A private encryption protocol traffic proxy-based internal network remote desktop access method

Abstract

The application discloses a kind of private encryption protocol traffic agent-based intranet remote desktop access method, comprising: control center: facing customer self-service system;Management browser WebSocket and the connection between intranet Agent and corresponding relation, is the pivot of two-way communication of data;Control node: the communication system of horizontal extension with intranet Agent, has carried the bridge of control center and intranet Agent communication;Message queue: for intranet Agent and control node delivery information;Intranet Agent: deployment in intranet, is the processing control instruction carrier, simultaneously is the data transmission pivot of intranet host and control center;The application realizes the remote desktop connection of intranet host based on Web simultaneously, without exposing any port in intranet, without installing any server or client on intranet host.

Description

TECHNICAL FIELD

[0001] The application relates to the field of IT cloud computing technology, in particular to an intranet remote desktop access method based on a private encryption protocol traffic agent. BACKGROUND

[0002] When a public cloud vendor provides a cloud server, a public network remote desktop connection scheme based on a Web is needed, a browser is connected with a service platform of the cloud vendor, the service platform is used for access control on the cloud server of a customer, and reference is made to FIG. 1. Figure 1 When the customer needs to access an intranet host in an edge cloud, the existing technical scheme cannot meet the demand of the customer, and the application provides an intranet remote desktop access method based on a private encryption protocol traffic agent. SUMMARY

[0003] In order to overcome the defects of the prior art, the application provides an intranet remote desktop access method based on a private encryption protocol traffic agent, so as to solve the problems in the background art.

[0004] In order to solve the above technical problems, the application provides the following technical scheme: an intranet remote desktop access method based on a private encryption protocol traffic agent, comprising the following steps:

[0005] The browser initiates an access request through a WebSocket, and transmits a unique identifier UUID corresponding to an intranet host to be accessed;

[0006] The control center analyzes the transmitted parameter, and requests a corresponding control node through an HTTP interface;

[0007] After the control node receives the request, an MQ message is sent to a corresponding intranet agent;

[0008] After the intranet agent receives the MQ message, a private encryption protocol connection is created with the control center, and a connection for accessing the intranet host is created;

[0009] The connection is established;

[0010] The control center: a customer self-service system; manages the connection and corresponding relationship between the browser WebSocket and the intranet agent, and is a pivot of bidirectional data communication;

[0011] The control node: a horizontally-extensible communication system with the intranet agent, and is a bridge for communication between the control center and the intranet agent;

[0012] The message queue: is used for information transmission between the intranet agent and the control node;

[0013] Intranet Agent: deployed in the intranet, is a control instruction carrier, and is a data transmission hub between the intranet host and the control center.

[0014] As a preferred technical solution of the present application, when establishing a connection, a protocol type (1 Byte) for detecting whether the network connection is normal and distinguishing different types of protocols, a WebSocket unique identifier (4 Bytes) for distinguishing different client browsers, a data length (4 Bytes) for program reading transmission data content, and data content are included.

[0015] As a preferred technical solution of the present application, the intranet Agent respectively establishes a connection with the control center and the intranet host.

[0016] Connection one: the connection established by the intranet Agent and the control center.

[0017] Connection two: the connection established by the intranet Agent and the intranet host.

[0018] As a preferred technical solution of the present application, the specific connection process is as follows:

[0019] The browser initiates an access request through WebSocket, the control center generates a unique identifier (session ID) according to the WebSocket connection, the control center stores the correspondence between the session ID and the WebSocket, and according to the UUID (intranet host unique identifier) transmitted, finds the intranet Agent corresponding to the UUID, and sends an HTTP request to the control node.

[0020] The control node finds the corresponding intranet Agent according to the UUID and sends an MQ message notification.

[0021] The intranet Agent will create a private encrypted protocol connection (connection one) with the control center according to the received MQ message, and send a heartbeat packet. When connection one is successfully established, the intranet Agent establishes a connection (connection two) with the intranet host, writes the data read by connection one into connection two, and writes the data read by connection two into connection one, completes the creation of connection two, and responds to the control center that the connection is successfully established.

[0022] After the establishment is completed, when the control center receives the heartbeat packet, it will store the association relationship between connection one and the session ID in the Server.

[0023] The browser sends the user's instructions to the control center through WebSocket, the control center encapsulates the data into a private encrypted protocol data packet according to the session ID, and sends it through the Server. The Server sends the data to the intranet Agent through connection one according to the correspondence between the session ID and connection one.

[0024] The intranet Agent receives the data packet, writes in the second connection, the returned data in the second connection is written in the first connection, the first connection encapsulates the data into a private encryption protocol data packet and sends to the control center, the control center receives the data packet, sends the data to the client's browser according to the WebSocket unique identification (session ID) in the data packet.

[0025] As a preferred technical solution of the application, the application further comprises heartbeat detection.

[0026] The browser sends a heartbeat data to the control center every 5 seconds, and the control center updates the active time of the connection;

[0027] The intranet Agent and the control center (the first connection) are set to read idle for 9 seconds and write idle for 3 seconds, and when the write idle time exceeds 3 seconds, a heartbeat packet is sent to the control center;

[0028] The intranet Agent and the intranet host (the second connection) are set to read idle for 9 seconds and write idle for 3 seconds, and when the write idle time exceeds 3 seconds, a heartbeat packet is sent to the intranet Agent.

[0029] As a preferred technical solution of the application, finally, the application comprises a disconnection mechanism.

[0030] When the user leaves the browser page, the browser closes the WebSocket connection, triggers the WebSocket disconnection event, closes the WebSocket connection, and closes the first connection, and when the intranet Agent detects that the first connection is closed, the second connection established between the intranet Agent and the intranet host is also closed, at this time all connections are closed.

[0031] The control center and the intranet Agent are disconnected, the first connection is actively closed, and the relationship between the first connection and the WebSocket is cleared, at this time the heartbeat packet between the browser and the control center is stopped, the browser closes the WebSocket connection, the second connection established between the intranet Agent and the intranet host is closed, at this time all connections are closed.

[0032] When the intranet Agent and the intranet host VNC are disconnected, the first connection is actively closed, the second connection is also closed, and the control center closes all connections according to the disconnection mechanism.

[0033] Compared with the prior art, the application has the following beneficial effects:

[0034] The application is a kind of internal network remote desktop access method based on private encryption protocol traffic agent, when multiple users access different internal network cloud host, the control center innovatively associates WebSocket of different users with corresponding internal network Agent communication connection, realizes mutual conversion and connection corresponding of private encryption protocol and WebSocket on communication, completes remote desktop traffic public network agent and encapsulation and decapsulation;

[0035] When multiple users access different cloud hosts of the same internal network, the internal network Agent innovatively associates VNC connection of different hosts with corresponding control center communication connection, realizes mutual conversion and connection corresponding of private encryption protocol and VNC connection on communication, completes remote desktop traffic internal network agent and encapsulation and decapsulation.

[0036] Through the remote desktop protocol encapsulation and traffic agent of the control center and the internal network Agent two sections, the remote desktop control of the remote internal network host through the Web is realized. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 It is a system diagram of prior art;

[0038] Figure 2 It is a software architecture diagram of the application, a kind of internal network remote desktop access method based on private encryption protocol traffic agent;

[0039] Figure 3 It is a timing diagram of the application, a kind of internal network remote desktop access method based on private encryption protocol traffic agent;

[0040] Figure 4 It is a 7xForward private protocol schematic diagram of the application, a kind of internal network remote desktop access method based on private encryption protocol traffic agent;

[0041] Figure 5 It is a specific flow chart of the application, a kind of internal network remote desktop access method based on private encryption protocol traffic agent;

[0042] Figure 6 It is a heartbeat detection schematic diagram of the application, a kind of internal network remote desktop access method based on private encryption protocol traffic agent. DETAILED DESCRIPTION

[0043] In order to make the technical means, creative features, purposes and effects of the present application easy to understand, the present application is further described below in conjunction with specific embodiments, but the following embodiments are only preferred embodiments of the present application, not all. Based on the embodiments in the embodiments, other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application. In the following examples, the experimental methods are conventional methods, and the materials and reagents used in the following examples are commercially available unless otherwise specified.

[0044] Embodiment:

[0045] As shown in the following, Figure 2 The present application provides a private encryption protocol traffic agent-based internal network remote desktop access method, comprising:

[0046] Control center: customer self-service system; manage the connection and correspondence between the browser WebSocket and the internal network agent, and it is the hub of data bidirectional communication;

[0047] Control node: horizontally expandable communication system with internal network agent, which carries the bridge for communication between control center and internal network agent;

[0048] Message queue: used for internal network agent and control node to deliver information;

[0049] Internal network agent: deployed in the internal network, which is the carrier for processing control instructions, and is also the data transmission hub between internal network host and control center;

[0050] In the present embodiment, the control center is a platform for user management. Through the control center, the user can remotely control the node cluster. The node cluster is composed of multiple nodes, and when the number of internal network agents is too large, it can be horizontally expanded. Through the self-developed private encryption protocol, the safety and reliability of user data can be guaranteed;

[0051] The internal network agent is a proxy for the user's internal network remote desktop, which enables the user's service to run in a secure network environment.

[0052] As shown in the following, Figure 3 The present embodiment discloses that the browser initiates an access request through WebSocket and transmits the unique identifier UUID corresponding to the internal network host to be accessed;

[0053] The control center analyzes the incoming parameters and requests the corresponding control node through the HTTP interface;

[0054] After receiving the request, the control node sends an MQ message to the corresponding internal network agent;

[0055] After receiving the MQ message, the intranet Agent creates a private encryption protocol connection with the control center and creates a connection to access the intranet host;

[0056] The connection establishment is completed.

[0057] As shown in Figure 4 , the embodiment discloses that when establishing the connection, a protocol type (1 Byte) for detecting whether the network connection is normal and for distinguishing different types of protocols, a WebSocket unique identifier (4 Byte) for distinguishing different client browsers, a data length (4 Byte) for program reading of transmission data content, and data content (10 Byte - data length) are included.

[0058] As shown in Figure 5 , the embodiment discloses that the intranet Agent establishes a connection with the control center and the intranet host respectively;

[0059] Connection 1: the connection established by the intranet Agent and the control center;

[0060] Connection 2: the connection established by the intranet Agent and the intranet host;

[0061] Specific connection process:

[0062] The browser initiates an access request through WebSocket, the control center generates a unique identifier (session ID) according to the WebSocket connection, the control center stores the correspondence between the session ID and the WebSocket, and according to the UUID (intranet host unique identifier) transmitted, finds the intranet Agent corresponding to the UUID, and sends an HTTP request to the control node;

[0063] WebSocket request format:

[0064] / ws / vm / domain / vnc?uuid=b0d394a9-d7d6-4362-9890-c252bb4c5018;

[0065] Parameter content format passed:

[0066] {uuid: b0d394a9-d7d6-4362-9890-c252bb4c5018, sessionId: 1691023927};

[0067] The control node finds the corresponding intranet Agent according to the UUID and sends an MQ message notification;

[0068] MQ message format:

[0069] {vncPort: 5900, sessionId: 1691023927, sessionIdHashCode: -1636587926};

[0070] Intranet Agent will be received according to MQ message, with the control center to create a private encryption protocol connection (connection one), and send a heartbeat packet, when connection one is established successfully, intranet Agent again establishes a connection with intranet host (connection two), will connection one read data, write in connection two, will connection two read data, write in connection one, complete connection two creation, MQ response success and control center connection establishment is completed;

[0071] After the establishment, when the control center receives the heartbeat packet, will be stored in the server connection one and the association relationship of session Id;

[0072] The browser will send the user's instructions through WebSocket to the control center, the control center will be according to session Id will be encapsulated as a private encryption protocol data packet, and send it through the server, the server will be according to session Id and the corresponding relationship of connection one, through connection one to send to intranet Agent;

[0073] Intranet Agent receives the data packet, will write in connection two, connection two in the return data, write in connection one, connection one will be encapsulated as a private encryption protocol data packet, send to the control center, the control center receives the data packet, according to the WebSocket unique identifier (session Id) in the data packet will be sent to the client's browser.

[0074] As shown in Figure 6 , the embodiment discloses, still including heartbeat detection:

[0075] The browser will send a heartbeat data to the control center every 5 seconds, and the control center will update the active time of this connection;

[0076] Intranet Agent and control center (connection one) set to read idle 9 seconds, and write idle 3 seconds, when the write idle time is more than 3 seconds, a heartbeat packet will be sent to the control center;

[0077] Intranet Agent and intranet host (connection two) set to read idle 9 seconds, and write idle 3 seconds, when the write idle time is more than 3 seconds, a heartbeat packet will be sent to the intranet Agent.

[0078] As shown in Figure 4 and Figure 6 , the embodiment discloses, finally, including the disconnection mechanism:

[0079] When the user leaves the browser page, the browser will close the WebSocket connection, trigger the WebSocket disconnection event, close the WebSocket connection, and close connection 1, when the intranet agent detects the closing of connection 1, connection 2 established with the intranet host in the intranet agent is also closed at the same time, at this time all connections have been closed;

[0080] The control center disconnects with the intranet agent, that is, the heartbeats ③ cannot be detected, connection 1 is actively closed, and the relationship between connection 1 and the WebSocket is cleared, at this time the heartbeat packet between the browser and the control center is stopped, the browser closes the WebSocket connection, and connection 2 established with the intranet host in the intranet agent is also closed at the same time, at this time all connections have been closed;

[0081] When the intranet agent disconnects with the intranet host VNC, connection 1 is actively closed, and connection 2 is also closed, and the control center closes all connections according to the disconnection mechanism.

[0082] The flow of the method for accessing the remote desktop in the intranet based on the private encryption protocol flow agent is as follows:

[0083] When multiple users access different intranet cloud hosts, the control center innovatively associates the WebSockets of different users with the corresponding intranet agent communication connections, realizes the mutual conversion and connection correspondence of the private encryption protocol and the WebSocket on the communication, and completes the public network proxy and encapsulation and decapsulation of the remote desktop flow;

[0084] When multiple users access different cloud hosts in the same intranet, the intranet agent innovatively associates the VNC connections of different hosts with the corresponding control center communication connections, realizes the mutual conversion and connection correspondence of the private encryption protocol and the VNC connection on the communication, and completes the intranet proxy and encapsulation and decapsulation of the remote desktop flow;

[0085] Through the remote desktop protocol encapsulation and flow proxy of the control center and the intranet agent, the remote desktop control of the remote intranet host through the Web is realized.

[0086] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. An internal network remote desktop access method based on a private encryption protocol traffic agent, characterized in that, The method comprises the steps of: The browser initiates an access request through a WebSocket, and a unique identifier UUID corresponding to the access to the intranet host is transmitted; The control center analyzes the transmitted parameter, and requests the corresponding control node through an HTTP interface; The control node receives the request, and sends an MQ message to the corresponding intranet Agent; The intranet Agent receives the MQ message, creates a private encryption protocol connection with the control center, and creates a connection for accessing the intranet host; The connection establishment is completed; The control center: a customer self-service system; manages the connection and corresponding relationship between the browser WebSocket and the intranet Agent, and is the hub of bidirectional data communication; The control node: a horizontally expandable communication system with the intranet Agent, which is a bridge for communication between the control center and the intranet Agent; Message queue: used for information transmission between the intranet Agent and the control node; The intranet Agent: deployed in the intranet, which is a control instruction processing carrier and a data transmission hub between the intranet host and the control center.

2. The method of claim 1, wherein, In the connection establishment, the protocol type is used to detect whether the network connection is normal and to distinguish different types of protocols, the WebSocket unique identifier is used to distinguish different customer browsers, the data length and data content are used for program to read the transmission data content.

3. The method of claim 1, wherein, The intranet Agent establishes connections with the control center and the intranet host respectively; Connection one: the connection established between the intranet Agent and the control center; Connection two: the connection established between the intranet Agent and the intranet host.

4. The method of claim 3, wherein, Specific connection process: The browser initiates an access request through a WebSocket, the control center generates a unique session ID according to the WebSocket connection, the control center stores the correspondence between the session ID and the WebSocket, and according to the transmitted UUID, finds the intranet Agent corresponding to the UUID, and sends an HTTP request to the control node; The control node finds the corresponding intranet Agent according to the UUID, and sends an MQ message notification; The intranet Agent will create a private encryption protocol connection with the control center according to the received MQ message, and send a heartbeat packet, when connection one is successfully established, the intranet Agent establishes a connection with the intranet host, writes the data read by connection one into connection two, and writes the data read by connection two into connection one, completes the creation of connection two, and responds to the control center that the connection is successfully established; After the establishment is completed, when the control center receives the heartbeat packet, it will store the association relationship between connection one and the session ID in the server; The browser sends the user's instruction to the control center through the WebSocket, the control center encapsulates the data into a private encryption protocol data packet according to the session ID, and sends it through the server, and the server sends the data to the intranet Agent through connection one according to the correspondence between the session ID and connection one; The inner network Agent receives the data packet, which will be written in connection two. The returned data in connection two will be written in connection one. Connection one encapsulates the data into a private encryption protocol data packet and sends it to the control center. After receiving the data packet, the control center sends the data to the client's browser according to the WebSocket unique identifier in the data packet.

5. The method of claim 4, wherein, It also includes heartbeat detection: The browser sends a heartbeat data to the control center every 5 seconds, and the control center updates the active time of this connection; The inner network Agent and the control center set the read idle time to 9 seconds and the write idle time to 3 seconds. When the write idle time exceeds 3 seconds, a heartbeat packet will be sent to the control center; The inner network Agent and the inner network host set the read idle time to 9 seconds and the write idle time to 3 seconds. When the write idle time exceeds 3 seconds, a heartbeat packet will be sent to the inner network Agent.

6. The method of claim 5, wherein, Finally, it includes a disconnection mechanism: When the user leaves the browser page, the browser will close the WebSocket connection, trigger the WebSocket disconnection event, close the WebSocket connection, and close connection one. When the inner network Agent detects that connection one is closed, it will also close the connection two established with the inner network host. At this time, all connections have been closed; The control center disconnects from the inner network Agent, which will actively close connection one and clear the relationship between connection one and WebSocket. At this time, the browser and the control center's heartbeat packet stop processing, the browser closes the WebSocket connection, and the inner network Agent closes the connection two established with the inner network host. At this time, all connections have been closed; When the inner network Agent and the inner network host VNC disconnect, it will actively close connection one and connection two. The control center will close all connections according to the disconnection mechanism.

Images