Data access method and device, computer device and readable storage medium

Abstract

The application discloses a data access method and device, computer equipment and a readable storage medium. The method comprises the following steps: in response to an access request of a first terminal to a second terminal, obtaining a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request; in the case that the user account does not have an access right to access the second terminal and the first storage does not store a first resource of the second terminal, the first resource of the second terminal is called from the second storage according to the first IP address; obtaining a second resource of a VPN device; generating a first firewall script instruction, a second firewall script instruction and a VPN device script instruction according to the first resource and the second resource; and giving the user account an access right to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction. The efficiency of processing user rights is improved, and the accuracy of opening a firewall configuration is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a data access method and device, a computer device and a readable storage medium. BACKGROUND

[0002] In the prior art, in the scenario where a VPN (Virtual Private Network) account needs to access multiple system resources, when accessing system resources in a firewall control area, an administrator needs to manually configure policies after finding the firewall control area in the path, and open the access permission between the VPN user and the target system.

[0003] In the process of implementing the present application, the applicant found that the related technology at least has the following problems:

[0004] When facing a large number of VPN account requirements, the administrator manually configures the way, which is low in efficiency and accuracy, requires high administrator ability, and has high labor cost. SUMMARY

[0005] Therefore, the present application provides a data access method and device, a computer device and a readable storage medium, which mainly aims to solve the problem that the administrator manually configures the way, which is low in efficiency and accuracy, requires high administrator ability, and has high labor cost when facing a large number of VPN account requirements.

[0006] According to the first aspect of the present application, a data access method is provided, which is suitable for a virtualization platform, wherein the virtualization platform includes a VPN device, and the method includes:

[0007] In response to an access request of a first terminal to a second terminal, a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request are obtained;

[0008] In the case that the user account does not have access permission to the second terminal, and the first storage does not store the first resource of the second terminal, the first resource of the second terminal is retrieved from the second storage according to the first IP address;

[0009] The second resource of the VPN device is obtained;

[0010] The first firewall script instruction, the second firewall script instruction and the VPN device script instruction are generated according to the first resource and the second resource;

[0011] The user account is given access permission to the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction.

[0012] Optionally, in response to the access request of the first terminal to the second terminal, after obtaining the user account of the first terminal and the first IP address of the second terminal included in the access request, the method further comprises:

[0013] determining whether the user account is authorized in the VPN device;

[0014] if yes, obtaining a permission set corresponding to the user account;

[0015] determining whether the user account has access permission to access the second terminal according to the first IP address and the permission set;

[0016] if no, authorizing the user account in the VPN device.

[0017] Optionally, the step of determining whether the user has access permission to access the second terminal according to the first IP address and the permission set comprises:

[0018] determining whether the first IP address is included in the permission set;

[0019] if yes, determining that the user account has access permission to access the second terminal;

[0020] if no, determining that the user account does not have access permission to access the second terminal.

[0021] Optionally, after determining that the user does not have access permission to access the second terminal, the method further comprises:

[0022] determining whether the first storage stores a first resource of the second terminal;

[0023] if yes, assigning the user account access permission to access the second terminal in the VPN device according to the user account and the first resource.

[0024] Optionally, the step of generating the first firewall script instruction, the second firewall script instruction and the VPN device script instruction according to the first resource and the second resource comprises:

[0025] determining first network segment information corresponding to the first firewall according to the first IP address, wherein the first firewall is a firewall corresponding to the second terminal;

[0026] determining a first firewall type according to the first network segment information;

[0027] generating the first firewall script instruction according to the first firewall type, the first resource and the second resource;

[0028] determining a second IP address of the VPN device according to the second resource;

[0029] According to the second IP address, second network segment information corresponding to the second firewall is determined, wherein the second firewall is a firewall corresponding to the VPN device;

[0030] According to the second network segment information, a second firewall type is determined;

[0031] According to the second firewall type, the first resource and the second resource, a second firewall script instruction is generated;

[0032] According to the user account and the first resource, a VPN device script instruction is generated.

[0033] Optionally, according to the user account, the first resource, the second resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the step of assigning the user account with the access permission to access the second terminal comprises:

[0034] The first firewall script instruction is sent to the first firewall;

[0035] The second firewall script instruction is sent to the second firewall;

[0036] The user account, the first resource and the VPN device script instruction are sent to the VPN device;

[0037] According to the user account and the first resource, the user account is assigned with the access permission to access the second terminal in the VPN device.

[0038] Optionally, after the user account is assigned with the access permission to access the second terminal according to the user account, the first resource, the second resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the method further comprises:

[0039] A firewall policy opening result is received;

[0040] According to the user account, the access permission and the firewall policy opening result, a prompt information is generated;

[0041] The prompt information is sent.

[0042] According to the second aspect of the present application, a data access device suitable for a virtualization platform is provided, wherein the virtualization platform comprises a VPN device, and the device comprises:

[0043] A first obtaining module is configured to, in response to an access request of a first terminal to a second terminal, obtain a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request;

[0044] The calling module is configured to call the first resource of the second terminal from the second storage according to the first IP address when the user account does not have the access right to access the second terminal and the first resource of the second terminal is not stored in the first storage.

[0045] The second obtaining module is configured to obtain a second resource of the VPN device.

[0046] The generating module is configured to generate a first firewall script instruction, a second firewall script instruction and a VPN device script instruction according to the first resource and the second resource.

[0047] The processing module is configured to assign the user account with the access right to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction.

[0048] According to the third aspect of the present application, a computer device is provided, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the method according to any one of the first aspect when executing the computer program.

[0049] According to the fourth aspect of the present application, a readable storage medium is provided, which stores a computer program, and the computer program implements the steps of the method according to any one of the first aspect when executed by a processor.

[0050] According to the above technical solution, the data access method, device, computer device and readable storage medium provided by the present application solve the technical problem that the administrator needs to manually configure the policy after finding the firewall control area in sequence in the prior art, which is inefficient and inaccurate when facing a large number of VPN account demands, and the administrator has a large workload. After obtaining the access request of the remote terminal to the enterprise internal terminal, the user account is verified whether it has the access right to access the enterprise internal terminal. When the user account does not have the access right and the resource of the enterprise internal terminal is not configured in the VPN device, the virtualization platform automatically finds the firewall security area to which the resource of the second terminal to be accessed belongs, generates the configuration information of the virtual private network user right, the script instruction of the corresponding area firewall and the script instruction of the VPN device, and pushes them to the VPN device and the corresponding firewall, respectively. When the user account corresponding to the VPN resource is created in the VPN device, the firewall configuration required by the user account to access the resource of the enterprise internal terminal through the VPN can be automatically opened. The automatic configuration of the VPN user right and the related resource firewall is realized, which greatly improves the processing efficiency of the user right and improves the accuracy of the corresponding firewall configuration opening, reduces the dependence on the administrator's ability level, and reduces the labor cost.

[0051] The above description is only a summary of the technical solutions of the present application. In order to enable one skilled in the art to better understand the technical means of the present application and to implement the same according to the contents of the description, and in order to enable the above and other purposes, characteristics and advantages of the present application to be more apparent and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Moreover, the same reference numerals in the attached drawings indicate the same or similar components. In the drawings:

[0053] Figure 1 A flow diagram of a data access method provided by an embodiment of the present application is shown;

[0054] Figure 2 Another flow diagram of a data access method provided by an embodiment of the present application is shown;

[0055] Figure 3 A structural diagram of a data access device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0056] Exemplary embodiments of the present application will be described in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided so that the present application can be more thoroughly understood and the scope of the present application can be accurately conveyed to those skilled in the art.

[0057] An embodiment of the present application provides a data access method, which is suitable for a virtualization platform, wherein the virtualization platform includes a VPN device, such as Figure 1 As shown in the figure, the method comprises:

[0058] S101, in response to an access request of a first terminal to a second terminal, obtaining a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request.

[0059] The data access method provided in the application is suitable for a virtualization platform, the virtualization platform comprises a VPN device, and the VPN device is installed with a VPN system. The virtualization platform is in communication connection with a first terminal and a second terminal respectively. Specifically, the first terminal is a remote terminal used by an employee of an enterprise, and the second terminal is an enterprise internal network terminal. The enterprise internal network refers to a network using a private IP address (Internet Protocol Address) space. The private IP address cannot be directly connected to an external network, i.e., a communication network used by public users, and needs to be forwarded through a public network IP. A VPN communication is established between the remote terminal and the enterprise local internal network through the VPN system in the VPN device. When the first terminal accesses the external network, if a user wants to access the second terminal in the enterprise internal network through the first terminal, due to the isolation between different networks, the first terminal cannot directly access the internal network, and needs to access the second terminal through the VPN channel established between the first terminal and the internal network by the VPN device. Therefore, when the virtualization platform obtains an access request for the second terminal initiated from the first terminal, the user account of the first terminal and the first IP address of the second terminal are obtained, and then according to the user account and the first IP address, it is judged whether the first terminal has the access permission of the enterprise internal terminal. It should be noted that the user account is an account with access permission of the enterprise internal network set by an enterprise administrator for each employee. After obtaining the exclusive user account, the employee needs to be authorized in the VPN device, and can log in to the internal network isolated by the VPN device.

[0060] S102, in the case that the user account does not have the access permission of the second terminal, and the first storage does not store the first resource of the second terminal, the first resource of the second terminal is retrieved from the second storage according to the first IP address.

[0061] In this step, the first storage is a storage in the VPN device, and is used to store the user account related information of the first terminal authorized by the VPN device, and the resources of each internal terminal of the enterprise internal network which can access the resources through the VPN system; the second storage is a general storage of the virtualization platform, and is used to store all the user account information of the enterprise cooperating with the virtualization platform and the resource information of all the internal terminals.

[0062] Specifically, before establishing a VPN connection channel between the first terminal and the second terminal according to the access request of the user account, it is first verified whether the user account has the access right to the second terminal. If it is verified that the user account does not have the access right to the enterprise internal terminal, it indicates that the VPN channel of the user and the second terminal has not been opened before, and needs to be configured based on the resources of the first terminal and the second terminal. Before the configuration, it is necessary to verify whether the resources of the second terminal are configured in the VPN device, that is, to determine whether the first resource of the second terminal is stored in the first storage. If the first resource is not stored in the first storage, it indicates that the second terminal is only registered in the virtualization platform and has not been configured in the VPN device, so that there is no resource of the second terminal in the VPN device as the VPN parameter configuration information. Therefore, after it is determined that the user account does not have the access right and the first resource of the second terminal is not stored in the VPN device, the first resource of the second terminal is found in the second storage according to the first IP address of the second terminal, wherein the first resource includes the port number and the transport layer protocol of the second terminal, and then the first resource of the second terminal is used as the VPN configuration information for establishing the VPN connection. Only after the second terminal is configured in the VPN device, the second terminal can communicate with the remote terminal outside.

[0063] S103, acquiring the second resource of the VPN device.

[0064] S104, generating the first firewall script instruction, the second firewall script instruction and the VPN device script instruction according to the first resource and the second resource.

[0065] In steps S103 and S104, the firewall is a network security system located between the internal network and the external network, which allows or restricts the transmission of data according to specific rules. In the prior art, the access right of the user to the enterprise internal terminal needs to be manually configured by the administrator to open the access right between the first terminal and the second terminal. However, in the above method, in the scene where the VPN account accesses multiple second terminals, when the terminal resources in the firewall control area are accessed, the administrator needs to manually configure the policy in the firewall control area to open the access right between the VPN user account and the second terminal. This manual configuration method is low in efficiency and accuracy, and the workload of the administrator is large and the labor cost is high. Based on the above problems, the present application proposes that when the VPN configuration is performed based on the resources of the first terminal and the second terminal to be accessed, the security areas to which the second terminal and the VPN device belong are found, the firewall permissions of each corresponding area are generated, and the script instruction for accessing the second terminal by the VPN device is executed.

[0066] S105, according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the user account is endowed with the access permission of the second terminal.

[0067] In this step, the first firewall script instruction and the second firewall script instruction are respectively pushed to the firewall for configuration and opening of the corresponding firewall policy, and the device script instruction is sent to the VPN device to execute the access to the second terminal on the VPN device. Further, the VPN system in the VPN device endows the user account with the access permission of the second terminal according to the user account and the first resource of the second terminal.

[0068] The data access method provided by the embodiment of the application solves the technical problems of low efficiency and low accuracy and large workload of the administrator in the prior art, in which the administrator needs to manually configure the policy after finding the firewall control area in sequence, and proposes that after obtaining the access request of the remote terminal to the enterprise internal terminal, it is verified whether the parsed user account has the access permission of the enterprise internal terminal. When the user account has no access permission and the resources of the enterprise internal terminal are not configured in the VPN device, the virtualization platform automatically finds the firewall security area to which the resource of the second terminal to be accessed belongs, generates the configuration information of the virtual private network user permission, the script instruction of the corresponding area firewall and the script instruction of the VPN system, and pushes them to the VPN device and the corresponding firewall respectively, so that when the user account corresponding to the VPN resource is created in the VPN device, the firewall configuration required by the user account to access the enterprise internal terminal through the VPN can be automatically opened. The automatic configuration of the VPN user permission and the related resource firewall greatly improves the processing efficiency of the user permission, improves the accuracy of the corresponding firewall configuration opening, reduces the dependence on the administrator's ability level, and reduces the labor cost.

[0069] Further, as a refinement and expansion of the specific implementation of the above embodiment, in order to completely describe the specific implementation process of the embodiment, the embodiment of the application provides another data access method, which comprises:

[0070] S201, in response to the access request of the first terminal to the second terminal, obtaining the user account corresponding to the first terminal and the first IP address of the second terminal included in the access request.

[0071] In this step, when the first terminal accesses the external network, if the user wants to access the second terminal in the enterprise internal network through the first terminal, due to the isolation between different networks, the first terminal cannot directly access the internal network, but needs to access the second terminal through the VPN channel established between the first end and the internal network by the VPN device. Therefore, when the virtualization platform obtains the access request for the second terminal initiated by the first terminal, the user account of the first terminal and the first IP address of the second terminal are obtained, and then according to the user account and the first IP address, it is judged whether the first terminal has access permission to access the enterprise internal terminal. It should be noted that the user account is an account with access permission to access the enterprise internal network set by the enterprise administrator for each employee. After the employee obtains his exclusive user account, he needs to authorize in the VPN device to log in to the internal network isolated by the VPN device.

[0072] In actual application, when the employee A of the enterprise hopes to access the "employee attendance system" in the enterprise internal network through VPN to submit an application form, the employee initiates an access request for accessing the "employee attendance system" through the first terminal, the administrator imports the access request into the virtualization platform, and the virtualization platform obtains the request of the remote terminal to access the employee attendance system, and obtains the user account of the employee A as "19288123", and the first IP address of the "employee attendance system" to be accessed as "https: / / 192.168.1.1".

[0073] S202, judge whether the user account is authorized in the VPN device, if yes, go to step S203, if no, go to step S206.

[0074] In this step, the user account is an employee exclusive account established by the enterprise administrator for each employee. The employee can install a VPN login tool on the first terminal and access the enterprise internal network using the employee exclusive account as the VPN account. However, before the employee uses the user account to access the enterprise internal network, the user account needs to be authorized in the VPN system in advance, and the connection relationship between the user account and the enterprise internal terminal that can be accessed is established. Therefore, when the employee accesses the enterprise internal network through the user account, the user account needs to be verified first to judge whether the user account has been authorized in the VPN device.

[0075] S203, obtaining the permission set corresponding to the user account.

[0076] S204, judging whether the user account has access permission to access the second terminal according to the first IP address and the permission set, if yes, going to step S205, if no, going to step S207.

[0077] In step S203 and step S204, if it is verified that the user account has been authorized for identity on the VPN device, the permission set corresponding to the user account stored in the first storage in the VPN device is acquired. It should be noted that the permission set refers to a set of permissions of enterprise intranet resources that the user account can access. Then, whether the second terminal is included in the permission set is determined according to the first IP address of the second terminal.

[0078] In the embodiment of the present application, in step 204, that is, according to the first IP address and the permission set, it is determined whether the user account has access permission to the second terminal, specifically including: determining whether the first IP address is included in the permission set; if yes, it is determined that the user account has access permission to the second terminal; if no, it is determined that the user account does not have access permission to the second terminal.

[0079] In this embodiment, the first IP address of the second terminal is matched with the IP addresses of the enterprise internal terminals that all user accounts in the permission set have access permission to. If the same IP address as the first IP address is found in the permission set, it indicates that the user account has access permission, and a VPN connection channel can be directly established for it. If the same IP address as the first IP address is not found in the permission set, it indicates that the user account does not have access permission to the second terminal, and the access permission needs to be configured for it.

[0080] S205, a VPN connection between the first terminal and the second terminal is established.

[0081] In this step, after it is determined that the user account corresponding to the first terminal has access permission to the second terminal in the enterprise intranet, a VPN connection between the first terminal and the second terminal is established through the VPN device, so that the first terminal is connected to the enterprise local intranet, and the user can access the resources of the enterprise intranet.

[0082] S206, the user account is authorized in the VPN device.

[0083] In this step, after it is verified that the user account has not been authorized for identity in the VPN device, the user account is authorized for identity on the VPN device.

[0084] In actual application, it is determined whether the user account "19288123" already exists in the VPN device. If it exists, it is further determined whether the account has access permission to the "employee attendance system". If it has access permission, a VPN connection between the first terminal and the "employee attendance system" is established. If the account does not exist, the account is authorized.

[0085] S207. Determine whether the first storage stores the first resource of the second terminal. If yes, go to step S208; if no, go to step S209.

[0086] In this step, after determining that the user account does not have the access permission to access the second terminal, it is necessary to verify whether the resource of the second terminal is configured in the VPN device, that is, to determine whether the first storage stores the first resource of the second terminal. If the first storage does not store the first resource, it indicates that the second terminal is only registered in the virtualization platform and is not configured in the VPN device, so that the VPN device does not have the resource of the second terminal as the VPN parameter configuration information.

[0087] S208. According to the user account and the first resource, assign the user account the access permission to access the second terminal in the VPN device.

[0088] In this step, when it is determined that the VPN device has the resource of the second terminal, it indicates that the second terminal has been configured in the VPN device. At this time, the user account and the first resource of the second terminal are sent to the VPN device as the VPN configuration information, and the user account is assigned the access permission to access the second terminal, so that the user account can access the intranet resource through the VPN channel. Thereafter, the VPN connection between the first terminal and the second terminal is established.

[0089] In actual application, if the user account does not have the access permission, according to the first IP address, it is determined whether the resource of the “employee attendance system” exists in the VPN system. If yes, the user account is assigned the access permission in the VPN device.

[0090] S209. According to the first IP address, retrieve the first resource of the second terminal in the second storage.

[0091] In this step, when the enterprise cooperates with the virtualization platform, the enterprise will import the resource information of all internal terminals into the virtualization platform in sequence, and the virtualization platform uses the second storage to save the received terminal resource information. After determining that the user account does not have the access permission to access the second terminal and the first resource of the second terminal does not exist in the VPN device, it is necessary to obtain the first resource of the second terminal to configure the permission for the user account. At this time, according to the first IP address of the second terminal, the first resource corresponding to the second terminal is searched in the second storage, wherein the first resource includes the first port number and the transport layer protocol of the second terminal, and then the user account and the first resource are used to configure the access permission of the user account to access the second terminal in the VPN device.

[0092] S210. Obtain the second resource of the VPN device.

[0093] In this step, the second resource of the VPN device is obtained in the first storage, and specifically, the second resource includes the second IP address, the second port number and the transport layer protocol of the VPN device. Then, the five-tuple information is formed according to the second IP address, the second port number, the first IP address, the first port number of the second terminal to be accessed and the transport layer protocol of the virtual private network.

[0094] In actual application, if the resource of the "employee attendance system" does not exist in the VPN device, the first resource of the "employee attendance system" is obtained in the second storage, including the first IP address: 192.168.1.1; the port number: 443; and the transport layer protocol: TCP. The second resource of the VPN device is obtained, including the second IP address: 172.168.2.2; the port number: 8888, and the five-tuple is formed according to the first resource, that is, 172.168.2.2, 8888, 192.168.1.1, 443 and TCP.

[0095] S211, determine the first network segment information corresponding to the first firewall according to the first IP address, wherein the first firewall is the firewall corresponding to the second terminal.

[0096] S212, determine the first firewall type according to the first network segment information.

[0097] S213, generate the first firewall script instruction according to the first firewall type, the first resource and the second resource.

[0098] In steps S211 to S213, different security areas are controlled by different firewalls, and the manufacturers and models of each firewall are different, so that the formats of the script instructions of the firewalls are different. Therefore, the firewall types of different security areas need to be determined, and the script instructions suitable for the types are respectively generated. Specifically, according to the first IP address of the second terminal, the IP network segment controlled by the first firewall of the security area "office application area" corresponding to the second terminal is found, that is, the first network segment information, and according to the first network segment information, the firewall type of the first firewall is determined in the second storage. Then, according to the five-tuple information formed by the second resource of the VPN device and the first resource of the second terminal, the first firewall script instruction suitable for the first firewall type is generated in combination with the first firewall type.

[0099] S214, determine the second IP address of the VPN device according to the second resource.

[0100] S215, determine the second network segment information corresponding to the second firewall according to the second IP address, wherein the second firewall is the firewall corresponding to the VPN device.

[0101] S216, determine the second firewall type according to the second network segment information.

[0102] S217, generating a second firewall script instruction according to the second firewall type, the first resource and the second resource.

[0103] In steps S214-S217, the second IP address in the second resource of the VPN device is acquired, and according to the second IP address, the second network segment information corresponding to the second firewall of the "VPN access area" is determined. In the second storage, the second firewall type of the second firewall is determined according to the second network segment information. Further, the five-tuple information formed by the first resource of the second terminal and the second resource of the VPN device is combined with the second firewall type to generate the second firewall script instruction suitable for the second firewall.

[0104] In the above manner, the firewall type of each control area is determined for different security areas, and then the script instruction suitable for different firewalls is generated according to the five-tuple information combined with the firewall type, which improves the adaptation degree of the script instruction and the firewall type, ensures that the script instruction can be executed correctly, and further improves the accuracy of the firewall configuration opening.

[0105] S218, generating a VPN device script instruction according to the user account and the first resource.

[0106] In this step, the permission is jointly controlled by the first firewall, the second firewall and the VPN device, so when the firewall script instruction is generated, the script instruction for executing the VPN device to access the second terminal is also generated according to the user account, the first IP address and the first port number of the second terminal to be accessed.

[0107] S219, sending the first firewall script instruction to the first firewall.

[0108] S220, sending the second firewall script instruction to the second firewall.

[0109] S221, sending the user account, the first resource and the VPN device script instruction to the VPN device.

[0110] S222, according to the user account and the first resource, assigning the user account with the access permission to access the second terminal in the VPN device.

[0111] In steps S218-S222, the first firewall script instruction is pushed to the first firewall for execution, so that the first firewall is configured and the corresponding firewall policy is opened. Meanwhile, the second firewall script instruction is pushed to the second firewall for execution, so that the second firewall is configured and the corresponding firewall policy is opened. Further, the device script instruction is sent to the VPN device, so that the second terminal can be accessed on the VPN device. Meanwhile, the user account and the first resource of the second terminal are sent to the VPN device as VPN configuration resources, and the access right of the second terminal is given to the user account in the VPN device.

[0112] In the above manner, the VPN in the end-to-end mode between the enterprise gateways of the enterprise organization is automatically established, the demand of enterprise mobile office and branch interconnection is met, the workload of the administrator is reduced, and the labor cost is effectively reduced.

[0113] S223, receiving the firewall policy opening result.

[0114] S224, generating prompt information according to the user account, the access right and the firewall policy opening result.

[0115] S225, sending the prompt information.

[0116] In steps S223-S225, during the process of pushing the firewall script instruction to the firewall, the firewall script instruction may not be successfully pushed to the firewall due to network fluctuation, or the firewall cannot execute due to script instruction error, so that the firewall policy cannot be opened. At this time, the firewall sends the firewall policy opening success or failure result to the virtualization platform. Then, the prompt information is generated according to the user account, the configured access right and the received firewall policy opening result, and the prompt information is sent to the administrator, so that the administrator can know the situation in time.

[0117] In practical application, according to the quintuple information, it is confirmed that the corresponding firewall control areas are respectively "VPN access area" and "office application area", and the control network segment information is respectively 172.168.2.0 / 24 and 192.168.1.0 / 24. According to the network segment information of 172.168.2.0 / 24 and 192.168.1.0 / 24, it is confirmed that the firewall types are respectively H3C-6600 and Huawei-5960. According to the quintuple information, combined with the firewall type, the firewall script instructions suitable for H3C-6600 and Huawei-5960 are respectively generated, and are respectively pushed to the firewall for execution, so as to configure the firewall and open the corresponding firewall policy. After that, the user account "19288123" is given the access permission of "employee attendance system" on the VPN device. The user account, access permission and firewall opening policy result are sent to the administrator. After the above configuration is automatically opened, employee A can access the intranet "employee attendance system" after logging in the VPN.

[0118] Optionally, the embodiment of the present application provides a data access method, which comprises:

[0119] S301, in response to an access request of a first terminal to a second terminal, obtaining a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request;

[0120] S302, judging whether the user account is authorized in a VPN device, if yes, entering step S304, if not, entering step S303;

[0121] S303, authorizing the user account, and entering step S304;

[0122] S304, judging whether the user has access permission to access the second terminal, if yes, entering step S310, if not, entering step S305;

[0123] S305, judging whether the first storage stores a first resource of the second terminal, if yes, entering step S306, if not, entering step S307;

[0124] S306, giving the user account the access permission to access the second terminal, and entering step S310;

[0125] S307, according to the first IP address, calling the first resource of the second terminal in the second storage;

[0126] S308, obtaining a second resource of the VPN device;

[0127] S308, generating a first firewall script instruction, a second firewall script instruction and a VPN device script instruction according to the first resource and the second resource;

[0128] S309, according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the user account is endowed with access permission to access the second terminal;

[0129] S310, the VPN connection is established for the first terminal and the second terminal.

[0130] In this embodiment, when the virtualization platform receives the VPN account request of the enterprise employee, the system resource demand to be accessed is automatically stripped out, and each security area to which the resource belongs is found, and the configuration information of the VPN gateway user permission and the configuration information of the corresponding area firewall configuration are generated and pushed to the corresponding VPN device and firewall, which are loaded by the device as user account configuration permission. Further, when facing a large number of VPN account demands, the processing efficiency and the accuracy of policy opening are greatly improved, and the dependence on the ability level of the VPN system administrator is reduced.

[0131] Specifically, the first step: obtaining user account information and IP address of the second terminal to be accessed.

[0132] The second step: judging whether the user account exists, if it exists, then entering the next step of judging the permission; if it does not exist, then authorizing the user account and jumping to the fourth step.

[0133] The third step: if the account exists, then judging whether the user account has access permission according to the IP address of the target address to be accessed, if it has access permission, then directly establishing the VPN connection; if it does not have access permission, then entering the fourth step of resource judgment.

[0134] The fourth step: judging whether the resource of the second terminal exists in the VPN device according to the IP address of the second terminal, if it exists, then directly jumping to the seventh step of endowing the user account with permission; if it does not exist, then entering the fifth step.

[0135] The fifth step: generating the first resource of the second terminal according to the second storage, the first IP address, the first port number and the transmission layer protocol of the second terminal, and entering the sixth step.

[0136] The sixth step: obtaining the second IP address, the second port number and the transmission layer protocol of the VPN device, and then forming the five-tuple information with the first IP address, the first port number and the transmission layer protocol of the second terminal. According to the five-tuple information, the IP network segment controlled by the corresponding security area firewall is found, so as to determine the type of firewall to be pushed. The five-tuple information is translated into a script command that can be recognized by the firewall of this type, and is pushed to the firewall, so that the firewall automatically configures and opens the firewall policy after receiving the script command.

[0137] The seventh step: endowing the user account with permission.

[0138] The eighth step is to return the result of whether the user account, access permission and firewall policy are successfully opened to the administrator.

[0139] In the above manner, when creating a VPN resource, the firewall configuration required by the system resource accessed by the user through the VPN can be automatically opened synchronously. The processing efficiency is greatly improved when facing a large number of VPN account requirements, and the accuracy of opening the corresponding firewall configuration is improved, and the dependence on the ability level of the VPN system administrator is reduced, and the labor cost is reduced.

[0140] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a data access device 400 suitable for a virtualization platform, wherein the virtualization platform includes a VPN device, such as Figure 3 As shown in the figure, the device comprises:

[0141] The first acquisition module 401 is configured to, in response to an access request of a first terminal to a second terminal, acquire a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request.

[0142] The calling module 402 is configured to, in the case that the user account does not have access permission to access the second terminal and the first storage does not store the first resource of the second terminal, call the first resource of the second terminal in the second storage according to the first IP address.

[0143] The second acquisition module 403 is configured to acquire a second resource of the VPN device.

[0144] The generation module 404 is configured to generate a first firewall script instruction and a second firewall script instruction according to the first resource and the second resource.

[0145] The processing module 405 is configured to assign the user account with access permission to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction.

[0146] Optionally, the device further comprises:

[0147] The judgment module 406 is configured to judge whether the user account is authorized in the VPN device.

[0148] The third acquisition module 407 is configured to, if yes, acquire a permission set corresponding to the user account.

[0149] Optionally, the judgment module 406 is further configured to judge whether the user account has access permission to access the second terminal according to the first IP address and the permission set.

[0150] Optionally, the apparatus further comprises:

[0151] an authorization module 408 configured to authorize the user account in the VPN device if the answer is no.

[0152] Optionally, the judgment module 406 is further configured to judge whether the first IP address is contained in the permission set.

[0153] Optionally, the apparatus further comprises:

[0154] a determination module 409 configured to determine that the user account has the access permission to access the second terminal if the answer is yes;

[0155] and determine that the user account does not have the access permission to access the second terminal if the answer is no.

[0156] Optionally, the judgment module 406 is further configured to judge whether the first resource of the second terminal is stored in the first storage.

[0157] Optionally, the processing module 405 is further configured to, if the answer is yes, assign the user account the access permission to access the second terminal in the VPN device according to the user account and the first resource.

[0158] Optionally, the generation module 404 is specifically configured to:

[0159] determine first network segment information corresponding to a first firewall according to the first IP address, wherein the first firewall is a firewall corresponding to the second terminal;

[0160] determine a first firewall type according to the first network segment information;

[0161] generate a first firewall script instruction according to the first firewall type, the first resource and a second resource;

[0162] determine a second IP address of the VPN device according to the second resource;

[0163] determine second network segment information corresponding to a second firewall according to the second IP address, wherein the second firewall is a firewall corresponding to the VPN device;

[0164] determine a second firewall type according to the second network segment information;

[0165] generate a second firewall script instruction according to the second firewall type, the first resource and the second resource;

[0166] generate a VPN device script instruction according to the user account and the first resource.

[0167] Optionally, the processing module 405 is further configured to:

[0168] send the first firewall script instruction to the first firewall.

[0169] sending the second firewall script instruction to the second firewall;

[0170] sending the user account, the first resource and the VPN device script instruction to the VPN device;

[0171] according to the user account and the first resource, granting the user account the access permission to the second terminal in the VPN device.

[0172] Optionally, the apparatus further comprises:

[0173] the receiving module 410 is configured to receive the firewall policy opening result.

[0174] Optionally, the generating module 404 is further configured to generate the prompt information according to the user account, the access permission and the firewall policy opening result.

[0175] Optionally, the apparatus further comprises:

[0176] the sending module 411 is configured to send the prompt information.

[0177] The data access apparatus 400 provided by the embodiments of the present application is based on the technical problem that in the prior art, the administrator needs to manually configure the policy after finding the firewall control area in sequence, which is inefficient and inaccurate, and the administrator has a heavy workload when facing a large number of VPN account demands. After obtaining the access request from the remote terminal to the enterprise internal terminal, the user account is verified whether it has the access permission to the enterprise internal terminal. When the user account has no access permission and the resource of the enterprise internal terminal is not configured in the VPN device, the virtualization platform automatically finds the firewall security area to which the resource of the second terminal to be accessed belongs, generates the configuration information of the virtual private network user permission, the script instruction of the corresponding area firewall and the script instruction of the VPN device, and pushes them to the VPN device and the corresponding firewall respectively. When the user account corresponding to the VPN resource is created in the VPN device, the firewall configuration required by the user account to access the resource of the enterprise internal terminal through the VPN can be automatically opened. The automatic configuration of the VPN user permission and the related resource firewall is realized, which greatly improves the processing efficiency of the user permission, improves the accuracy of the corresponding firewall configuration opening, reduces the dependence on the administrator's ability level, and reduces the labor cost.

[0178] In the example embodiments, the present application further provides a computer device comprising a memory and a processor. The memory stores a computer program, and the processor is configured to execute the program stored in the memory to execute the data access method in the above embodiments.

[0179] In the example embodiment, the application also provides a readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the data access method.

[0180] From the above description of the embodiments, those skilled in the art can clearly understand that the application can be implemented by hardware, or by means of software and a necessary universal hardware platform. Based on such understanding, the technical solution of the application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.), and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method described in each embodiment scenario of the application.

[0181] Those skilled in the art can understand that the drawings are only schematic of a preferred embodiment scenario, and the modules or flows in the drawings are not necessarily required for implementing the application.

[0182] Those skilled in the art can understand that the modules in the device in the embodiment scenario can be distributed in the device in the embodiment scenario according to the description of the embodiment scenario, or can be changed to be located in one or more devices different from the embodiment scenario. The modules in the above embodiment scenario can be combined as one module, or can be further split into a plurality of sub-modules.

[0183] The above application serial numbers are only for description, and do not represent the advantages or disadvantages of the embodiment scenario.

[0184] The above disclosure is only some specific embodiment scenarios of the application, but the application is not limited thereto, and any variation that can be thought of by those skilled in the art should fall within the protection scope of the application.

Claims

1. A data access method, characterized by, The method is suitable for a virtualization platform, wherein the virtualization platform comprises a VPN device, and the method comprises: In response to an access request of a first terminal to a second terminal, obtaining a user account corresponding to the first terminal and a first IP address of the second terminal included in the access request; In a case where the user account does not have an access permission to access the second terminal and a first resource of the second terminal is not stored in a first storage, the first resource of the second terminal is retrieved from a second storage according to the first IP address, wherein the first storage is a storage in the VPN device, and the second storage is a general storage of the virtualization platform; Obtaining a second resource of the VPN device; Generating a first firewall script instruction, a second firewall script instruction and a VPN device script instruction according to the first resource and the second resource; According to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the user account is given an access permission to access the second terminal; The step of generating the first firewall script instruction, the second firewall script instruction and the VPN device script instruction according to the first resource and the second resource specifically comprises: According to the first IP address, determining first network segment information corresponding to a first firewall, wherein the first firewall is a firewall corresponding to the second terminal; According to the first network segment information, determining a first firewall type; According to the first firewall type, the first resource and the second resource, generating the first firewall script instruction; According to the second resource, determining a second IP address of the VPN device; According to the second IP address, determining second network segment information corresponding to a second firewall, wherein the second firewall is a firewall corresponding to the VPN device; According to the second network segment information, determining a second firewall type; According to the second firewall type, the first resource and the second resource, generating the second firewall script instruction; According to the user account and the first resource, generating the VPN device script instruction; The step of giving the user account an access permission to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction specifically comprises: Sending the first firewall script instruction to the first firewall; Sending the second firewall script instruction to the second firewall; Sending the user account, the first resource and the VPN device script instruction to the VPN device; According to the user account and the first resource, giving the user account an access permission to access the second terminal in the VPN device.

2. The method of claim 1, wherein, After the step of obtaining the user account of the first terminal and the first IP address of the second terminal included in the access request in response to the access request of the first terminal to the second terminal, the method further comprises: Determining whether the user account is authorized in the VPN device; If yes, a permission set corresponding to the user account is acquired; According to the first IP address and the permission set, it is judged whether the user account has access permission to access the second terminal; If no, the user account is authorized in the VPN device.

3. The method of claim 2, wherein, The step of judging whether the user has access permission to access the second terminal according to the first IP address and the permission set specifically comprises: It is judged whether the first IP address is contained in the permission set; If yes, it is determined that the user account has access permission to access the second terminal; If no, it is determined that the user account does not have access permission to access the second terminal.

4. The method of claim 3, wherein, After it is determined that the user does not have access permission to access the second terminal, the method further comprises: It is judged whether the first resource of the second terminal is stored in the first storage; If yes, the user account is given access permission to access the second terminal in the VPN device according to the user account and the first resource.

5. The method according to any one of claims 1 to 4, characterized in that, After the user account is given access permission to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction, the method further comprises: A firewall policy opening result is received; Prompt information is generated according to the user account, the access permission and the firewall policy opening result; The prompt information is sent.

6. A data access device, characterized by The method is suitable for a virtualization platform, wherein the virtualization platform comprises a VPN device, and the apparatus comprises: A first acquisition module is configured to acquire a user account corresponding to a first terminal and a first IP address of a second terminal included in an access request of the first terminal to the second terminal in response to the access request of the first terminal to the second terminal; A calling module is configured to call the first resource of the second terminal in a second storage according to the first IP address in a case where the user account does not have access permission to access the second terminal and the first resource of the second terminal is not stored in a first storage, wherein the first storage is a storage in the VPN device, and the second storage is a general storage of the virtualization platform; A second acquisition module is configured to acquire a second resource of the VPN device; A generation module is configured to generate a first firewall script instruction, a second firewall script instruction and a VPN device script instruction according to the first resource and the second resource; A processing module is configured to give the user account access permission to access the second terminal according to the user account, the first resource, the first firewall script instruction, the second firewall script instruction and the VPN device script instruction; The generation module is specifically configured to: Determine first network segment information corresponding to a first firewall according to the first IP address, wherein the first firewall is a firewall corresponding to the second terminal; Determine a first firewall type according to the first network segment information; Generate the first firewall script instruction according to the first firewall type, the first resource and the second resource; Determine a second IP address of the VPN device according to the second resource; According to the second IP address, second network segment information corresponding to the second firewall is determined, wherein the second firewall is a firewall corresponding to a VPN device; According to the second network segment information, a second firewall type is determined; According to the second firewall type, the first resource and the second resource, a second firewall script instruction is generated; According to the user account and the first resource, a VPN device script instruction is generated; The processing module is specifically configured to: send the first firewall script instruction to the first firewall; send the second firewall script instruction to the second firewall; send the user account, the first resource and the VPN device script instruction to the VPN device; According to the user account and the first resource, the user account is given access permission to the second terminal in the VPN device. 7.A computer device, comprising a memory and a processor, the memory storing a computer program, and the computer device is characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

8. A readable storage medium, having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images