal network; the server authenticating the information to be authenticated and obtaining the authentication result; and, if the authentication result indicates successful authentication, the server responding to the access request by controlling the opening of a target browser to allow the target client to access the server. The target browser is a browser specifically designed for the enterprise's internal network and integrates various browser plugins. This solution utilizes a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise intranets, thereby achieving the encapsulation of addresses for internal application systems and enabling secure access to internal enterprise resources.

Description

Technical Field

[0001] This application relates to the field of data communication, and more specifically, to a communication method, server, computer-readable storage medium, and communication system for an enterprise intranet. Background Technology

[0002] With the promotion and application of enterprise information systems, higher demands are placed on the user experience and access efficiency of business systems. During system use, there are urgent needs regarding the installation and debugging of information systems, unified browser authentication, compatibility, and security. Because lightweight enterprise applications rely on third-party browsers for access, they are susceptible to data leaks and attacks on internal application systems. Summary of the Invention

[0003] The main purpose of this application is to provide a communication method, server, computer-readable storage medium, and communication system for enterprise intranets, in order to solve the problem in the prior art that the reliance of enterprise internal lightweight application systems on third-party browsers for access can easily lead to data leakage and attacks on the enterprise's internal application systems.

[0004] According to one aspect of the present invention, a communication method for an enterprise intranet is provided, comprising: a server acquiring an access request sent by a target client, the server and the target client communicating through a target network tunnel, the target network tunnel being a tunnel used for communication within the enterprise intranet, the access request further including authentication information of the target client; the server authenticating the authentication information and obtaining an authentication result; the server responding to the access request and controlling a target browser to open so that the target client can access the server if the authentication result indicates successful authentication, wherein the target browser is a browser specifically designed for enterprise use and integrates various browser plugins.

[0005] Optionally, the information to be authenticated includes tunnel information to be authenticated and user information to be authenticated. The tunnel information to be authenticated includes at least a tunnel ID, and the user information to be authenticated includes at least a username and a password. The server authenticates the information to be authenticated and obtains an authentication result, including: the server authenticates the tunnel information to be authenticated to obtain a first authentication result; and if the first authentication result indicates that the authentication is successful, the server authenticates the user information to be authenticated to obtain a second authentication result.

[0006] Optionally, the server authenticates the tunnel authentication information to obtain a first authentication result, including: the server determining whether the tunnel authentication information is the same as reference tunnel authentication information, wherein the reference tunnel authentication information is stored in a target database; if the tunnel authentication information is the same as the reference tunnel authentication information, the server determines that the tunnel authentication information has passed authentication; if the tunnel authentication information is different from the reference tunnel authentication information, the server determines that the tunnel authentication information has failed authentication; if the first authentication result indicates that authentication has passed, the server authenticates the user authentication information to obtain a second authentication result, including: the server determining whether the user authentication information is the same as reference user authentication information, wherein the reference user authentication information is stored in the target database; if the user authentication information is the same as the reference user authentication information, the server determines that the user authentication information has passed authentication; if the user authentication information is different from the reference user authentication information, the server determines that the user authentication information has failed authentication.

[0007] Optionally, after controlling the target browser to open so that the target client can access the server, the method further includes: the server obtaining the importance level of the target file; if the importance level of the target file is the first importance level, when receiving a download request from the target client, the server determines that the target client is not allowed to download the target file, but only allowed to view the target file online, and adds a watermark to the target file when the target client views the target file online; if the importance level of the target file is the second importance level, when receiving the download request from the target client, the server determines that the target client is allowed to download the target file, and sends the target file to the target client, wherein the importance level of the first importance level is higher than the importance level of the second importance level.

[0008] Optionally, after controlling the target browser to open so that the target client can access the server, the method further includes: the server hiding the browser address of the target browser from the target client; and the server hiding the webpage source code of the target browser from the target client.

[0009] Optionally, after controlling the target browser to open so that the target client can access the server, the method further includes: the server obtaining the type of the target client; if the type of the target client is a first type and the server detects that the current operation event of the target client is a preset operation event, the server prohibits the target client from operating the current operation event, wherein the preset operation event includes at least one of the following: a share event, a copy event, and a jump event; if the type of the target client is a second type and the server detects that the current operation event of the target client is the preset operation event, the server allows the target client to operate the current operation event, wherein the permissions of the target client of the first type are less than the permissions of the target client of the second type.

[0010] Optionally, the method further includes: the server determining to update the tunnel information of the target network tunnel when the update conditions are met, the update conditions including at least one of the following: the server goes offline, the target network tunnel through which the server communicates with the target client cannot transmit data, the server receives an update request, and the tunnel information includes at least tunnel address information; when the server determines to update the tunnel information of the target network tunnel, the server reconfigures the tunnel information of the target network tunnel and re-establishes a connection with the target client through the updated target network tunnel.

[0011] According to another aspect of the present invention, a server is also provided, comprising: a first acquisition unit, configured to acquire an access request sent by a target client, wherein the server and the target client communicate via a target network tunnel, the target network tunnel being a tunnel used for communication within an enterprise's internal network, and the access request further comprising authentication information of the target client; an authentication unit, configured to authenticate the authentication information and obtain an authentication result; and a first processing unit, configured to, upon the authentication result indicating successful authentication, respond to the access request and control a target browser to open so that the target client can access the server, wherein the target browser is a browser specifically designed for internal use within the enterprise and integrates various browser plugins.

[0012] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the methods described.

[0013] According to another aspect of the present invention, a communication system is also provided, comprising: a client and a server, wherein the client and the server communicate with each other, and the server is configured to perform any of the methods described herein.

[0014] In this embodiment of the invention, the server first obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel. Then, the server authenticates the information to be authenticated and obtains the authentication result. Finally, if the authentication result indicates successful authentication, the server responds to the access request and controls the target browser to open, allowing the target client to access the server. This scheme employs a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise internal networks. This encapsulates the addresses of internal application systems, enabling secure access to internal enterprise resources. Attached Figure Description

[0015] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0016] Figure 1 A flowchart illustrating a communication method for an enterprise intranet according to an embodiment of this application is shown.

[0017] Figure 2 A schematic diagram of the structure of a server according to an embodiment of this application is shown;

[0018] Figure 3 A flowchart illustrating another communication method for an enterprise intranet is shown. Detailed Implementation

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] It should be understood that when an element (such as a layer, film, region, or substrate) is described as being "on" another element, the element may be directly on the other element, or there may be an intermediate element present. Furthermore, in the specification and claims, when an element is described as being "connected" to another element, the element may be "directly connected" to the other element, or "connected" to the other element via a third element.

[0023] Currently, most enterprise lightweight applications use tunnel encryption for external network access, but they do not use tunnel encryption for internal network access. The encryption methods are simple, rely on third-party browsers, and have limited access. Data transmission between application systems cannot reach absolute security standards, which can easily lead to data leakage and attacks on application systems.

[0024] As mentioned in the background section, existing technologies often lead to data leaks and attacks on enterprise internal application systems because these systems rely on third-party browsers. To address these issues, this application provides a typical implementation of a communication method, server, computer-readable storage medium, and communication system for an enterprise intranet.

[0025] According to an embodiment of this application, a communication method for an enterprise intranet is provided.

[0026] Figure 1 This is a flowchart of a communication method for an enterprise intranet according to an embodiment of this application. For example... Figure 1 As shown, the method includes the following steps:

[0027] Step S101: The server obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel, which is a tunnel used for communication within the enterprise's internal network. The access request also includes the authentication information of the target client.

[0028] Specifically, the target network tunnel can be encrypted through custom interface configurations. The encryption algorithm can be AES, or a custom-configured algorithm. This allows for the encryption of addresses of internal enterprise application systems, thereby enabling secure access to internal resources.

[0029] Specifically, the custom algorithm process can be as follows: Combine the interface header parameters with base64 encryption to form the first part: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9; Define the payload to generate the second part through AES encryption: U2FsdGVkX18h8yjv7jAJwRm9IFPCT6JCBXz9PhEyHVovuaRef+CHrFMMBn7Vd5Di; Concatenate the two parts to obtain:

[0030] The string obtained is a custom encryption algorithm.

[0031] In step S101 above, establishing a target network tunnel between the server and the target client prevents web crawler data leakage. Dynamic tunnel access provides a superior user experience, facilitating enterprise IT strategy development, improving user experience, and ensuring secure data access. Furthermore, managing lightweight enterprise applications through custom configuration and binding them to a secure target network tunnel enables secure application access.

[0032] Step S102: The server authenticates the information to be authenticated and obtains the authentication result.

[0033] In step S102 above, the information to be authenticated can be authenticated, which further ensures that the target client for internal communication within the enterprise can be authenticated, thereby further ensuring the security of internal data within the enterprise.

[0034] In step S103, if the authentication result indicates that the authentication is successful, the server responds to the access request and controls the target browser to open so that the target client can access the server. The target browser is a browser used internally by the enterprise and integrates various browser plugins.

[0035] Specifically, browser plugins can include Flash plugins, video playback plugins, etc. The masking server can be compatible with multiple plugins and avoids the duplication of multiple installations.

[0036] In step S103 above, unified compatibility configuration and parameter distribution, as well as unified plugin distribution, can be performed according to the browser environment requirements of different lightweight application systems, achieving modular and configurable management. This enables lightweight desktop and web applications, ensuring program execution security and preventing ActiveX controls within web pages from executing malicious code. Furthermore, through dynamic kernel management, it can be compatible with the page characteristics of different systems.

[0037] In the above method, the server first obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel. Then, the server authenticates the information to be authenticated and obtains the authentication result. Finally, if the authentication result indicates successful authentication, the server responds to the access request and controls the target browser to open, allowing the target client to access the server. This scheme, by using a dedicated server and establishing a dedicated target network tunnel within the enterprise, encapsulates proprietary communication lines between multiple enterprise internal networks, thereby achieving the encapsulation of addresses for internal application systems and enabling secure access to internal enterprise resources.

[0038] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0039] Specifically, this solution allows the establishment of access rules (with customizable configuration) between users and the system, determining whether to allow or deny users access to resources on the controlled system. These rules can be configured to control the rule engine, application visibility, and application operation logs, with control granularity at the individual user level. Furthermore, a custom-configured browser can integrate various browser plugins, eliminating reliance on third-party browsers.

[0040] Furthermore, this solution allows access to the target server of the connected lightweight application, enabling all applications to load and access resources remotely from the server, ensuring unified distribution and secure management of all resources.

[0041] To further improve the efficiency of authenticating the information to be authenticated and ensure more accurate authentication results, in one embodiment of this application, the information to be authenticated includes tunnel authentication information and user authentication information. The tunnel authentication information includes at least a tunnel ID, and the user authentication information includes at least a username and password. The server authenticates the information to be authenticated and obtains the authentication result, specifically including the following steps:

[0042] Step S201: The server authenticates the tunnel authentication information to obtain the first authentication result.

[0043] In one specific embodiment of this application, the server authenticates the tunnel authentication information to obtain a first authentication result, including: the server determining whether the tunnel authentication information is the same as reference tunnel authentication information, wherein the reference tunnel authentication information is stored in a target database; if the tunnel authentication information is the same as the reference tunnel authentication information, the server determines that the tunnel authentication information has passed authentication; if the tunnel authentication information is different from the reference tunnel authentication information, the server determines that the tunnel authentication information has failed authentication. In this embodiment, the tunnel authentication information can be authenticated by comparing it with the reference tunnel authentication information, thereby ensuring that the target network tunnel to be connected can be authenticated, further ensuring the security of data within the enterprise.

[0044] In step S202, if the first authentication result indicates that the authentication is successful, the server authenticates the user's information to be authenticated to obtain a second authentication result.

[0045] In one specific embodiment of this application, when the first authentication result indicates successful authentication, the server authenticates the user's authentication information to obtain a second authentication result. This includes: the server determining whether the user's authentication information is the same as reference user authentication information, which is stored in the target database; if the user's authentication information is the same as the reference user authentication information, the server determines that the user's authentication information has passed; if the user's authentication information is different from the reference user authentication information, the server determines that the user's authentication information has failed. In this embodiment, the user's authentication information can be authenticated by comparing it with reference user authentication information, thereby ensuring that the target client connecting to the target network tunnel can be authenticated, further guaranteeing the security of internal enterprise data.

[0046] In steps S201 to S202 above, the tunnel information to be authenticated can be authenticated first. If the tunnel information to be authenticated fails to be authenticated, it will not be able to be authenticated no matter how the user information to be authenticated is authenticated. If the tunnel information to be authenticated passes the authentication, then the user information to be authenticated is authenticated again. This two-stage authentication method further ensures higher authentication efficiency and can further guarantee the security of internal enterprise data.

[0047] In one optional embodiment, the server of this solution also includes a function for filling in user authentication information. Based on the browser and related configurations, the input boxes corresponding to the username and password can be captured, and the corresponding username and password can be automatically filled in. Each client has corresponding information to be filled in, which can be bound in advance. This can solve the problem of single sign-on maintenance for old business systems and the need for employees to record and fill in multiple account passwords every time they access the business system.

[0048] Since some access applications may access sensitive internal enterprise data, users may perform operations such as taking screenshots of web pages and downloading files, which could spread this data and lead to the possibility of data leakage, thereby causing the leakage of internal enterprise data. In another embodiment of this application, after controlling the target browser to open so that the target client can access the server, the method further includes the following steps:

[0049] Step S301: The server obtains the importance level of the target file;

[0050] In step S302, when the target file is classified as having the highest importance level, the server determines that the target client is not allowed to download the target file when it receives a download request from the target client. Instead, the server only allows the target client to view the target file online and adds a watermark to the target file when the target client views it online.

[0051] Specifically, online viewing can be achieved by converting the target file into a PDF format and viewing it in a browser.

[0052] In step S303, when the target file is classified as having the second most important level, the server, upon receiving the download request from the target client, determines to allow the target client to download the target file and sends the target file to the target client. The first most important level is more important than the second most important level.

[0053] In steps S301 to S303 above, watermarking is added to the target file according to its importance level, and the file is configured to allow downloads, which can effectively protect sensitive data within the enterprise and ensure the secure flow of data.

[0054] To further protect internal enterprise data and address the issue of data breaches leading to attacks on internal application systems, in another embodiment of this application, after controlling the target browser to open so that the target client can access the server, the method further includes the following steps:

[0055] Step S401: The server hides the browser address of the target browser from the target client.

[0056] Step S402: The server hides the webpage source code of the target browser from the target client.

[0057] In steps S401 to S402 above, an embedded framework can be developed to perform secondary kernel encapsulation on the data inside the enterprise, which can hide relevant access information of the target browser, such as browser address and webpage source code, to further ensure the data security inside the enterprise.

[0058] To further protect internal enterprise data and address the issue of data breaches leading to attacks on internal application systems, in another embodiment of this application, after controlling the target browser to open so that the target client can access the server, the method further includes the following steps:

[0059] Step S501: The server obtains the type of the target client.

[0060] Step S502: When the target client is of type 1 and the server detects that the target client's current operation event is a preset operation event, the server prohibits the target client from operating the current operation event. The preset operation event includes at least one of the following: sharing event, copying event, and jump event.

[0061] In step S503, when the target client is of type 2 and the server detects that the current operation event of the target client is the preset operation event, the server allows the target client to operate the current operation event, wherein the permissions of the target client of type 1 are less than the permissions of the target client of type 2.

[0062] In steps S501 to S503 above, an embedded framework can be developed to perform secondary kernel encapsulation on the enterprise's internal data, or on the enterprise's preset operations, thereby further ensuring the security of the enterprise's internal data.

[0063] In one embodiment, the transmitted parameters can also be encrypted, which can further ensure the data security within the enterprise.

[0064] Specifically, unified configuration management can be used to configure the corresponding permissions for different types of target clients. Different types of target clients can be configured with their own dedicated network tunnels, and different network tunnels and encryption methods can be authorized for different types of target clients. For example, network tunnel startup type, network tunnel address, encryption method, and dynamic connection can be configured.

[0065] During the communication between the server and the target client, the tunnel information of the target network tunnel can also be updated to ensure high availability during the communication process. In an optional embodiment of this application, the above method further includes the following steps:

[0066] Step S601: If the update conditions are met, the server determines to update the tunnel information of the target network tunnel. The update conditions include at least one of the following: the server goes offline, the target network tunnel through which the server communicates with the target client cannot transmit data, or the server receives an update request. The tunnel information includes at least tunnel address information.

[0067] In step S602, if the server determines that the tunnel information of the target network tunnel needs to be updated, it reconfigures the tunnel information of the target network tunnel and re-establishes a connection with the target client through the updated target network tunnel.

[0068] In steps S601 to S602 above, if it is determined that the tunnel information of the target network tunnel needs to be updated, the target network tunnel can be reconfigured on the server side, the tunnel information can be automatically updated according to the newly received tunnel information, and the target network tunnel can be restarted and the server and target client can be automatically connected after the update.

[0069] The solution proposed in this application uses multi-core dynamic tunneling technology for enterprise internal lightweight applications to centrally manage and control existing enterprise internal lightweight applications, solve the security problem of accessing enterprise internal lightweight applications, realize dynamic tunnel encrypted access, and support network stealth and secure access.

[0070] This application also provides a server. It should be noted that the server in this application can be used to execute the communication method for enterprise intranets provided in this application. The server provided in this application is described below.

[0071] Figure 2 This is a schematic diagram of a server according to an embodiment of this application. For example... Figure 2 As shown, the server includes:

[0072] The first acquisition unit 10 is used to acquire the access request sent by the target client. The server and the target client communicate through a target network tunnel. The target network tunnel is a tunnel used for communication within the enterprise's internal network. The access request also includes the authentication information of the target client.

[0073] The first acquisition unit described above, by establishing a target network tunnel between the server and the target client, can prevent web crawler data leakage. It provides a superior application experience through dynamic tunnel access, which can be integrated into the enterprise's information strategy, improve user experience, and ensure secure data access. Furthermore, by managing lightweight applications within the enterprise and binding them to a secure target network tunnel through custom configuration, secure application access can be achieved.

[0074] The authentication unit 20 is used to authenticate the above-mentioned information to be authenticated and obtain the authentication result;

[0075] The aforementioned authentication unit can authenticate the information to be authenticated, thus further ensuring that the target client for internal enterprise communication can be authenticated, thereby further ensuring the security of internal enterprise data.

[0076] The first processing unit 30 is configured to respond to the access request and control the target browser to open so that the target client can access the server when the authentication result indicates that the authentication is successful. The target browser is a browser used internally by the enterprise and integrates a variety of browser plugins.

[0077] The aforementioned first processing unit can perform unified compatibility configuration and parameter distribution, and unified plugin distribution according to the browser environment requirements of different lightweight application systems, achieving modular and configurable management. It can realize lightweight desktop and web applications, ensuring the security of program execution and preventing ActiveX controls within web pages from executing malicious code. Furthermore, through dynamic kernel management, it can be compatible with the page characteristics of different systems.

[0078] In the aforementioned server, the first acquisition unit acquires the access request sent by the target client. The server and the target client communicate via a target network tunnel. The authentication unit authenticates the information to be authenticated and obtains the authentication result. If the authentication result indicates successful authentication, the first processing unit responds to the access request and controls the target browser to open, enabling the target client to access the server. This scheme utilizes a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise internal networks. This encapsulates the addresses of internal application systems, achieving secure access to internal enterprise resources.

[0079] To further improve the efficiency of authenticating the information to be authenticated and ensure more accurate authentication results, in one embodiment of this application, the information to be authenticated includes tunnel authentication information and user authentication information. The tunnel authentication information includes at least tunnel ID information, and the user authentication information includes at least username and password. The authentication unit includes a first authentication module and a second authentication module, and the functions of each module are as follows:

[0080] The first authentication module is used to authenticate the tunnel information to be authenticated and obtain the first authentication result;

[0081] In one specific embodiment of this application, the first authentication module includes a first determining submodule, a second determining submodule, and a third determining submodule. The first determining submodule is used to determine whether the tunnel authentication information to be authenticated is the same as the reference tunnel authentication information, which is stored in a target database. The second determining submodule is used to determine that the tunnel authentication information to be authenticated has passed authentication if it is the same as the reference tunnel authentication information. The third determining submodule is used to determine that the tunnel authentication information to be authenticated has failed authentication if it is different from the reference tunnel authentication information. In this embodiment, the tunnel authentication information to be authenticated can be compared with the reference tunnel authentication information to ensure that the target network tunnel to be connected can be authenticated, thereby further ensuring the security of internal enterprise data.

[0082] The second authentication module is used to authenticate the user's information to be authenticated when the first authentication result indicates that the authentication has passed, and to obtain a second authentication result.

[0083] In one specific embodiment of this application, the second authentication module includes a fourth determining submodule, a fifth determining submodule, and a sixth determining submodule. The fourth determining submodule is used to determine whether the user authentication information to be authenticated is the same as the reference user authentication information, which is stored in the target database. The fifth determining submodule is used to determine that the user authentication information to be authenticated has passed authentication if it is the same as the reference user authentication information. The sixth determining submodule is used to determine that the user authentication information to be authenticated has failed authentication if it is different from the reference user authentication information. In this embodiment, the user authentication information to be authenticated can be compared with the reference user authentication information to ensure that the target client connected to the target network tunnel can be authenticated, thereby further ensuring the security of internal enterprise data.

[0084] The first and second authentication modules mentioned above can first authenticate the tunnel information to be authenticated. If the tunnel information to be authenticated fails to be authenticated, it will not be able to be authenticated no matter how the user information to be authenticated is authenticated. If the tunnel information to be authenticated passes the authentication, then the user information to be authenticated will be authenticated again. This two-stage authentication method further ensures higher authentication efficiency and can further guarantee the security of the enterprise's internal data.

[0085] Since some access applications may access sensitive internal enterprise data, users may perform operations such as taking screenshots of web pages and downloading files, which could spread this data and lead to the possibility of data leakage, thereby causing the leakage of internal enterprise data. In another embodiment of this application, the above-mentioned server further includes a second acquisition unit, a second processing unit, and a third processing unit, and the functions of each unit are as follows:

[0086] The second acquisition unit is used to acquire the importance level of the target file after controlling the target browser to open so that the target client can access the server.

[0087] The second processing unit is configured to, when receiving a download request from the target client, determine that the target client is not allowed to download the target file and is only allowed to view the target file online, and add a watermark to the target file when the target client views the target file online, if the target file is classified as having the highest importance level.

[0088] The third processing unit is configured to, when receiving the download request sent by the target client, determine to allow the target client to download the target file and send the target file to the target client if the target file has a importance level of second importance level, wherein the importance level of the first importance level is higher than the importance level of the second importance level.

[0089] The aforementioned second acquisition unit, second processing unit, and third processing unit add watermarks to the target file and configure whether the file can be downloaded based on the importance level of the target file. This can effectively protect sensitive data within the enterprise and ensure the secure flow of data.

[0090] To further protect internal enterprise data and address the issue of data breaches leading to attacks on internal application systems, in another embodiment of this application, the server further includes a first hiding unit and a second hiding unit, each with the following functions:

[0091] The first hiding unit is used to hide the browser address of the target browser from the target client after controlling the target browser to open so that the target client can access the server.

[0092] The second hiding unit is used to hide the webpage source code of the target browser from the target client.

[0093] The first and second hiding units mentioned above can be used to develop an embedded framework to perform secondary kernel encapsulation of the enterprise's internal data, thereby hiding relevant access information of the target browser, such as browser address and webpage source code, to further ensure the security of the enterprise's internal data.

[0094] To further protect internal enterprise data and address the issue of data breaches leading to attacks on internal application systems, in another embodiment of this application, the server further includes a third acquisition unit, a fourth processing unit, and a fifth processing unit, with the functions of each unit as follows:

[0095] The third acquisition unit is used to acquire the type of the target client after controlling the target browser to open so that the target client can access the server.

[0096] The fourth processing unit is configured to prevent the target client from operating the current operation event when the target client is of the first type and the current operation event of the target client is a preset operation event. The preset operation event includes at least one of the following: sharing event, copying event, and jump event.

[0097] The fifth processing unit is configured to allow the target client to perform the current operation event when the target client is of the second type and the current operation event of the target client is the preset operation event, wherein the permissions of the target client of the first type are less than the permissions of the target client of the second type.

[0098] The aforementioned third acquisition unit, fourth processing unit, and fifth processing unit can perform secondary kernel encapsulation of internal enterprise data and preset operations by developing an embedded framework, thereby further ensuring the security of internal enterprise data.

[0099] During the communication between the server and the target client, the tunnel information of the target network tunnel can also be updated to ensure high availability during the communication process. In an optional embodiment of this application, the server further includes a determining unit and a sixth processing unit, and the functions of each unit are as follows:

[0100] The determining unit is configured to determine to update the tunnel information of the target network tunnel when the update conditions are met. The update conditions include at least one of the following: the server goes offline, the target network tunnel through which the server communicates with the target client cannot transmit data, or the server receives an update request. The tunnel information includes at least tunnel address information.

[0101] The sixth processing unit is configured to, when it is determined that the tunnel information of the target network tunnel needs to be updated, reconfigure the tunnel information of the target network tunnel and re-establish a connection with the target client through the updated target network tunnel.

[0102] The aforementioned determining unit and the sixth processing unit, when determining that the tunnel information of the target network tunnel needs to be updated, can reconfigure the target network tunnel on the server side, automatically update the tunnel information based on the newly received tunnel information, and restart the target network tunnel and automatically connect the server and the target client after the update.

[0103] The server includes a processor and a memory. The first acquisition unit, authentication unit, and first processing unit are all stored in the memory as program units. The processor executes the program units stored in the memory to achieve the corresponding functions.

[0104] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the problem in existing technologies where lightweight enterprise applications rely on third-party browsers for access, making them susceptible to data leaks and attacks.

[0105] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0106] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements the aforementioned communication method for an enterprise intranet.

[0107] This invention provides a processor for running a program, wherein the program executes the communication method of the enterprise intranet.

[0108] This application also provides a communication system including a client and a server, wherein the client and the server communicate with each other, and the server is used to execute any of the methods described above.

[0109] In the aforementioned system, which includes any of the methods described above, the server first obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel. Then, the server authenticates the information to be authenticated and obtains the authentication result. Finally, if the authentication result indicates successful authentication, the server responds to the access request and controls the target browser to open, allowing the target client to access the server. This solution utilizes a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise internal networks. This encapsulates the addresses of internal application systems, enabling secure access to internal enterprise resources.

[0110] This invention provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0111] Step S101: The server obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel, which is a tunnel used for communication within the enterprise's internal network. The access request also includes the authentication information of the target client.

[0112] Step S102: The server authenticates the information to be authenticated and obtains the authentication result.

[0113] In step S103, if the authentication result indicates that the authentication is successful, the server responds to the access request and controls the target browser to open so that the target client can access the server. The target browser is a browser used internally by the enterprise and integrates various browser plugins.

[0114] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0115] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0116] Step S101: The server obtains the access request sent by the target client. The server and the target client communicate through a target network tunnel, which is a tunnel used for communication within the enterprise's internal network. The access request also includes the authentication information of the target client.

[0117] Step S102: The server authenticates the information to be authenticated and obtains the authentication result.

[0118] In step S103, if the authentication result indicates that the authentication is successful, the server responds to the access request and controls the target browser to open so that the target client can access the server. The target browser is a browser used internally by the enterprise and integrates various browser plugins.

[0119] To enable those skilled in the art to better understand the technical solution of this application, the technical solution and technical effects of this application will be described below in conjunction with specific embodiments.

[0120] Example

[0121] This embodiment provides a communication method for an enterprise intranet, such as... Figure 3 As shown, the method includes:

[0122] Construct a target network tunnel for communication between the enterprise's internal servers and the target client;

[0123] The server reads the configuration file, which includes at least: API address and tunnel information;

[0124] The server authenticates the tunnel authentication information and obtains the first authentication result;

[0125] If the first authentication result is successful, establish an encrypted target network tunnel.

[0126] If the connection is successful, the user's authentication information is authenticated to obtain a second authentication result;

[0127] If the connection fails, reconfigure the tunnel information.

[0128] If the first authentication result fails, an interface for authenticating the user's information to be authenticated can be displayed, but the authentication of the user's information to be authenticated will not be successful.

[0129] The server is used for internal application management within the enterprise;

[0130] The server is configured with multi-core binding (security operation permissions), including target client permission configuration, target file configuration, application compatibility access configuration, etc.

[0131] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0133] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0134] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0135] If the aforementioned integrated units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0136] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0137] 1) The communication method for the enterprise intranet in this application involves the following steps: First, the server receives the access request sent by the target client. The server and the target client communicate through a target network tunnel. Then, the server authenticates the information to be authenticated and obtains the authentication result. Finally, if the authentication result indicates successful authentication, the server responds to the access request and controls the target browser to open, allowing the target client to access the server. This scheme utilizes a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise intranets. This encapsulates the addresses of internal application systems, enabling secure access to internal enterprise resources.

[0138] 2) In this application, the server's first acquisition unit acquires the access request sent by the target client. The server and the target client communicate through a target network tunnel. The authentication unit authenticates the information to be authenticated and obtains the authentication result. If the authentication result indicates that the authentication is successful, the first processing unit responds to the access request and controls the target browser to open so that the target client can access the server. In this scheme, by using an independent server and establishing a dedicated target network tunnel within the enterprise, dedicated communication lines are encapsulated between multiple enterprise internal networks, thereby achieving the encapsulation of the addresses of internal application systems and realizing secure access to internal enterprise resources.

[0139] 3) The communication system of this application, including any of the above-mentioned methods, firstly involves the server obtaining the access request sent by the target client. The server and the target client communicate through a target network tunnel. Then, the server authenticates the information to be authenticated and obtains the authentication result. Finally, if the authentication result indicates successful authentication, the server responds to the access request and controls the target browser to open, allowing the target client to access the server. This solution employs a dedicated server to establish a dedicated target network tunnel within the enterprise, encapsulating proprietary communication lines between multiple enterprise internal networks. This encapsulates the addresses of internal application systems, enabling secure access to internal enterprise resources.

[0140] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A communication method of an intranet of an enterprise, characterized by, The method comprises the following steps: A server acquires an access request sent by a target client, the server and the target client communicate through a target network tunnel, the target network tunnel is a tunnel used for communication in an enterprise internal network, and the access request further comprises to-be-authenticated information of the target client; The server authenticates the to-be-authenticated information and obtains an authentication result; In a case where the authentication result indicates that the authentication is passed, the server responds to the access request and controls a target browser to be started so that the target client accesses the server, wherein the target browser is a browser specially used in the enterprise internal network and is integrated with multiple browser plug-ins; The to-be-authenticated information comprises tunnel to-be-authenticated information and user to-be-authenticated information, the tunnel to-be-authenticated information at least comprises tunnel ID information, the user to-be-authenticated information at least comprises a username and a password, the server authenticates the to-be-authenticated information and obtains an authentication result, which comprises the following steps: The server authenticates the tunnel to-be-authenticated information and obtains a first authentication result; In a case where the first authentication result indicates that the authentication is passed, the server authenticates the user to-be-authenticated information and obtains a second authentication result; The method further comprises the following steps: In a case where an update condition is met, the server determines to update tunnel information of the target network tunnel, the update condition comprises at least one of the following: the server is offline, the target network tunnel through which the server and the target client communicate cannot transmit data, and the server receives an update request, the tunnel information at least comprises tunnel address information; In a case where it is determined to update the tunnel information of the target network tunnel, the server reconfigures the tunnel information of the target network tunnel and reestablishes a connection with the target client through the updated target network tunnel.

2. The method of claim 1, wherein The server authenticates the tunnel to-be-authenticated information and obtains a first authentication result, which comprises the following steps: The server determines whether the tunnel to-be-authenticated information is same as reference tunnel authentication information, the reference tunnel authentication information is stored in a target database; In a case where the tunnel to-be-authenticated information is same as the reference tunnel authentication information, the server determines that the tunnel to-be-authenticated information is authenticated to be passed; In a case where the tunnel to-be-authenticated information is not same as the reference tunnel authentication information, the server determines that the tunnel to-be-authenticated information is authenticated to be failed; The server authenticates the user to-be-authenticated information and obtains a second authentication result in a case where the first authentication result indicates that the authentication is passed, which comprises the following steps: The server determines whether the user to-be-authenticated information is same as reference user authentication information, the reference user authentication information is stored in the target database; In a case where the user to-be-authenticated information is same as the reference user authentication information, the server determines that the user to-be-authenticated information is authenticated to be passed; The server determines that the user information to be authenticated fails authentication if the user information to be authenticated is different from the reference user authentication information.

3. The method of claim 1, wherein, After the target browser is controlled to be opened to enable the target client to access the server, the method further comprises: The server acquires an importance level of the target file; The server determines not to allow the target client to download the target file and only allows the target client to view the target file online if the importance level of the target file is a first importance level when the server receives a download request sent by the target client, and adds a watermark in the target file when the target client views the target file online; The server determines to allow the target client to download the target file and sends the target file to the target client if the importance level of the target file is a second importance level when the server receives the download request sent by the target client, wherein the first importance level is higher than the second importance level.

4. The method of claim 1, wherein, After the target browser is controlled to be opened to enable the target client to access the server, the method further comprises: The server hides a browser address of the target browser for the target client; The server hides a web source code of the target browser for the target client.

5. The method of claim 1, wherein, After the target browser is controlled to be opened to enable the target client to access the server, the method further comprises: The server acquires a type of the target client; The server prohibits the target client from operating a current operation event if the type of the target client is a first type and the current operation event of the target client is a preset operation event, wherein the preset operation event comprises at least one of a sharing event, a copying event and a jumping event; The server allows the target client to operate the current operation event if the type of the target client is a second type and the current operation event of the target client is the preset operation event, wherein the target client of the first type has a smaller permission than the target client of the second type.

6. A server, characterized by The method comprises: The first acquisition unit is configured to acquire an access request sent by a target client, the server and the target client communicate through a target network tunnel, the target network tunnel is a tunnel used for communication in an enterprise internal network, and the access request further comprises to-be-authenticated information of the target client; The authentication unit is configured to authenticate the to-be-authenticated information and obtain an authentication result; The first processing unit is configured to control a target browser to be opened to enable the target client to access the server in response to the access request if the authentication result indicates that the authentication is passed, wherein the target browser is an enterprise-internal dedicated browser integrated with a plurality of browser plug-ins. The to-be-authenticated information includes tunnel to-be-authenticated information and user to-be-authenticated information, the tunnel to-be-authenticated information at least includes tunnel ID information, the user to-be-authenticated information at least includes a username and a password, and the authentication unit includes: A first authentication module is configured to authenticate the tunnel to-be-authenticated information by the server to obtain a first authentication result; A second authentication module is configured to authenticate the user to-be-authenticated information by the server in a case that the first authentication result represents that the authentication is passed to obtain a second authentication result; The server further includes: A determination unit is configured to determine to update tunnel information of the target network tunnel by the server in a case that an update condition is met, the update condition includes at least one of the following: the server is offline, the target network tunnel for communication between the server and the target client cannot transmit data, the server receives an update request, and the tunnel information at least includes tunnel address information; A sixth processing unit is configured to reconfigure the tunnel information of the target network tunnel and reestablish a connection with the target client through the updated target network tunnel by the server in a case that it is determined to update the tunnel information of the target network tunnel.

7. A computer readable storage medium characterized by The computer readable storage medium includes a stored program, wherein the program executes the method of any one of claims 1-5.

8. A communication system, characterized by It includes: A client and a server, the client and the server communicate, and the server is configured to execute the method of any one of claims 1-5.

Images