An intranet service system, an intranet service data access method and device

Abstract

The application discloses an intranet service system, an intranet service data access method and device, electronic equipment and a storage medium, and relates to the technical field of network security. In the system, an information server sends a device certificate to a client; an access tunnel server sends access tunnel parameters for establishing an access tunnel to the client, and establishes an access tunnel between the client and an authentication server for the client; the authentication server sends an access token for accessing a service tunnel to the client through the access tunnel; a service tunnel server sends service tunnel parameters for establishing a service tunnel to the client, and establishes a service tunnel between the client and an intranet service data server for the client; and the intranet service data server provides intranet service data to the client through the service tunnel. Through the intranet service system, intranet service data can be concealed, and the security of intranet service data is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to an intranet service system, an intranet service data access method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the increasing maturity and vigorous development of technologies such as the Internet, the Internet of Things, artificial intelligence and cloud computing, complex network access environments, changing personnel roles and ubiquitous security attacks continue to threaten enterprise network facilities. How to safely access internal network data in a complex network environment has become one of the important research directions in network security.

[0003] Currently, the C / S (Client / Server) architecture puts forward higher and more detailed requirements for service end business publishing, business port exposure and access permission control. Based on the traditional network architecture system, enterprises generally deploy firewalls or other security gateway products at the network boundary to control access to the Internet. However, with the increase of enterprise business, more and more business and ports need to be exposed and opened, and the possibility of security threats is increasing, increasing the risk of enterprise internal networks.

[0004] Therefore, how to conceal intranet business data and improve the security of intranet business data has become a problem to be solved. SUMMARY

[0005] Therefore, the embodiments of the present application provide an intranet service system, an intranet service data access method and device, an electronic device and a storage medium, which help to solve the problem of exposure of intranet business data in the prior art, thereby increasing the risk of enterprise intranet business data.

[0006] The first aspect of the embodiments of the present application provides an intranet service system, which comprises an information service end, an access tunnel service end, an authentication service end, a business tunnel service end and an intranet business data service end located in an intranet;

[0007] The information service end is configured to obtain a device authentication request message sent by a client, send a device certificate to the client, the client is a client running in an extranet device, the device authentication request message is used to request to authenticate the extranet device running the client, and the device certificate is an authentication result certificate for the extranet device running the client;

[0008] The access tunnel service end is configured to obtain an access tunnel request message sent by the client, the access tunnel request message comprising the device certificate, perform a verification operation on the device certificate, and if a verification pass result for the device certificate is obtained, send an access tunnel parameter for establishing an access tunnel to the client, and establish the access tunnel between the client and the authentication service end for the client.

[0009] The authentication service end is configured to obtain a user authentication request message sent by the client through the access tunnel, the user authentication request message comprising user identity information corresponding to the client, perform a verification operation on the user identity information, and if a verification pass result for the user identity information is obtained, send an access token for accessing a service tunnel to the client through the access tunnel.

[0010] The service tunnel service end is configured to obtain a service tunnel request message sent by the client, the service tunnel request message comprising the device certificate and the access token, perform a verification operation on the device certificate and the access token, and if a verification pass result for the device certificate and the access token is obtained, send a service tunnel parameter for establishing a service tunnel to the client, and establish the service tunnel between the client and the intranet service data service end for the client.

[0011] The intranet service data service end is configured to obtain an intranet service data access request message sent by the client through the service tunnel, and provide intranet service data to the client through the service tunnel.

[0012] Optionally, the information service end is specifically configured to, after obtaining the device authentication request message sent by the client, obtain user identity information of the client sending the device authentication request message according to the device authentication request message; the user identity information comprises user communication information.

[0013] Send a first dynamic verification code to a user device corresponding to the user communication information.

[0014] Obtain a second dynamic verification code provided by the user through the client;

[0015] Verify the second dynamic verification code according to the first dynamic verification code.

[0016] Optionally, the information service end is further configured to obtain a verification result of the first dynamic verification code on the second dynamic verification code.

[0017] If the verification passes, send a device certificate to the client.

[0018] If the verification fails, a prompt message indicating that the external network device is an illegal device is sent to the client.

[0019] Optionally, the access tunnel server is specifically configured to: if the verification of the device certificate is passed, send access tunnel parameters for establishing an access tunnel to the client, the access tunnel parameters being parameters after encryption processing.

[0020] Optionally, the access tunnel server is further configured to: if the verification of the device certificate fails, send a prompt message indicating that the access tunnel parameters cannot be returned to the client.

[0021] Optionally, the authentication server performing the verification operation on the user identity information includes: obtaining the user identity information and the login password provided by the client; querying the login password corresponding to the user identity information provided by the client in the information database of the authentication server; and verifying the login password obtained by querying in the information database by the login password corresponding to the user identity information provided by the client.

[0022] Optionally, the authentication server is further configured to obtain the verification result of the login password obtained by querying in the information database by the login password corresponding to the user identity information provided by the client.

[0023] If the verification is passed, an access token for accessing a service tunnel is sent to the client through the access tunnel;

[0024] If the verification fails, a prompt message indicating that the user identity information verification fails is sent to the client.

[0025] Optionally, the service tunnel server is specifically configured to: if the verification of the device certificate and the access token is passed, send service tunnel parameters for establishing a service tunnel to the client, the service tunnel parameters being parameters after encryption processing.

[0026] Optionally, the service tunnel server is further configured to: if the verification of the device certificate and the access token fails, send a prompt message indicating that the service tunnel parameters cannot be returned to the client.

[0027] Optionally, the authentication server is specifically configured to: if the verification of the user identity information is passed, obtain the internal network service data access permission information corresponding to the user identity information, determine the service tunnel level corresponding to the internal network service data access permission information according to the internal network service data access permission information, obtain an access token corresponding to the service tunnel level, and send the access token to the client through the access tunnel.

[0028] The service tunnel server is specifically configured to determine the service tunnel level corresponding to the access token, obtain service tunnel parameters corresponding to the service tunnel level, send the service tunnel parameters to the client, and establish a service tunnel corresponding to the service tunnel level for the client.

[0029] The internal network service data server is specifically configured to provide internal network service data corresponding to the service tunnel level to the client through the service tunnel.

[0030] Optionally, the internal network service data access permission information includes at least one of the following permission information: internal network service full data access permission information for indicating permission to access all internal network service data, internal network service multiple data access permission information for indicating permission to access multiple internal network service data, and internal network service targeted data access permission information for indicating permission to access targeted internal network service data.

[0031] The service tunnel level corresponding to the internal network service full data access permission information is a full data level service tunnel, the service tunnel level corresponding to the internal network service multiple data access permission information is a multiple data level service tunnel, and the service tunnel level corresponding to the internal network service targeted data access permission information is a targeted data level service tunnel.

[0032] Optionally, the service tunnel server is further specifically configured to determine a service tunnel sub-level corresponding to the device certificate after determining the service tunnel level corresponding to the access token, wherein the service tunnel sub-level is one of the service tunnel levels.

[0033] The obtaining and sending of the service tunnel parameters corresponding to the service tunnel level to the client includes obtaining service tunnel parameters corresponding to the service tunnel level and corresponding to the service tunnel sub-level.

[0034] The establishment of the service tunnel corresponding to the service tunnel level for the client includes establishing a service tunnel corresponding to the service tunnel level and corresponding to the service tunnel sub-level for the client.

[0035] The providing of the internal network service data corresponding to the service tunnel level to the client through the service tunnel includes providing internal network service data corresponding to the service tunnel level and corresponding to the service tunnel sub-level to the client through the service tunnel.

[0036] Optionally, the service tunnel server is specifically configured to query the access times and / or access time length of the external network device running the client to access the internal network service system through the client according to the device certificate, and determine the service tunnel sub-level corresponding to the device certificate according to the access times and / or access time length.

[0037] Optionally, the service tunnel server is specifically configured to determine whether the access times reach or exceed a preset access times, and / or determine whether the access time length reaches or exceeds a preset access time length, and if it is determined that the access times reach or exceed the preset access times, and / or if it is determined that the access time length reaches or exceeds the preset access time length, then determine that the service tunnel sub-level corresponding to the device certificate is a non-watermark service tunnel sub-level, otherwise, determine that the service tunnel sub-level corresponding to the device certificate is a watermark service tunnel sub-level, wherein the non-watermark service tunnel sub-level is used to indicate that no watermark data is added to the internal network service data provided to the client, and the watermark service tunnel sub-level is used to indicate that watermark data is added to the internal network service data provided to the client.

[0038] Optionally, the access tunnel established by the access tunnel server for the client is a temporary channel, and the temporary channel is invalid after the user passes through the access tunnel.

[0039] Optionally, the service tunnel established by the service tunnel server for the client is a temporary channel, and the temporary channel is invalid after the user passes through the access tunnel.

[0040] Optionally, the client running on the external network device is a tunnel client program.

[0041] Optionally, the tunnel protocol of the access tunnel and the tunnel protocol of the service tunnel are both user datagram protocol.

[0042] The second aspect of the embodiment of the application provides an internal network service data access method, which is applied to a client running in an external network device, and the method comprises the following steps:

[0043] sending a device authentication request message to an information server located in an internal network, obtaining a device certificate sent by the information server, wherein the device certificate is an authentication result certificate for the external network device of the client;

[0044] sending an access tunnel request message to an access tunnel server located in the internal network, wherein the access tunnel request message comprises the device certificate, obtaining access tunnel parameters for establishing an access tunnel sent by the access tunnel server, and requesting the access tunnel server to establish an access tunnel between the client and an authentication server located in the internal network according to the access tunnel parameters;

[0045] sending a user authentication request message to the authentication server through the access tunnel, the user authentication request message comprising user identity information corresponding to the client, and obtaining an access token for accessing the service tunnel sent by the authentication server through the access tunnel;

[0046] sending a service tunnel request message to a service tunnel server located in the intranet, the service tunnel request message comprising the device certificate and the access token, obtaining service tunnel parameters for establishing a service tunnel sent by the service tunnel server, and requesting the access tunnel server to establish a service tunnel between the client and an intranet service data server located in the intranet according to the service tunnel parameters;

[0047] sending an intranet service data access request message to the intranet service data server through the service tunnel, and obtaining intranet service data provided by the intranet service data server through the service tunnel.

[0048] Optionally, after sending the device authentication request message to the information server located in the intranet, obtaining user identity information of the client sending the device request message according to the device authentication request message; the user identity information comprises user personal communication information.

[0049] obtaining a first dynamic verification code on a user device corresponding to the user personal communication information;

[0050] providing the obtained first dynamic verification code to the client, and generating a second dynamic verification code;

[0051] verifying the second dynamic verification code according to the first dynamic verification code.

[0052] Optionally, obtaining a verification result of the first dynamic verification code on the second dynamic verification code;

[0053] if the verification is passed, obtaining a device certificate sent by the information server;

[0054] if the verification is not passed, obtaining a prompt message sent by the information server for indicating that the extranet device is an illegal device.

[0055] Optionally, the access tunnel parameters for establishing the access tunnel sent by the access tunnel server comprise parameters after encryption processing.

[0056] Optionally, after sending the access tunnel request message to the access tunnel server located in the intranet, the method further comprises:

[0057] Obtaining a prompt message sent by the access tunnel server and indicating that the access tunnel parameter cannot be returned.

[0058] Optionally, after the user authentication request message including the user identity information corresponding to the client is sent to the authentication server through the access tunnel, the method further comprises:

[0059] Providing the user identity information and the login password to the authentication server; and verifying the login password corresponding to the user identity information provided by the client against the login password obtained by querying the information database of the authentication server.

[0060] Optionally, the method further comprises:

[0061] Obtaining a verification result of the login password corresponding to the user identity information provided by the client against the login password obtained by querying the information database of the authentication server.

[0062] If the verification is passed, obtaining an access token for accessing the service tunnel sent by the authentication server through the access tunnel;

[0063] If the verification is not passed, obtaining a prompt message sent by the authentication server and indicating that the user identity information verification fails.

[0064] Optionally, the service tunnel parameter for establishing the service tunnel sent by the service tunnel server comprises a parameter after encryption processing.

[0065] Optionally, after the service tunnel request message including the device certificate and the access token is sent to the service tunnel server located in the intranet, the method further comprises:

[0066] Obtaining a prompt message sent by the service tunnel server and indicating that the service tunnel parameter cannot be returned.

[0067] Optionally, the access tunnel between the client and the authentication server established for the client is a temporary channel, and the temporary channel is invalidated after the user passes through the access tunnel.

[0068] Optionally, the service tunnel between the client and the intranet service data server established for the client is a temporary channel, and the temporary channel is invalidated after the user passes through the access tunnel.

[0069] Optionally, the client running on the device in the extranet is a tunnel client program.

[0070] Optionally, the tunnel protocol of the access tunnel and the tunnel protocol of the service tunnel are both user datagram protocol. Embodiments of the third aspect of the present application provide an internal network service data access method, which comprises:

[0071] A first service end located in the internal network obtains an authentication request message sent by a client through a first service layer tunnel, the client is a client running on a device in the external network, and the authentication request message is used to request authentication of the device in the external network or user identity information corresponding to the client;

[0072] If the first service end obtains an authentication result for the device in the external network or the user identity information, the first service end sends an access token used to access a second service layer tunnel to the client through the first service layer tunnel;

[0073] A second service end located in the internal network obtains an internal network service data access request message sent by the client through the second service layer tunnel, the client accesses the second service layer tunnel by using the access token;

[0074] The second service end provides internal network service data to the client through the second service layer tunnel for the internal network service data access request message.

[0075] Embodiments of the fourth aspect of the present application provide an internal network service data access method, which is applied to a client running on a device in an external network, and the method comprises:

[0076] Sending an authentication request message to a first service end located in the internal network through a first service layer tunnel, the authentication request message is used to request authentication of a device in the external network running the client or user identity information corresponding to the client;

[0077] Obtaining an access token used to access a second service layer tunnel sent by the first service end through the first service layer tunnel;

[0078] Accessing the second service layer tunnel by using the access token;

[0079] Sending an internal network service data access request message to a second service end located in the internal network through the second service layer tunnel;

[0080] Obtaining internal network service data provided by the second service end through the second service layer tunnel.

[0081] Embodiments of the fifth aspect of the present application provide an internal network service data access device, which is applied to a client running on a device in an external network, and the device comprises:

[0082] The device authentication unit is configured to send a device authentication request message to an information service end located in an internal network, and obtain a device certificate sent by the information service end, wherein the device certificate is an authentication result credential for the external network device of the client.

[0083] The access tunnel establishment unit is configured to send an access tunnel request message to an access tunnel service end located in the internal network, wherein the access tunnel request message comprises the device certificate, obtain access tunnel parameters for establishing an access tunnel sent by the access tunnel service end, and request the access tunnel service end to establish the access tunnel between the client and an authentication service end located in the internal network according to the access tunnel parameters.

[0084] The user authentication unit is configured to send a user authentication request message to the authentication service end through the access tunnel, wherein the user authentication request message comprises user identity information corresponding to the client, and obtain an access token for accessing the service tunnel sent by the authentication service end through the access tunnel.

[0085] The service tunnel establishment unit is configured to send a service tunnel request message to a service tunnel service end located in the internal network, wherein the service tunnel request message comprises the device certificate and the access token, obtain service tunnel parameters for establishing a service tunnel sent by the service tunnel service end, and request the access tunnel service end to establish the service tunnel between the client and an internal network service data service end located in the internal network according to the service tunnel parameters.

[0086] The internal network service data access unit is configured to send an internal network service data access request message to the internal network service data service end through the service tunnel, and obtain internal network service data provided by the internal network service data service end through the service tunnel.

[0087] The sixth aspect of the embodiment of the present application provides an internal network service data access device, which comprises:

[0088] The authentication unit is configured to obtain, by a first service end located in an internal network, an authentication request message sent by a client through a first service layer tunnel, wherein the client is a client running on an external network device, and the authentication request message is used to request to authenticate the external network device running the client or user identity information corresponding to the client.

[0089] The access token sending unit is configured to send, by the first service end, an access token for accessing a second service layer tunnel to the client through the first service layer tunnel if an authentication result for the external network device or the user identity information is obtained.

[0090] The access second service layer tunnel unit is configured to obtain, by the second service end located in the internal network, the internal network service data access request message sent by the client through the second service layer tunnel, and the client accesses the second service layer tunnel by using the access token.

[0091] The access internal network service data unit is configured to provide, by the second service end, the internal network service data to the client through the second service layer tunnel according to the internal network service data access request message.

[0092] The seventh aspect of the embodiment of the present application provides an internal network service data access device applied to a client running in an external network device, and the device comprises:

[0093] The authentication unit is configured to send an authentication request message to a first service end located in an internal network through a first service layer tunnel, and the authentication request message is used to request to authenticate the external network device running the client or user identity information corresponding to the client;

[0094] The access token obtaining unit is configured to obtain an access token for accessing a second service layer tunnel sent by the first service end through the first service layer tunnel.

[0095] The access second service layer tunnel unit is configured to access the second service layer tunnel by using the access token.

[0096] The internal network service data access request unit is configured to send an internal network service data access request message to a second service end located in an internal network through the second service layer tunnel.

[0097] The internal network service data unit is configured to obtain internal network service data provided by the second service end through the second service layer tunnel.

[0098] The eighth aspect of the embodiment of the present application further provides an electronic device, which comprises:

[0099] A processor;

[0100] A memory;

[0101] The memory is configured to store a program of an internal network service data access method, and the program is read and executed by the processor to execute the method in the second aspect or the third aspect or the fourth aspect of the embodiment of the present application.

[0102] The ninth aspect of the embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to execute the method in the second aspect or the third aspect or the fourth aspect of the embodiment of the present application.

[0103] The intranet service system provided by the embodiments of the present application comprises an information server, an access tunnel server, an authentication server, a service tunnel server and an intranet service data server in an intranet. The information server is configured to obtain a device authentication request message sent by a client, send a device certificate to the client, and perform a verification operation on the device certificate. The client is a client running in an extranet device, the device authentication request message is used to request authentication of the extranet device running the client, and the device certificate is an authentication result certificate for the extranet device running the client. The access tunnel server is configured to obtain an access tunnel request message sent by the client, the access tunnel request message comprising the device certificate, perform a verification operation on the device certificate, and send access tunnel parameters for establishing an access tunnel to the client if a verification pass result for the device certificate is obtained, so as to establish the access tunnel between the client and the authentication server for the client. The authentication server is configured to obtain a user authentication request message sent by the client through the access tunnel, the user authentication request message comprising user identity information corresponding to the client, perform a verification operation on the user identity information, and send an access token for accessing a service tunnel to the client through the access tunnel if a verification pass result for the user identity information is obtained. The service tunnel server is configured to obtain a service tunnel request message sent by the client, the service tunnel request message comprising the device certificate and the access token, perform a verification operation on the device certificate and the access token, and send service tunnel parameters for establishing a service tunnel to the client if a verification pass result for the device certificate and the access token is obtained, so as to establish the service tunnel between the client and the intranet service data server for the client. The intranet service data server is configured to obtain an intranet service data access request message sent by the client through the service tunnel, and provide intranet service data to the client through the service tunnel. By establishing multiple layers of tunnel servers, the user accessing intranet service data and the client of the extranet device are set in multiple levels, so as to conceal the intranet service data and improve the security of the intranet service data. BRIEF DESCRIPTION OF DRAWINGS

[0104] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0105] Figure 1 is a system framework diagram of an intranet service system provided by the embodiments of the present application;

[0106] Figure 2 is a flowchart of an intranet service data access method provided by an embodiment of the present application;

[0107] Figure 3 is a specific flowchart of an intranet service data access method provided by an embodiment of the present application;

[0108] Figure 4 is a complete process flowchart of an intranet service data access method provided by an embodiment of the present application;

[0109] Figure 5 is a flowchart of another intranet service data access method provided by an embodiment of the present application;

[0110] Figure 6 is a flowchart of another intranet service data access method provided by an embodiment of the present application;

[0111] Figure 7 is a block diagram of an intranet service data access device provided by an embodiment of the present application;

[0112] Figure 8 is a block diagram of another intranet service data access device provided by an embodiment of the present application;

[0113] Figure 9 is a block diagram of another intranet service data access device provided by an embodiment of the present application;

[0114] Figure 10 is a logical structure diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0115] The embodiments of the present application provide an intranet service system, and an intranet service data access method and corresponding device, which can better conceal intranet service data and improve the security of intranet service data.

[0116] In order for those skilled in the art to better understand the technical solutions of the present application, the present application will be described in detail below with reference to the drawings in the embodiments of the present application. However, the present application can be implemented in many ways different from the description below, therefore, based on the embodiments provided by the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0117] It should be noted that the terms "first", "second", "third", and the like in the claims, specification and drawings of the present application are used for distinguishing between similar objects and are not necessarily used to describe a particular sequential or chronological order. Use of the terms so shall be interpreted to include a "reversed" sequence or order, where appropriate, unless otherwise expressly limited or implied. Also, the terms "include", "includes" and "including" are used in this specification in their broadest sense, for example, that of meaning "including, but not limited to", "including, but not limited to" or "even including other steps or elements which are not expressly listed".

[0118] The C / S architecture includes two parts of a client and a server. The client is responsible for processing the business logic of an application, including processing of data, implementation of business logic, and presentation of a user interface. The server is responsible for storing and processing data. An example of a C / S architecture project is a mail client. In the mail client, the mail client is responsible for processing the business logic of a user interface, mail processing, and mail storage. The mail server is responsible for storing mail data. The mail client communicates with the server through a dedicated communication protocol.

[0119] With the development of science and technology, the importance of network security of the server in the mainstream C / S architecture is increasingly prominent. Based on the traditional network architecture system, enterprises usually deploy firewalls or other security gateway products at the network boundary to control access to the Internet. The traditional firewall is generally used as a gateway device. With the increase of enterprise business, more and more business and ports need to be exposed and opened, and the challenge is greater, thereby bringing risks. Therefore, it is necessary to maximize the concealment of intranet business data without affecting the use of users and improve the security of intranet business data.

[0120] The intranet involved in the present application is an internal network, for example, a local area network (LAN), which is a computer communication network composed of various computers, devices, and databases connected to each other within a local geographical range, such as a school, factory, or unit, generally within a few kilometers. The internal network can be connected to a remote local area network, database, or processing center through a data communication network or a dedicated data circuit to form a larger range of information processing system.

[0121] Corresponding to the internal network is the external network, which is an external network, i.e., a wide area network (WAN). The wide area network is also called a long-distance network, which usually searches across a large physical range. The coverage ranges from tens of kilometers to thousands of kilometers, can connect multiple cities or countries, or cross several continents and provide long-distance communication, forming an international long-distance network.

[0122] The user protocol involved in the present application is divided into two types according to the type of service provided, one is TCP user protocol (Transmission Control Protocol, TCP) and the other is UDP user protocol (User Datagram Protocol, UDP). Among them, TCP is a connection-oriented, reliable, byte stream-based transport layer (Transport Layer) protocol; UDP is a connectionless transport layer protocol in the OSI (Open System Interconnection, OSI) reference model, which provides a simple unreliable message transfer service for transactions.

[0123] In the prior art, there are several mainstream technologies for hiding internal network business data. The following will briefly introduce the technologies for hiding internal network business data in the prior art and their respective advantages and disadvantages.

[0124] One is the firewall entry IP (Internet Protocol, IP) restriction technology. By setting the corresponding white list IP in the firewall, only the white list is allowed to access the enterprise's externally open IP and port to access the internal network business data, thereby improving the security of the internal network business data. This method is based on the function of adding a white list in the firewall to hide the internal network business data, and the operation is simple and fast, but it is only suitable for enterprises with small amounts of business data. When the enterprise's business data volume is large, the IP and port accessing the enterprise's internal business data are increasing, and the white list needs to be added / turned off frequently in the firewall, which is cumbersome to operate and affects the performance of the firewall.

[0125] Another is Single Packet Authorization (SPA), which is a key technology in SDP (Software Defined Perimeter). The core idea of zero trust SDP is to break the traditional perimeter protection center and establish an authorization access mechanism based on identity, operating environment and context information. SDP only allows authorized data packets to pass, and discards non-authorized data packets by default. The mechanism of discarding non-authorized data packets by default makes non-authorized clients unable to perceive the existence of valid IP and port, and realizes network stealth. SPA protocol, as an evolution protocol of port knocking, its core idea is that the client is only authorized to establish a secure connection after successful authentication through a single packet knocking, otherwise all request packets are discarded by default. The knocking packet is usually UDP, which sends a specific UDP authentication message to the server, knocks in a certain order, and adds the IP in the message to the whitelist after authentication, achieving the effect of hiding the external port. However, this method requires users on the Internet to access the enterprise intranet through network address translation, and only the client's public IP can be added to the whitelist when accessing the enterprise. However, a public IP can be used by many users, which expands the exposure surface; at the same time, SPA protocol needs to modify the firewall when used, so its universality is not strong.

[0126] In order to solve the above problems in the prior art when concealing intranet business data, the present application provides an intranet business service system, and three intranet business data access methods and corresponding devices. By establishing a multi-layer tunnel server, the user accessing the intranet business data and the client of the extranet device are set in multiple levels, the intranet business data is concealed, the exposure risk is reduced, and the security of the intranet business data is provided.

[0127] The first embodiment of the present application provides an intranet business service system. Please refer to Figure 1 , which is a system framework diagram of the first embodiment of the present application.

[0128] The following will be described in detail Figure 1 , the first embodiment of the present application provides an intranet business service system. The intranet business service system provided by the first embodiment of the present application includes an information server in the intranet, an access tunnel server, an authentication server, a business tunnel server and an intranet business data server.

[0129] The information server is configured to receive a device authentication request message sent by a client, and send a device certificate to the client. The client is a client running on an external network device. The device authentication request message is used to request authentication of the external network device running the client. The device certificate is an authentication result credential for the external network device running the client.

[0130] The external network device is an electronic terminal device, which is a user-used electronic device with a display screen and support for web browsing, including but not limited to laptops, desktop computers, smartphones, tablets, etc.

[0131] The client is a tunnel client program installed and running on the external network device or a tunnel SDK (Software Development Kit) that can access the external network device.

[0132] When a user needs to access intranet business data through an external network device, the tunnel client program or tunnel SDK is activated. After the information server receives the device authentication request message sent by the client, it obtains the user identity information of the client that sent the device authentication request message based on the device authentication request message. The user identity information includes user communication information. A first dynamic verification code is sent to the user device corresponding to the user communication information. A second dynamic verification code is obtained by the user through the client. The second dynamic verification code is verified based on the first dynamic verification code.

[0133] After receiving a device authentication request message from the client, the information server obtains the client's user identity information based on the message. This user identity information includes user communication information, which includes, but is not limited to, one or more of email addresses, mobile phone numbers, and landline numbers. A first dynamic verification code is sent to the user device corresponding to the user's communication information. In this embodiment, the user device includes, but is not limited to, one or more of laptops, desktop computers, smartphones, feature phones, and tablets. The user obtains a second dynamic verification code based on the first dynamic verification code provided by the information server to the user device. The information server then obtains the second dynamic verification code provided by the user through the client and verifies the second dynamic verification code based on the first dynamic verification code.

[0134] The generation and verification methods of the first and second dynamic verification codes are not limited here. They can be dynamic passwords (OTP, One-Time Password). Any feasible generation and verification method of dynamic verification codes is within the scope of protection requested in this application.

[0135] After the first dynamic verification code is verified against the second dynamic verification code, the information server is further configured to obtain a verification result of the first dynamic verification code against the second dynamic verification code.

[0136] If the verification is passed, the device certificate is sent to the client;

[0137] If the verification is not passed, a prompt message indicating that the external network device is an illegal device is sent to the client.

[0138] If the verification result of the first dynamic verification code against the second dynamic verification code is passed, the device certificate is sent to the client, proving that the external network device is a legal device; if the verification result of the first dynamic verification code against the second dynamic verification code is not passed, a prompt message indicating that the external network device is an illegal device is sent to the client, proving that the external network device is an illegal device.

[0139] The information server in the internal network service system is configured to send a dynamic verification code to a user device corresponding to user communication information, to verify a client sending a device authentication request message, and to obtain a relationship between an external network device and user identity information, so as to verify the external network device used by the user, and to issue a device certificate for a legal device.

[0140] The information server in the internal network service system is configured to send a dynamic verification code to a user device corresponding to user communication information, to verify a client sending a device authentication request message, and to obtain a relationship between an external network device and user identity information, so as to verify the external network device used by the user, and to issue a device certificate for a legal device.

[0141] The access tunnel server is configured to obtain an access tunnel request message sent by the client, the access tunnel request message including the device certificate, to perform a verification operation on the device certificate, and if a verification pass result for the device certificate is obtained, to send an access tunnel parameter for establishing an access tunnel to the client, and to establish the access tunnel between the client and the authentication server for the client.

[0142] The access tunnel server is configured to perform a verification operation according to the received access tunnel request message, and to obtain a verification result for the verification operation, and if a verification pass result for the device certificate is obtained, to obtain an access tunnel parameter for establishing an access tunnel, and to return the access tunnel parameter to the client, and to establish the access tunnel between the client and the authentication server for the client through the access tunnel parameter.

[0143] The access tunnel server is further configured to: if it obtains a successful verification result for the device certificate, send access tunnel parameters used to establish the access tunnel to the client, wherein the access tunnel parameters are encrypted parameters. The encryption method includes Transport Layer Security (TLS) encryption. There are many encryption methods in the prior art, and any feasible encryption method is within the scope of protection requested in this application.

[0144] The Transport Layer Security (TLS) protocol is used to provide confidentiality and data integrity between two communicating applications. HTTPS combines symmetric-key encryption and asymmetric encryption mechanisms to improve encrypted transmission speed while ensuring authentication. The encryption key is used to encrypt the data exchanged between the two parties, guaranteeing the confidentiality and reliability of communication between the two applications. This prevents attackers from eavesdropping on communication between client and server applications, significantly enhancing security.

[0145] Access tunnels, also known as pre-tunnels (PT), are preparatory tunnels for subsequent access service tunnels.

[0146] The access tunnel server performs a verification operation based on the received access tunnel request message, and then obtains the verification result for the verification operation. If the verification performed on the device certificate fails, a prompt message is sent to the client indicating that the access tunnel parameters cannot be returned, that is, the access tunnel between the client and the authentication server cannot be established for the client, and the external network device fails to access the internal network business data.

[0147] The access tunnel established by the access tunnel server for the client is a temporary channel, which becomes invalid after the user passes through the access tunnel.

[0148] The access tunnel uses the User Datagram Protocol (UDP). UDP does not establish a connection and has a silent service characteristic. After establishing the access tunnel, it returns the access tunnel parameters to the client. Only then will the authentication server send a user authentication request message to the access tunnel.

[0149] The access tunnel server, located in the intranet business service system, receives access tunnel request messages sent by clients. These messages include the device certificate of a trusted device. The server performs verification on the device certificate; if verification is successful, it obtains access tunnel parameters and sends these parameters to the client, establishing an access tunnel between the client and the authentication server. By establishing the access tunnel between the client and the authentication server using the obtained access tunnel parameters, it provides an access tunnel for external network devices to access intranet business data.

[0150] The authentication server is configured to obtain a user authentication request message sent by the client through the access tunnel, the user authentication request message comprising user identity information corresponding to the client, perform a verification operation on the user identity information, and if a verification pass result is obtained for the user identity information, send an access token for accessing a service tunnel to the client through the access tunnel.

[0151] The authentication server can also be referred to as an authentication center (AC), configured to perform a verification operation on user identity information corresponding to a client included in a received user authentication request message, and then obtain a verification result for the user identity information, and if a verification pass result is obtained for the user identity information, obtain an access token for accessing a service tunnel, and return the access token to the client.

[0152] The access token is an access credential for entering a service tunnel. In order to further ensure the security of intranet service data, the access credential (access-token) is time-limited, and if the access time of the access token is exceeded, the client needs to send a user authentication request message to the authentication server again. The access time of the access token can be set as desired.

[0153] The authentication server performs a verification operation on the user identity information, including: obtaining a user identity information and a login password provided by the client; querying a login password corresponding to the user identity information provided by the client in an information database of the authentication server; and verifying the login password obtained by querying in the information database by using the login password corresponding to the user identity information provided by the client.

[0154] After obtaining the device certificate, a login page is displayed on a display interface of the client. The login page can be a single sign-on (SSO), that is, in multiple application systems, a user only needs to log in once to access all application systems with mutual information.

[0155] The user identity information and the login password are provided on the display interface of the client. After the authentication server obtains the user identity information and the login password, the authentication server queries a login password corresponding to the user identity information provided by the client in an information database of the authentication server, and then verifies the login password obtained by querying in the information database by using the login password corresponding to the user identity information provided by the client, that is, verifies whether the login password provided by the client is consistent with the login password obtained by querying in the information database.

[0156] Obtain the verification result of the login password corresponding to the user identity information provided by the client in the information database, and if the verification is passed, send the access token for accessing the service tunnel to the client through the access tunnel, and if the verification is not passed, send the prompt message of user identity information verification failure to the client. The authentication server in the intranet service system is used to obtain the user authentication request message sent by the client through the access tunnel, the user authentication request message including the user identity information corresponding to the client, and the authentication operation is performed on the user identity information, and if the authentication is passed, the access token for accessing the service tunnel is sent to the client through the access tunnel. The authentication server completes the authentication operation on the user identity information, and provides identity authentication for the external network device accessing the intranet service data.

[0157] The service tunnel server is used to obtain the service tunnel request message sent by the client, the service tunnel request message including the device certificate and the access token, and the authentication operation is performed on the device certificate and the access token, and if the authentication pass result of the device certificate and the access token is obtained, the service tunnel parameter for establishing the service tunnel is sent to the client, and the service tunnel between the client and the intranet service data server is established for the client.

[0158] The service tunnel server according to the received service tunnel request message, the service tunnel request message including the device certificate and the access token of the external network trusted device, performs the authentication operation on the device certificate and the access token, and if the authentication pass result of the device certificate and the access token is obtained, the service tunnel parameter for establishing the service tunnel is obtained, and the service tunnel parameter is returned to the client, and the service tunnel between the client and the intranet service data server is established for the client through the service tunnel parameter.

[0159] The service tunnel server is specifically used to: if the authentication pass result of the device certificate and the access token is obtained, the service tunnel parameter for establishing the service tunnel is sent to the client, and the service tunnel parameter is a parameter after encryption processing.

[0160] Specifically, there are many encryption methods for the service tunnel parameter, which are not limited here, and any feasible encryption method for the service tunnel parameter is within the scope of protection of the present application.

[0161] The business tunnel server is configured to perform a verification operation according to the received device certificate and the access token, and to obtain a verification result for the verification operation. If the verification for the device certificate and the access token fails, the business tunnel server sends a prompt message to the client, indicating that the business tunnel parameters cannot be returned, i.e., the business tunnel between the client and the internal business data server cannot be established, and the external device fails to access the internal business data.

[0162] The business tunnel can also be referred to as a formal tunnel (FT), which is the main channel for a user to access internal network business data.

[0163] The business tunnel established by the business tunnel server for the client is a temporary channel, which is invalid after the user passes through the access tunnel.

[0164] The tunnel protocol of the business tunnel is also a user datagram protocol, which does not establish a connection and has a service silent feature. After the business tunnel is established, the business tunnel parameters are returned to the client, and then the internal business data server sends an internal business data access request message to the business tunnel.

[0165] The business tunnel server in the internal business service system is configured to obtain a business tunnel request message sent by a client, the business tunnel request message including a device certificate and an access token of a trusted device, perform a verification operation on the device certificate and the access token, and if the verification is passed, obtain business tunnel parameters and send the business tunnel parameters to the client to establish a business tunnel between the client and an internal business data server. The business tunnel parameters are used to establish a business tunnel between the client and the internal business data server, providing a business tunnel for an external device to access internal business data.

[0166] The internal business data server is configured to obtain an internal business data access request message sent by the client through the business tunnel, and provide internal business data to the client through the business tunnel.

[0167] The internal business data server is configured to obtain an internal business data access request message sent by the client through the business tunnel, and provide internal business data to the client through the business tunnel.

[0168] So far, the first embodiment of the present application provides an intranet service system, comprising an information server, an access tunnel server, an authentication server, a service tunnel server and an intranet service data server located in an intranet; the information server is configured to obtain a device authentication request message sent by a client, send a device certificate to the client, the client is a client running in an extranet device, the device authentication request message is used to request to authenticate the extranet device running the client, and the device certificate is an authentication result certificate for the extranet device running the client; the access tunnel server is configured to obtain an access tunnel request message sent by the client, the access tunnel request message comprises the device certificate, perform a verification operation on the device certificate, if a verification pass result for the device certificate is obtained, send an access tunnel parameter for establishing an access tunnel to the client, and establish the access tunnel between the client and the authentication server for the client; the authentication server is configured to obtain a user authentication request message sent by the client through the access tunnel, the user authentication request message comprises user identity information corresponding to the client, perform a verification operation on the user identity information, if a verification pass result for the user identity information is obtained, send an access token for accessing a service tunnel to the client through the access tunnel; the service tunnel server is configured to obtain a service tunnel request message sent by the client, the service tunnel request message comprises the device certificate and the access token, perform a verification operation on the device certificate and the access token, if a verification pass result for the device certificate and the access token is obtained, send a service tunnel parameter for establishing a service tunnel to the client, and establish the service tunnel between the client and the intranet service data server for the client; and the intranet service data server is configured to obtain an intranet service data access request message sent by the client through the service tunnel, and provide intranet service data to the client through the service tunnel. The first embodiment of the present application establishes multiple layers of tunnel servers, and sets multiple levels for the user accessing the intranet service data and the client of the extranet device, so as to hide the intranet service data and improve the security of the intranet service data.

[0169] Optionally, on the basis of the above intranet service system, the embodiment of the present application further provides a system for providing different permission level intranet service data for users with different permission levels.

[0170] In the intranet service system, specifically, the authentication server is configured to, if the verification result for the user identity information is passed, obtain intranet service data access permission information corresponding to the user identity information, determine a service tunnel level corresponding to the intranet service data access permission information, obtain an access token corresponding to the service tunnel level, and send the access token to the client through the access tunnel.

[0171] The service tunnel server is configured to determine a service tunnel level corresponding to the access token, obtain service tunnel parameters corresponding to the service tunnel level, send the service tunnel parameters to the client, and establish a service tunnel corresponding to the service tunnel level for the client.

[0172] The intranet service data server is configured to provide intranet service data corresponding to the service tunnel level to the client through the service tunnel.

[0173] The authentication server obtains intranet service data access permission information corresponding to the user identity information, determines a corresponding service tunnel level, and then obtains a corresponding access token. The service tunnel server obtains service tunnel parameters corresponding to the service tunnel level, and then establishes a corresponding service tunnel. The intranet service data server provides intranet service data corresponding to the service tunnel level to the client through the service tunnel. In this way, different intranet service data is provided for users with different permission levels, further ensuring the security of intranet service data.

[0174] Optionally, the intranet service data access permission information includes at least one of the following permission information: intranet service full data access permission information indicating that access to all intranet service data is allowed, intranet service multiple data access permission information indicating that access to multiple intranet service data is allowed, and intranet service directional data access permission information indicating that access to directional intranet service data is allowed.

[0175] The service tunnel level corresponding to the intranet service full data access permission information is a full data level service tunnel, the service tunnel level corresponding to the intranet service multiple data access permission information is a multiple data level service tunnel, and the service tunnel level corresponding to the intranet service directional data access permission information is a directional data level service tunnel.

[0176] For example, when a user A accesses intranet service data through the intranet service system, the authentication server determines, according to the user identity of the user A, that the intranet service data access permission information is intranet service full data access permission information allowing access to all intranet service data. Then, the service tunnel server obtains a service tunnel level of a full data level service tunnel, and the intranet service data server obtains intranet service data through the full data level service tunnel, which is intranet service full data.

[0177] Optionally, the service tunnel server is further configured to determine a service tunnel sub-level corresponding to the device certificate after determining the service tunnel level corresponding to the access token, wherein the service tunnel sub-level is a sub-level of the service tunnel level; the obtaining the service tunnel parameter corresponding to the service tunnel level and sending the service tunnel parameter to the client comprises: obtaining a service tunnel parameter corresponding to the service tunnel level and corresponding to the service tunnel sub-level; the establishing the service tunnel corresponding to the service tunnel level for the client comprises: establishing a service tunnel corresponding to the service tunnel level and corresponding to the service tunnel sub-level for the client; and the providing the intranet service data corresponding to the service tunnel level to the client through the service tunnel comprises: providing intranet service data corresponding to the service tunnel level and corresponding to the service tunnel sub-level to the client through the service tunnel.

[0178] For example, employee B is a general staff, employee C is a department manager, and employee D is a general manager. When employee B accesses intranet service data through the intranet service system, the service tunnel server obtains the service tunnel level corresponding to the access token as service tunnel level one, and then establishes a service tunnel according to the service tunnel level one; the intranet service data server provides employee B with intranet service data corresponding to the service tunnel level one according to the service tunnel, and the intranet service data provided for employee B is company internal public service data and internal service data of the department. When employee C accesses intranet service data through the intranet service system, the intranet service data provided for employee C is higher-level company internal public service data and higher-level internal service data of the department. In this way, different users obtain different intranet service data even on the same trusted extranet device, further ensuring the security of intranet service data.

[0179] Optionally, in addition to confirming according to the user identity information, the service tunnel sub-level can also be determined according to the access times and / or access duration of the extranet device running the client to access the intranet service system through the client.

[0180] The extranet device user can increase the trust level of the extranet device and the user according to the access times and / or access duration of the client, and determine the service tunnel sub-level according to the trust level of the extranet device and the user.

[0181] Optionally, the service tunnel server is specifically configured to determine whether the access frequency reaches or exceeds a preset access frequency, and / or determine whether the access duration reaches or exceeds a preset access duration, and if it is determined that the access frequency reaches or exceeds the preset access frequency, and / or if it is determined that the access duration reaches or exceeds the preset access duration, determine that the service tunnel sub-level corresponding to the device certificate is a non-watermark service tunnel sub-level, otherwise, determine that the service tunnel sub-level corresponding to the device certificate is a watermark service sub-level. The non-watermark service tunnel sub-level is used to indicate that no watermark data is added to the intranet service data provided to the client, and the watermark service tunnel sub-level is used to indicate that watermark data is added to the intranet service data provided to the client.

[0182] Watermark, in the embodiments of the present application, is digital watermark, any feasible way of adding watermark data to the image, audio, video or text file generated according to the intranet service data is within the scope of protection of the present application, and the digital watermark can be embedded by one or more of embedded watermark, external watermark, distributed watermark, and watermark based on data fingerprint. The ownership, source or content of the data is tracked and verified through the digital watermark. In the embodiments of the present application, the added digital watermark includes one or more of user identity information, which can maximize the traceability when the intranet service data is leaked.

[0183] Optionally, the use rights of different users for the obtained intranet service data are also different, and the use rights include but are not limited to viewing, uploading, downloading, etc. of the intranet service data.

[0184] So far, on the basis of the intranet service system provided in the first embodiment of the present application, the related content of the user's access right information of the intranet service data is added, different intranet service data is provided for different users, and the safety of the intranet service data is further ensured.

[0185] The second embodiment of the present application provides an intranet service data access method. Please refer to Figure 2 , which is a flowchart of the second embodiment of the present application.

[0186] The following will be described in detail Figure 2 , the intranet service data access method provided in the second embodiment of the present application. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a group of computer executable instructions, and in some cases, the steps shown can be executed in a different logical order from that shown in the flowchart.

[0187] As Figure 2As shown, the second embodiment of the present application provides an intranet service data access method, which comprises the following steps:

[0188] In step S201, a device authentication request message is sent to an information server in an intranet, and a device certificate sent by the information server is obtained, wherein the device authentication request message is used to request authentication of an extranet device running the client, and the device certificate is an authentication result certificate for the extranet device running the client.

[0189] This step is used to send a device authentication request message to an information server in an intranet after a user activates a tunnel client or tunnel SDK installed on an extranet device, and then obtain a device certificate sent by the information server. The device authentication request message is used to request authentication of an extranet device running the client, and the device certificate is an authentication result certificate for the extranet device running the client.

[0190] After the device authentication request message is sent to the information server in the intranet, user identity information of the client sending the device request message is obtained according to the device authentication request message, wherein the user identity information comprises user personal communication information.

[0191] A first dynamic verification code is obtained on a user device corresponding to the user personal communication information.

[0192] The obtained first dynamic verification code is provided to the client to generate a second dynamic verification code.

[0193] The second dynamic verification code is verified according to the first dynamic verification code.

[0194] The verification result of the first dynamic verification code on the second dynamic verification code is obtained.

[0195] If the verification is passed, a device certificate sent by the information service is obtained.

[0196] If the verification is not passed, a prompt message sent by the information server indicating that the extranet device is an illegal device is obtained.

[0197] After receiving the user identity information of the client obtained according to the device authentication request message, the user identity information is verified to obtain a verification result of the user identity. If the verification is passed, it indicates that the extranet device is a legal device, and a device certificate sent by the information server is obtained. If the verification is not passed, a prompt message sent by the information server indicating that the extranet device is an illegal device is obtained, and intranet service data cannot be further obtained.

[0198] The step is used for sending a device authentication request message to an information service end located in an internal network, and then issuing a device certificate for a legal device to provide a device basis for further accessing internal network service data.

[0199] In step S202, an access tunnel request message is sent to an access tunnel service end located in the internal network, the access tunnel request message including the device certificate, access tunnel parameters for establishing an access tunnel sent by the access tunnel service end are obtained, and the access tunnel service end is requested to establish an access tunnel between the client and an authentication service end located in the internal network according to the access tunnel parameters.

[0200] The step is used for sending an access tunnel request message to an access tunnel service end located in the internal network after confirming that the external network device is a trusted device, including a device certificate in the access tunnel request message, obtaining access tunnel parameters for establishing an access tunnel sent by the access tunnel service end, and requesting the access tunnel service end to establish an access tunnel between the client and an authentication service end located in the internal network according to the access tunnel parameters.

[0201] The access tunnel parameters for establishing an access tunnel sent by the access tunnel service end include parameters after encryption processing.

[0202] After the access tunnel request message including the device certificate is sent to the access tunnel service end located in the internal network, the method further includes:

[0203] A prompt message indicating that the access tunnel parameters cannot be returned is obtained from the access tunnel service end.

[0204] If the access tunnel request message is sent to the access tunnel service end located in the internal network, and a prompt message indicating that the access tunnel parameters cannot be returned is obtained from the access tunnel service end, indicating that the authentication performed by the access tunnel service end on the device certificate fails, the internal network service data cannot be further accessed, and the process of accessing the internal network service data is ended.

[0205] In step S203, a user authentication request message is sent to the authentication service end through the access tunnel, the user authentication request message including user identity information corresponding to the client, and an access token for accessing a service tunnel is obtained from the authentication service end through the access tunnel.

[0206] This step is used to establish an access tunnel between the client and the authentication server located in the intranet, and then send a user authentication request message to the authentication server through the access tunnel. The user authentication request message includes the user identity information corresponding to the client, and obtains the access token sent by the authentication server through the access tunnel for accessing the service tunnel.

[0207] After sending a user authentication request message to the authentication server through the access tunnel, wherein the user authentication request message includes the user identity information corresponding to the client, the method further includes:

[0208] The client provides the authentication server with user identity information and login password; the client then verifies the login password obtained from the authentication server's information database against the login password corresponding to the user identity information provided by the client.

[0209] The method further includes: obtaining the verification result of the login password corresponding to the user identity information provided by the client and querying the login password obtained from the information database of the authentication server;

[0210] If the verification is successful, an access token for accessing the service tunnel is obtained from the authentication server through the access tunnel.

[0211] If the verification fails, a message indicating that the user's identity information verification failed will be sent by the authentication server.

[0212] Step S204: Send a service tunnel request message to the service tunnel server located in the intranet. The service tunnel request message includes the device certificate and the access token. Obtain the service tunnel parameters sent by the service tunnel server for establishing the service tunnel. Request the service tunnel server to establish a service tunnel between the client and the intranet service data server located in the intranet according to the service tunnel parameters.

[0213] This step is used by the client to send a service tunnel request message to the service tunnel server located in the intranet after obtaining the access token for accessing the service tunnel. The service tunnel request message includes the device certificate of the legitimate external network device and the access token that allows access to the service tunnel. The client obtains the service tunnel parameters sent by the service tunnel server to establish the service tunnel, and requests the service tunnel server to establish a service tunnel between the client and the intranet service data server located in the intranet according to the service tunnel parameters.

[0214] The step of obtaining the business tunnel parameters sent by the business tunnel server for establishing the business tunnel includes: the business tunnel parameters being encrypted parameters.

[0215] The method further comprises: after sending the service tunnel request message to the service tunnel server located in the intranet, the device certificate and the access token are included, the method further comprises:

[0216] Obtaining the prompt message sent by the service tunnel server for indicating that the service tunnel parameters cannot be returned.

[0217] If the service tunnel request message is sent to the service tunnel server located in the intranet, and the prompt message sent by the service tunnel server for indicating that the service tunnel parameters cannot be returned is obtained at the client, indicating that the verification result performed by the service tunnel server on the device certificate and the access token is failed, the intranet service data cannot be accessed, and the process of accessing the intranet service data is ended.

[0218] Step S205, sending an intranet service data access request message to the intranet service data server through the service tunnel, and obtaining the intranet service data provided by the intranet service data server through the service tunnel.

[0219] After the service tunnel between the client and the intranet service data server located in the intranet is established, the intranet service data access request message is sent to the intranet service data server through the service tunnel, and the intranet service data provided by the intranet service data server through the service tunnel is obtained.

[0220] Since the related content of the second embodiment is similar to that of the first embodiment, only the description angle is different, and the specific details of the second embodiment can be referred to the first embodiment.

[0221] Please refer to Figure 3 The figure is a specific flowchart of the second embodiment of the application.

[0222] Step S301, the client sends a device authentication request message to the information server located in the intranet;

[0223] Step S302, the client obtains the device certificate sent by the information server, and the device certificate is the authentication result certificate of the external network device of the client;

[0224] Step S303, the client sends an access tunnel request message to the access tunnel server located in the intranet, and the access tunnel request message includes the device certificate;

[0225] Step S304, the client obtains the access tunnel parameters sent by the access tunnel server for establishing the access tunnel, and requests the access tunnel server to establish the access tunnel between the client and the authentication server located in the intranet according to the access tunnel parameters;

[0226] Step S305, the client sends a user authentication request message to the authentication server through the access tunnel, wherein the user authentication request message comprises user identity information corresponding to the client;

[0227] Step S306, the client obtains an access token for accessing the service tunnel sent by the authentication server through the access tunnel;

[0228] Step S307, the client sends a service tunnel request message to the service tunnel server located in the intranet, wherein the service tunnel request message comprises the device certificate and the access token;

[0229] Step S308, the client obtains service tunnel parameters for establishing a service tunnel sent by the service tunnel server, and requests the access tunnel server to establish a service tunnel between the client and an intranet service data server located in the intranet according to the service tunnel parameters;

[0230] Step S309, the client sends an intranet service data access request message to the intranet service data server through the service tunnel;

[0231] Step S310, the client obtains intranet service data provided by the intranet service data server through the service tunnel.

[0232] Please refer to Figure 4 , the complete process flow diagram of the second embodiment of the present application. The user of the extranet device first starts 400, installs the client 401, sends a device authentication request message 402, judges whether the device certificate is legal 403, if yes, sends an access tunnel request message 404, judges whether the access tunnel parameter information is obtained 405, if yes, sends a user authentication request message 406, obtains an access token 407, then executes a service tunnel request message 408, judges whether the service tunnel parameter information is obtained 409, if yes, sends an intranet service data access request message 410, finally accesses the intranet service data 411, ends the access 412, and ends the whole process. When the judgment result of whether the device certificate is legal 403 is no, the invalidation 413 process is executed, and the access of the intranet service data is ended. When the judgment result of whether the access tunnel parameter information is obtained 405 is no, or the judgment result of whether the service tunnel parameter information is obtained 409 is no, the no return information 414 is executed, the invalidation 414 process is executed, and the access of the intranet service data is ended.

[0233] So far, the second embodiment of the present application provides an intranet service data access method, which is applied to a client running in an extranet device, and the method comprises the following steps:

[0234] The third embodiment of the present application provides an intranet service data access method. Please refer to Figure 5 , which is a flowchart of the third embodiment of the present application.

[0235] The following will be described in detail Figure 5 , and a brief description will be given to the intranet service data access method provided by the third embodiment of the present application. The related specific contents can be referred to the detailed description in the first embodiment and the second embodiment of the present application. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a group of computer executable instructions, and in some cases, the steps shown can be executed in a different logical order from that shown in the flowchart.

[0236] As shown in Figure 5 , the intranet service data access method provided by the third embodiment of the present application comprises the following steps:

[0237] Step S501, the first service end in the intranet obtains an authentication request message sent by a client through a first service layer tunnel, the client is a client running on an external network device, and the authentication request message is used to request authentication of the external network device running the client or user identity information corresponding to the client.

[0238] Step S501, the first service end in the intranet obtains an authentication request message sent by a client through a first service layer tunnel, the client is a client running on an external network device, and the authentication request message is used to request authentication of the external network device running the client or user identity information corresponding to the client.

[0239] The authentication request message obtained by the first service end in the third embodiment of the present application can be used to request authentication of the external network device of the client or authentication of the user identity information corresponding to the client.

[0240] Step S502, if the first service end obtains an authentication result for the external network device or the user identity information, the first service end sends an access token used to access a second service layer tunnel to the client through the first service layer tunnel.

[0241] Step S502, if the first service end obtains an authentication result for the external network device or the user identity information, the first service end sends an access token used to access a second service layer tunnel to the client through the first service layer tunnel.

[0242] Step S503, the second service end in the intranet obtains an intranet service data access request message sent by the client through the second service layer tunnel, and the client accesses the second service layer tunnel by using the access token.

[0243] Step S503, the second service end in the intranet obtains an intranet service data access request message sent by the client through the second service layer tunnel, and the client accesses the second service layer tunnel by using the access token.

[0244] Step S504, the second service end provides intranet service data to the client through the second service layer tunnel for the intranet service data access request message.

[0245] Step S504, the second service end provides intranet service data to the client through the second service layer tunnel for the intranet service data access request message.

[0246] The fourth embodiment of the present application provides an intranet service data access method, and an execution subject of the intranet service data access method is a client running in an external network device. Figure 6Fig. 4 is a flowchart of a fourth embodiment of the present application.

[0247] The following describes Figure 6 a method for accessing intranet service data according to the fourth embodiment of the present application. For details, refer to the description of the first to third embodiments. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and in some cases, the steps can be executed in a different logical order from that shown in the flowchart.

[0248] As Figure 6 shown in Fig. 4, the method for accessing intranet service data according to the fourth embodiment of the present application includes the following steps.

[0249] In step S601, a first service layer tunnel is used to send an authentication request message to a first service end located in an intranet, and the authentication request message is used to request authentication of an extranet device running on the client or user identity information corresponding to the client.

[0250] In step S602, an access token for accessing a second service layer tunnel is obtained from the first service end via the first service layer tunnel.

[0251] In step S603, the second service layer tunnel is accessed using the access token.

[0252] In step S604, an intranet service data access request message is sent to a second service end located in the intranet via the second service layer tunnel.

[0253] In step S605, intranet service data is obtained from the second service end via the second service layer tunnel.

[0254] The fifth embodiment of the present application provides an apparatus for accessing intranet service data, which corresponds to the method for accessing intranet service data according to the second embodiment of the present application. For details of the implementation scheme of the present embodiment,

[0255] For details of the implementation scheme of the present embodiment,

[0256] For details of the implementation scheme of the present embodiment, Figure 7 Fig. 5 is a block diagram of an apparatus according to the fifth embodiment of the present application.

[0257] The apparatus 700 for accessing intranet service data according to the fifth embodiment of the present application includes a device authentication unit 701, an access tunnel establishment unit 702, a user authentication unit 703, a service tunnel establishment unit 704, and an intranet service data access unit 705.

[0258] The device authentication unit 701 is configured to send a device authentication request message to an information service end located in the intranet, and obtain a device certificate sent by the information service end, wherein the device certificate is an authentication result credential for the external network device of the client.

[0259] The access tunnel establishment unit 702 is configured to send an access tunnel request message to an access tunnel service end located in the intranet, wherein the access tunnel request message comprises the device certificate, obtain access tunnel parameters for establishing an access tunnel sent by the access tunnel service end, and request the access tunnel service end to establish an access tunnel between the client and an authentication service end located in the intranet according to the access tunnel parameters.

[0260] The user authentication unit 703 is configured to send a user authentication request message to the authentication service end through the access tunnel, wherein the user authentication request message comprises user identity information corresponding to the client, and obtain an access token for accessing the service tunnel sent by the authentication service end through the access tunnel.

[0261] The service tunnel establishment unit 704 is configured to send a service tunnel request message to a service tunnel service end located in the intranet, wherein the service tunnel request message comprises the device certificate and the access token, obtain service tunnel parameters for establishing a service tunnel sent by the service tunnel service end, and request the access tunnel service end to establish a service tunnel between the client and an intranet service data service end located in the intranet according to the service tunnel parameters.

[0262] The access intranet service data unit 705 is configured to send an intranet service data access request message to the intranet service data service end through the service tunnel, and obtain intranet service data provided by the intranet service data service end through the service tunnel.

[0263] The sixth embodiment of the present application provides an intranet service data access device 800, which corresponds to the intranet service data access method provided by the third embodiment of the present application, and is briefly introduced here. For the unknown part of the implementation scheme of the present embodiment, please refer to the third embodiment.

[0264] Please refer to Figure 8 , which is a device block diagram provided by the sixth embodiment of the present application.

[0265] The device for accessing intranet service data provided by the sixth embodiment of the present application comprises an authentication unit 801, a sending access token device unit 802, an accessing second service layer tunnel unit 803, and an accessing intranet service data unit 804.

[0266] The authentication unit 801 is configured to obtain, by a first server located in an intranet, an authentication request message sent by a client through a first service layer tunnel, the client is a client running on an extranet device, and the authentication request message is used to request authentication of the extranet device running the client or user identity information corresponding to the client;

[0267] The access token sending unit 802 is configured to send, by the first server, an access token for accessing a second service layer tunnel to the client through the first service layer tunnel if an authentication result for the extranet device or the user identity information is obtained;

[0268] The second service layer tunnel accessing unit 803 is configured to obtain, by a second server located in the intranet, an intranet service data access request message sent by the client through the second service layer tunnel, the client accesses the second service layer tunnel by using the access token;

[0269] The intranet service data accessing unit 804 is configured to provide, by the second server, intranet service data to the client through the second service layer tunnel for the intranet service data access request message.

[0270] The seventh embodiment of the present application provides an intranet service data access device 900, which corresponds to the intranet service data access method provided in the fourth embodiment of the present application, and is briefly introduced here. For the unknown part of the implementation scheme of the present embodiment, the fourth embodiment can be referred to.

[0271] Please refer to Figure 9 , which is a device block diagram provided in the seventh embodiment of the present application.

[0272] The device for intranet service data access provided in the seventh embodiment of the present application comprises an authentication unit 901, an access token obtaining unit 902, a second service layer tunnel accessing unit 903, an intranet service data access request unit 904, and an intranet service data unit 905.

[0273] The authentication unit 901 is configured to send an authentication request message to a first server located in an intranet through a first service layer tunnel, the authentication request message is used to request authentication of an extranet device running the client or user identity information corresponding to the client;

[0274] The access token obtaining unit 902 is configured to obtain, through the first service layer tunnel, an access token for accessing a second service layer tunnel sent by the first server;

[0275] The second service layer tunnel accessing unit 903 is configured to access the second service layer tunnel by using the access token;

[0276] The internal network service data access request unit 904 is configured to send an internal network service data access request message to the second service end located in the internal network through the second service layer tunnel.

[0277] The internal network service data unit 905 is configured to obtain internal network service data provided by the second service end through the second service layer tunnel.

[0278] The eighth embodiment of the present application provides an electronic device, please refer to Figure 10 , which is a schematic diagram of the electronic device provided by the eighth embodiment of the present application.

[0279] The electronic device comprises:

[0280] The processor 1001;

[0281] The memory 1002 is configured to store a program of an internal network service data access method, and the program is executed by the processor to execute the method described in the second embodiment or the third embodiment or the fourth embodiment of the present application.

[0282] The ninth embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to execute the method described in the second embodiment or the third embodiment or the fourth embodiment of the present application.

[0283] It should be noted that the embodiments of the present application can involve the use of user data. In actual application, user-specific personal data can be used in the schemes described herein within the scope allowed by applicable laws and regulations, for example, with the explicit consent of the user, the user is actually notified, etc.

[0284] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws and regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0285] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0286] In a typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memories.

[0287] Memory can include, without being limited to, non-persistent memory, random access memory (RAM), and / or non-volatile memory, such as read only memory (ROM), or flash memory. Memory is an example of computer readable media.

[0288] 1. Computer readable media includes both permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, without being limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that is accessible to a computing device. According to the definition provided herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0289] 2. Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, without being limited to, disk storage, CD-ROMs, optical storage and so forth) embodying computer readable program code.

[0290] Although the present application has been disclosed in the context of preferred embodiments with additional features, it will be understood by those skilled in the art that certain adaptations and modifications of these preferred embodiments described herein can be made, without departing from the spirit and scope of the present application, it is intended, therefore, to cover all adaptations and modifications as fall within the scope of the claims.

Claims

1. An intranet business service system, characterized by comprising: The information server, the access tunnel server, the authentication server, the service tunnel server and the intranet service data server are located in an intranet; The information server is configured to obtain a device authentication request message sent by a client, send a device certificate to the client, and perform a verification operation on the device certificate, wherein the client is a client running on an extranet device, the device authentication request message is used to request authentication of the extranet device running the client, the device certificate is an authentication result certificate for the extranet device running the client, and if a verification pass result for the device certificate is obtained, an access tunnel parameter used to establish an access tunnel is sent to the client, and the access tunnel between the client and the authentication server is established for the client. The authentication server is configured to obtain a user authentication request message sent by the client through the access tunnel, perform a verification operation on the user identity information, and if a verification pass result for the user identity information is obtained, an access token used to access a service tunnel is sent to the client through the access tunnel. The service tunnel server is configured to obtain a service tunnel request message sent by the client, perform a verification operation on the device certificate and the access token, and if a verification pass result for the device certificate and the access token is obtained, a service tunnel parameter used to establish a service tunnel is sent to the client, and the service tunnel between the client and the intranet service data server is established for the client. The intranet service data server is configured to obtain an intranet service data access request message sent by the client through the service tunnel, and provide intranet service data to the client through the service tunnel. The information server is specifically configured to obtain a device authentication request message sent by a client, obtain user identity information of the client sending the device authentication request message according to the device authentication request message, and send a first dynamic verification code to a user device corresponding to the user identity information.

2. The system of claim 1, wherein, The method applied to a client running on an extranet device comprises the following steps. sending a device authentication request message to an information server located in an intranet, obtaining a device certificate sent by the information server, and the device certificate being an authentication result certificate for the extranet device of the client. ​ ​ 3. An intranet service data access method characterized by, ​ ​ sending an access tunnel request message to an access tunnel server located in the intranet, the access tunnel request message including the device certificate, obtaining access tunnel parameters for establishing an access tunnel sent by the access tunnel server, and requesting the access tunnel server to establish an access tunnel between the client and an authentication server located in the intranet according to the access tunnel parameters; sending a user authentication request message to the authentication server through the access tunnel, the user authentication request message including user identity information corresponding to the client, and obtaining an access token for accessing a service tunnel sent by the authentication server through the access tunnel; sending a service tunnel request message to a service tunnel server located in the intranet, the service tunnel request message including the device certificate and the access token, obtaining service tunnel parameters for establishing a service tunnel sent by the service tunnel server, and requesting the access tunnel server to establish a service tunnel between the client and an intranet service data server located in the intranet according to the service tunnel parameters; sending an intranet service data access request message to the intranet service data server through the service tunnel, and obtaining intranet service data provided by the intranet service data server through the service tunnel.

4. The method of claim 3, wherein, The access tunnel parameters for establishing an access tunnel sent by the access tunnel server include parameters that have been subjected to encryption processing.

5. The method of claim 3, wherein, After the access tunnel request message including the device certificate is sent to the access tunnel server located in the intranet, the method further includes: obtaining a prompt message sent by the access tunnel server indicating that the access tunnel parameters cannot be returned.

6. The method of claim 3, wherein, The access tunnel between the client and the authentication server is a temporary channel that is invalidated after the user passes through the access tunnel.

7. An intranet service data access apparatus characterized by comprising: The application is applied to a client running in an extranet device, and the device includes: a device authentication unit configured to send a device authentication request message to an information server located in an intranet, and obtain a device certificate sent by the information server, the device certificate being an authentication result credential for the extranet device of the client; an access tunnel establishment unit configured to send an access tunnel request message to an access tunnel server located in the intranet, the access tunnel request message including the device certificate, obtain access tunnel parameters for establishing an access tunnel sent by the access tunnel server, and request the access tunnel server to establish an access tunnel between the client and an authentication server located in the intranet according to the access tunnel parameters; a user authentication unit configured to send a user authentication request message to the authentication server through the access tunnel, the user authentication request message including user identity information corresponding to the client, and obtain an access token for accessing a service tunnel sent by the authentication server through the access tunnel; The service tunnel establishment unit is configured to send a service tunnel request message to a service tunnel server located in the intranet, the service tunnel request message comprising the device certificate and the access token, obtain service tunnel parameters for establishing a service tunnel sent by the service tunnel server, and request the access tunnel server to establish a service tunnel between the client and an intranet service data server located in the intranet according to the service tunnel parameters; The intranet service data access unit is configured to send an intranet service data access request message to the intranet service data server through the service tunnel, and obtain intranet service data provided by the intranet service data server through the service tunnel.

8. An electronic device, comprising: Comprise: A processor, a memory, and computer program instructions stored on the memory and executable on the processor; The processor executes the computer program instructions to implement the intranet service data access method of any one of claims 3-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the intranet service data access method of any one of claims 3-6.

Images