A secure access system and method for application data

Abstract

The embodiment of the application discloses a kind of application data's safe access system and method, system includes management server, gateway server and mirror resource server cluster;Management server is used to create user, release application and provide authentication interface to client;The client is used to generate access request according to the application access of user;Gateway server is used to: the identity identification of user's access request;Instruction is sent to mirror resource server cluster;Mirror resource server cluster is used to: receive the instruction of gateway server, create corresponding mirror;The whole life cycle management is carried out to the mirror created;Gateway server is also used to: mirror in mirror resource server cluster, provide traffic agent;Its effect is: through the application of mirror, use gateway server to associate the user of access and running container instance, reduce the expense of system resource, also protect data security, realize that data does not land.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a secure access system and method for application data. BACKGROUND

[0002] At present, the existing enterprises generally use application security sandbox for application data security.

[0003] The existing technology, problems and defects, mainly have the following points:

[0004] (1) The application security sandbox is greatly associated with the operating system of the mobile terminal and pc. When the version is upgraded, the program also needs to be upgraded;

[0005] (2) The sandbox solution does not realize data not landing, but only realizes the protection function of data through the data isolation solution;

[0006] (3) The application needs to be modified and integrated with sdk, which has a lot of work.

[0007] Although some cloud desktop applications have appeared, the existing cloud desktops have the defect of requiring more resources. SUMMARY

[0008] In view of the defects in the prior art, the secure access system and method for application data provided by the present application overcome the defects of the prior art that the application needs to be modified and requires more resources.

[0009] In a first aspect, the present application provides a secure access system for application data, comprising a management server, a gateway server and an image resource server cluster;

[0010] The management server is configured to create users, publish applications and provide authentication connection to the client;

[0011] The client is configured to generate an access request according to the user's application access; the application is a light application;

[0012] The gateway server is configured to:

[0013] Identity recognition of the user's access request to ensure that the access request is legal traffic;

[0014] Send instructions to the image resource server cluster;

[0015] The image resource server cluster is configured to:

[0016] Receive the instructions of the gateway server, create a corresponding image, and create a container instance according to the image;

[0017] Full life cycle management is performed on the created image;

[0018] The gateway server is further configured to:

[0019] The image resource server cluster provides traffic proxy for the image, so that the user can interact with the external service server through the image.

[0020] Optionally, the image resource server cluster creates a container through docker, and each container corresponds to a client authenticated by login, so as to realize multi-user access.

[0021] Optionally, the created image is associated with a user through a port of the corresponding container and is mapped to the gateway server.

[0022] Optionally, the full life cycle management includes creation, resource loading and recycling.

[0023] Optionally, the created image specifically includes:

[0024] An image command is edited using a dockerfile;

[0025] A base image is created through centos7.7;

[0026] Openbox is loaded;

[0027] Firefox, an open-source browser, is loaded as a browser of the light application and as an interface opened by the user;

[0028] X11vnc is loaded to provide remote functions;

[0029] Nginx server control instructions are loaded to operate the browser, so that the user can see different pages;

[0030] S6-svscan is loaded to control the process.

[0031] In a second aspect, the embodiments of the present application further provide a secure access method for application data, applied to the secure access system for application data in the first aspect, and the system includes a management server, a gateway server and an image resource server cluster; the method includes:

[0032] The management server is used to create a user, publish an application and provide authentication connection for the client; the user generates an access request for accessing the application through the client; and the application is a light application;

[0033] The gateway server is used to perform identity authentication on the access request, so as to ensure that the access request is legitimate traffic;

[0034] After the authentication is passed, an instruction is sent to the mirror resource server cluster to query whether the corresponding mirror exists;

[0035] The mirror resource server cluster receives the instruction sent by the gateway server and judges whether the mirror exists;

[0036] If not, create a corresponding mirror, then create a container instance according to the mirror, associate the user through the port of the corresponding container, and return the mirror corresponding to the user to the client;

[0037] Then, based on the returned mirror of the client and the traffic proxy provided by the gateway server, the user can interact with the external service server through the mirror.

[0038] Optionally, the method further comprises:

[0039] The created mirror is managed throughout its life cycle, including creation, resource loading and recycling.

[0040] Optionally, after the authentication is passed, a cookie is set as a subsequent valid password.

[0041] Optionally, the creation of the corresponding mirror specifically includes:

[0042] Use dockerfile to edit the create mirror command;

[0043] Create a base image through centos7.7;

[0044] Load openbox;

[0045] Load the firefox open source browser as the browser of the light application and as the interface opened by the user;

[0046] Load x11vnc to provide remote functions;

[0047] Load nginx server control instructions to operate the browser and let the user see different pages;

[0048] Load s6-svscan to manage and control processes.

[0049] Optionally, the gateway server splits the access request sent by the client and sends it to the port where the http service is created to initialize the display of the mirror.

[0050] The mirror resource server cluster creates a connection of x11vnc, and returns the data of x11vnc by taking the gateway server as a proxy.

[0051] The beneficial effects of the present application are as follows:

[0052] The application data security access system and method provided by the embodiment of the present application can identify the user identity of the application access, create a mirror image, provide traffic proxy for the mirror image resource server cluster, and thus do not need to modify and integrate the sdk of the application, thereby reducing the workload of the client;

[0053] Meanwhile, the application of the mirror image is used to associate the user and the running container instance by the gateway server, so that the complete pc or andriod or ios does not need to be provided, the system resource overhead is reduced, the data security is protected, the data is not landed, and the data security is improved. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the specific embodiments or prior art of the present application, the drawings needed to be used in the specific embodiments or prior art description will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0055] Figure 1 The structure block diagram of the application data security access system provided by the embodiment of the present application is shown;

[0056] Figure 2 The sequence diagram of the data interaction provided by the embodiment of the present application is shown;

[0057] Figure 3 The flow chart of the application data security access method provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0059] It should be understood that when used in the present specification and the appended claims, the terms "comprise" and "include" indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or sets thereof.

[0060] It should also be understood that the terms used in the present application specification are only for the purpose of describing particular embodiments and are not intended to limit the present application. As used in the present application specification and the appended claims, "a", "an", and "the" are intended to include plural references unless the context clearly indicates otherwise.

[0061] It should be further understood that the term "and / or" used in the present application specification and the appended claims means one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0062] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present application should be understood as the general meaning understood by the skilled person in the field of the present application.

[0063] As shown in Figure 1 , a security access system for application data provided by an embodiment of the present application is shown, which includes a management server, a gateway server and a mirror resource server cluster.

[0064] The management server is configured to create users, publish applications and provide authentication docking for clients; wherein the client is configured to generate an access request according to the user's application access; and the application is a light application.

[0065] Specifically, the management server is deployed in the background and is configured to manage the user's rights, legitimacy, application publishing and accessible applications.

[0066] This embodiment takes a light application as an example, for example, an H5 application. The client publishes the H5 application on the background management server and formulates which users access by mirroring; and modifies the url accessed by the previous client to modify the domain name of the original application to the domain name of the gateway server.

[0067] The client here can be understood as a small program in various platforms, and the generated access request is an https or http request; the various platforms are, for example, WeChat Enterprise, DingTalk and Feishu, etc.

[0068] The gateway server is configured to:

[0069] identify the user's access request to ensure that the access request is legitimate traffic;

[0070] send an instruction to the mirror resource server cluster;

[0071] The mirror resource server cluster is configured to:

[0072] receive the instruction from the gateway server, create a corresponding mirror, and create a container instance according to the mirror;

[0073] The created image is managed throughout the life cycle; the life cycle management includes creation, loading and recycling of resources; the resource is created when the user uses the light application, and the resource is recycled when the light application is closed.

[0074] The gateway server is further configured to:

[0075] The gateway server is further configured to:

[0076] The image resource server cluster creates containers through docker, and each container corresponds to a client that has passed login authentication, so as to realize multi-user access; that is, the number of containers is multiple; the light application corresponds to the image, and the container is generated from the image; the container and the container instance can be understood as the same meaning.

[0077] At the same time, the security capability is not realized by local integration of the sdk, and the security capability is not realized by local integration of the sdk, which avoids the problem that there is a great workload of compatibility and application modification; and the data of the user is in the image resource server, and the user accesses remotely through the browser, which improves the security.

[0078] As shown in Figure 2 The interaction process between the system is shown.

[0079] The user first sends an https or http request through the client, and the H5 application traffic of the client reaches the gateway server; the gateway server judges whether to authenticate; if authentication is performed, the gateway server sends an authentication page to the client; the user inputs the username, password and other information on the client to perform authentication; and judges whether the authentication is passed; if the authentication is passed, a cookie is set as a subsequent effective password;

[0080] And whether there is an image of the other party (here, the other party is the current user, and one user corresponds to one corresponding container, and the container is generated from the image, and the light application corresponds to the image); specifically including:

[0081] The gateway server interacts with the management server to judge the prefix of the url to determine the user's authority, whether the H5 application can be accessed, and whether the image of the H5 application needs to be created; the creation process is as follows:

[0082] The image command is created by editing the dockerfile;

[0083] The base image is created by centos7.7;

[0084] Load openbox;

[0085] Load the open source browser Firefox as a light application browser and as the interface opened by the user.

[0086] Load x11vnc to provide remote functions.

[0087] Load the nginx server control instruction to operate the browser and let the user see different pages.

[0088] Load s6-svscan to control the process.

[0089] When the image is created, the created image is associated with the user through the port of the corresponding container and is mapped to the gateway server; the gateway server records the port information associated with the user, then the image resource server cluster returns the image of the client, and the user accesses the business server by operating the image; wherein the business server refers to an external server that supports user access to corresponding services; for example, if the user needs to access Baidu, data interaction between the user and the business server deployed for the corresponding Baidu service is required.

[0090] Take the H5 application listed in this embodiment as an example.

[0091] First, make a docker base image, H5 is centos+firefox+x11vnc;

[0092] Use docker-p to map the ports of x11vnc and http service, associate the ports with the user, and return them to the gateway server; that is, associate the created user and the running docker instance through the gateway server; and the actual running of the image only needs to occupy 200M memory, reducing resource overhead;

[0093] Finally, the gateway server will split the request sent by the client and send it to the previously created http service port to initialize the display of the image; create an x11vnc connection, and the gateway server returns the x11vnc data as a proxy.

[0094] The effects and advantages of the above scheme are mainly as follows:

[0095] I. Through the application of the image, the gateway server is used to associate the accessed user and the running container instance, so that it is not necessary to provide a complete pc or andriod or ios, reducing the resource overhead of the system;

[0096] II. The user's data is in the image resource server, and the user accesses remotely through vnc, realizing data not landing and thus improving the security of the data;

[0097] III. No need to modify and integrate the application and SDK, reducing the workload of the client.

[0098] As shown in Figure 3 The application also shows a secure access method for application data, applied to the secure access system for application data described above, which includes a management server, a gateway server and a mirror resource server cluster; the method comprises:

[0099] S101, create a user through the management server, publish an application and provide authentication interface for the client; wherein the user generates an access request for application access through the client; the application is a light application;

[0100] S102, through the gateway server, identity authentication is performed on the access request to ensure that the access request is legal traffic;

[0101] S103, after authentication, send an instruction to the mirror resource server cluster to query whether the corresponding mirror exists;

[0102] S104, through the mirror resource server cluster, receive the instruction sent by the gateway server, and judge whether the mirror exists;

[0103] S105, if not, create a corresponding mirror, then create a container instance according to the mirror, associate the user through the port of the corresponding container, and return the mirror corresponding to the client to the client;

[0104] S106, based on the returned client mirror, perform operations, and the traffic proxy provided by the gateway server, realize data interaction between the user and the external business server through the mirror.

[0105] When applied, the method further comprises:

[0106] The created mirror is managed throughout its life cycle, including creation, resource loading and recycling.

[0107] After the authentication, a cookie will be set as the subsequent effective password.

[0108] In this embodiment, the creation of the corresponding mirror specifically includes:

[0109] Use dockerfile to edit the mirror creation command;

[0110] Create a base image through centos7.7;

[0111] Load openbox;

[0112] Load the open source browser Firefox as a light application browser and as an interface opened by the user.

[0113] Load x11vnc to provide remote functions.

[0114] Load the nginx server control instruction to operate the browser and make the user see different pages.

[0115] Load s6-svscan to control the process.

[0116] Support dockerfile to create an image.

[0117] When implemented, the access request sent by the client is split by the gateway server and sent to the port of the previously created http service, and the display of the image is initialized.

[0118] The connection of x11vnc is created through the image resource server cluster, and the gateway server is used as a proxy to return the data of x11vnc.

[0119] Since the method embodiment is based on the foregoing system embodiment, it is described relatively simply, and the relevant part can refer to the part of the system embodiment.

[0120] The application data security access method provided by the embodiment of the application creates an image, provides traffic proxy for the image in the image resource server cluster, so that the application does not need to be modified and integrated with an sdk, and the workload of the client is reduced.

[0121] At the same time, through the application of the image, the gateway server is used to associate the accessed user and the running container instance, so that a complete pc or andriod or ios does not need to be provided, the system resource overhead is reduced, the data security is protected, the data is not landed, and the data security is improved.

[0122] In the embodiments provided in the present application, it should be understood that the disclosed method and system can be implemented in other ways. For example, the system embodiment described above is only schematic, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should be covered in the scope of the claims and the description of the present application.

Claims

1. A secure access system for application data, characterized in that, This includes a cluster of management servers, gateway servers, and image resource servers; The management server is used to create users, publish applications, and provide authentication integration for clients; wherein, the client is used to generate access requests based on the user's application access; the application is a lightweight application; the URL previously accessed by the client is modified by changing the domain name of the original application to the domain name of the gateway server; The gateway server is used for: User access requests are authenticated to ensure that they are legitimate traffic; Send instructions to the image resource server cluster; The mirror resource server cluster is used for: Receive instructions from the gateway server, create the corresponding image, and create a container instance based on the image; Perform full lifecycle management on the created images; The gateway server is also used for: Traffic proxy is provided for the images in the image resource server cluster to enable users to interact with external business servers through the images. The business servers refer to external servers that support users to access corresponding services. The creation of the corresponding image specifically includes: Use the Dockerfile to edit the command to create the image; Create a base image using CentOS 7.7; Load Openbox; Load the Firefox open-source browser as a lightweight application browser and as the user interface; Loading x11vnc provides remote functionality; Load nginx server control commands to manipulate the browser and allow users to see different pages; Load s6-svscan to manage processes; The image resource server cluster creates containers using Docker, with each container corresponding to a login-authenticated client to enable multi-user access; lightweight applications correspond to images, and containers are generated from images; The created image is associated with the user through the port of the corresponding container and mapped to the gateway server; the image resource server cluster returns the image for the client, and the user accesses the business server by operating the image; the full lifecycle management includes creation, resource loading and recycling.

2. A method for secure access to application data, characterized in that, The method is applied to a secure access system for application data as described in claim 1, the system comprising a management server, a gateway server, and a cluster of mirror resource servers; the method comprises: The management server is used to create users, publish applications, and provide authentication integration for clients. In this process, the user generates an access request for the application through the client; the application is a lightweight application; the URL previously accessed by the client is modified, and the domain name of the original application is changed to the domain name of the gateway server. The gateway server performs authentication on the access request to ensure that the access request is legitimate traffic. Once authentication is successful, a command is sent to the image resource server cluster to query whether the corresponding image exists. The image resource server cluster receives instructions sent by the gateway server and determines whether the image exists. If it does not exist, create the corresponding image, then create a container instance based on the image, associate the user with the corresponding container port, and return the image of the client corresponding to the user to the client. Then, based on the operation of the returned client image and the traffic proxy provided by the gateway server, the user can interact with the external business server through the image. The business server refers to the external server that supports the user to access the corresponding business. The creation of the corresponding image specifically includes: Use the Dockerfile to edit the command to create the image; Create a base image using CentOS 7.7; Load Openbox; Load the Firefox open-source browser as a lightweight application browser and as the user interface; Loading x11vnc provides remote functionality; Load nginx server control commands to manipulate the browser and allow users to see different pages; Load s6-svscan to manage processes; The gateway server splits the access requests sent by the client and sends them to the port where the HTTP service was previously created, thus initializing the display of the image. The x11vnc connection is created through the image resource server cluster, and the gateway server is used as a proxy to return x11vnc data; Perform full lifecycle management on the created images, including creation, resource loading, and recycling.

3. The method as described in claim 2, characterized in that, Once the authentication is successful, a cookie will be set as the valid password for subsequent authentication.

Images