Data processing method and device, computer device, storage medium and program product

Abstract

The application provides a data processing method and device, computer equipment and a storage medium, relates to the technical fields of cloud technology, cloud security, intelligent transportation and the like. By determining the communication link information corresponding to the access request, when the network resource belongs to a diversion resource, the access request is diverted to a target gateway based on the target address and the preconfigured diversion port to access a target server, and the access request can be forwarded to the target server through the target gateway, so that the access to the resource requiring diversion is automatically diverted to the corresponding gateway for access. By recording the association between the source address and the process information, when the corresponding response data is received, the response page corresponding to the access request is displayed based on the association, so that the entire access process initiated by the access request is accurately executed without modifying the routing table, effectively solving the poor practicability problem of related technologies and improving the accuracy and practicability of the access process of the special-purpose network.

Description

Technical Field

[0001] This application relates to the technical fields of communication, cloud technology, and intelligent transportation. This application relates to a data processing method, apparatus, computer equipment, storage medium, and program product. Background Technology

[0002] In this field, VPNs (Virtual Private Networks) are typically used to access private networks where access needs to be restricted. For example, a private network can be established over a public network for encrypted communication to enable access to internal network resources within an enterprise.

[0003] In related technologies, access to private networks is typically achieved using system routing tables. For example, using a TUN / TAP virtual network interface card (NIC), the priority of the default route in the routing table is adjusted to set the route pointing to the virtual NIC as the default route with the highest priority. However, using system routing tables for traffic redirection can easily lead to conflicts with third-party VPN software that compete for routing tables. Some VPN software even has routing table protection features, causing access failures. Therefore, in many scenarios, using system routing tables cannot achieve access to private networks, resulting in low practicality of this access method. Summary of the Invention

[0004] This application provides a data processing method, apparatus, computer equipment, storage medium, and program product, which can solve the problem of low practicality in related technologies. The technical solution is as follows:

[0005] On the one hand, a data processing method is provided, the method comprising:

[0006] In response to receiving an access request for network resources, the communication link information corresponding to the access request is determined, the communication link information including the source address and the destination address;

[0007] In response to determining that the network resource belongs to the redirection resource based on the pre-configured target redirection strategy, the access request is redirected to the target gateway to access the target server based on the target address and the pre-configured redirection port, and the association between the source address and process information is recorded;

[0008] The target gateway is used to forward the access request to the target server and forward the response data of the target server to the source address, and the process information is used to indicate the process that initiated the access request.

[0009] Receive the response data returned by the target server through the target gateway, and display the response page corresponding to the access request based on the response data and the correlation between the source address and process information.

[0010] On the other hand, a data processing apparatus is provided, the apparatus comprising:

[0011] A communication link determination module is used to determine the communication link information corresponding to the access request in response to receiving an access request for network resources. The communication link information includes a source address and a destination address.

[0012] The traffic redirection module is used to respond to the determination that the network resource belongs to the traffic redirection resource based on the pre-configured target traffic redirection strategy, and based on the target address and the pre-configured traffic redirection port, redirect the access request to the target gateway to access the target server, and record the association between the source address and process information;

[0013] The target gateway is used to forward the access request to the target server and forward the response data of the target server to the source address, and the process information is used to indicate the process that initiated the access request.

[0014] A receiving module is used to receive response data returned by the target server via the target gateway;

[0015] The display module is used to display the response page corresponding to the access request based on the response data and the correlation between the source address and process information.

[0016] In one possible implementation, the referral port indicates an address used to carry the intercepted access request;

[0017] The referral module is configured to, in response to determining that the network resource belongs to the referral resource based on the target referral strategy, modify the target address of the access request to the referral port at the network layer, and call the callback processing function corresponding to the protocol type of the access request, so as to send the access request intercepted to the referral port to the target server through the target gateway after authentication.

[0018] The callback function is used to authenticate the access request and send the access request to the target server based on the transmission method of the corresponding protocol type.

[0019] In one possible implementation, the device further includes:

[0020] The input module is used to pass the function entry address corresponding to at least one protocol type to a pre-configured kernel component through a pre-configured proxy process;

[0021] The diversion module is used for:

[0022] The kernel component modifies the target address to the proxy process's redirection port at the network layer.

[0023] Through the kernel component, based on the function entry address passed by the proxy process, the callback processing function corresponding to the protocol type is called to execute the authentication of the access request intercepted to the redirection port and send it to the target server through the target gateway;

[0024] Wherein, the target gateway is the gateway corresponding to the target address in the association relationship between gateway service addresses and gateways.

[0025] In one possible implementation, the device further includes:

[0026] Data detection of the referral port is enabled through a pre-configured proxy process;

[0027] The referral module is used to respond to the detection of the access request intercepted by the referral port, and through the proxy process, store the association relationship between the source address, source port and process information, with the source address and source port of the access request as keys and the process information as values. The communication link information also includes the source port.

[0028] In one possible implementation, the communication link information further includes a source port, and the association includes a correspondence with the source address and source port as keys and the process information as values;

[0029] The display module is configured to: determine the receiving address and receiving port for receiving the response data; determine the process information corresponding to the receiving address and receiving port from a correspondence where the source address and source port are keys and the process information is the value; based on the process information corresponding to the receiving address and receiving port, send the response data back to the application that initiated the access request, and display the response page in the application based on the response data.

[0030] In one possible implementation, the device further includes any of the following:

[0031] The short connection release module is used to release the source port in the process that initiates the access request and delete the correspondence between the source address and source port as keys and the process information as values. The communication connection between the target server and the requesting device is a short connection.

[0032] The long connection release module is used to maintain the source port in the process until the communication connection between the target server and the terminal device reaches the long connection termination condition, release the source port in the process, and delete the correspondence with the source address and source port as keys and the process information as values. The communication connection between the target server and the requesting device is a long connection.

[0033] In one possible implementation, the apparatus further includes an acquisition module, which, when acquiring the target referral strategy, is configured to, in response to the current object logging into the referral management application, acquire the target referral strategy corresponding to the current object from the management server of the referral management application based on the object login information of the current object; and store the target referral strategy in the memory space corresponding to the pre-configured kernel component.

[0034] In one possible implementation, the target referral strategy includes at least one of the following: pre-configured referral resource domain name and port, referral resource network address and port, referral resource protocol type, referral resource process characteristic information, non-referral resource domain name and port, non-referral resource network address and port, non-referral resource protocol type, or non-referral resource process characteristic information.

[0035] In one possible implementation, the non-traffic-driving resource domain name and port include the domain name and port bound to the management server;

[0036] The referral resource domain names and ports include the domain names and ports bound to resource servers in the private network of the target network, while the non-referral resource domain names and ports include the domain names and ports bound to resource servers in the public network of the target network.

[0037] In one possible implementation, the referral module is further used for at least one of the following:

[0038] If the domain name and port of the access request belong to the domain name and port of the referral resource, it is determined that the network resource belongs to the referral resource.

[0039] In response to the fact that the target address and target port of the access request belong to the network address and port of the referral resource, it is determined that the network resource belongs to the referral resource.

[0040] If the protocol type of the access request is a referral resource protocol type, then the network resource is determined to be a referral resource.

[0041] If the process information of the access request matches the process characteristic information of the referral resource, it is determined that the network resource belongs to the referral resource.

[0042] In one possible implementation, the device further includes:

[0043] The redirection module is used to redirect the domain name of the access request to a virtual network address in response to the fact that the domain name and port of the access request belong to the domain name and port of the traffic redirection resource. The virtual network address is not the real network address corresponding to the domain name of the access request.

[0044] In one possible implementation, the apparatus further includes a non-traffic resource sending module, the non-traffic resource sending module being configured to:

[0045] If the domain name and port of the access request are non-traffic-driving resource domain names and ports, the access request is sent based on the communication link information;

[0046] In response to the process information matching the characteristics of a non-traffic-driving resource process, the access request is sent based on the communication link information;

[0047] When the communication quintuple of the access request does not match any of the following: the network address and port of the referral resource, the protocol type of the referral resource, or the process characteristics of the referral resource, the access request is sent based on the communication link information.

[0048] On the other hand, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the above-described data processing method.

[0049] On the other hand, a computer-readable storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described data processing method.

[0050] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described data processing method.

[0051] The beneficial effects of the technical solutions provided in this application are:

[0052] The data processing method provided in this application determines the communication link information corresponding to the access request. When the network resource is a redirection resource, based on the target address and the pre-configured redirection port, the access request is redirected to the target gateway to access the target server. The target gateway can then forward the access request to the target server, thereby automatically redirecting access to the resource requiring redirection to the corresponding gateway. By recording the association between the source address and the process information of the process that initiated the access request, the response page corresponding to the access request can be displayed based on the association between the source address and the process information when the response data returned by the target server is received. This ensures that the entire access process initiated by the access request is executed accurately, without the need to install a virtual network card or modify the system routing table. This effectively solves the problem of poor practicality in related technologies and improves the accuracy and practicality of accessing private networks. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0054] Figure 1 A schematic diagram illustrating the implementation environment of a data processing method provided in this application embodiment;

[0055] Figure 2 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0056] Figure 3 A schematic diagram of a strategy configuration page provided in an embodiment of this application;

[0057] Figure 4 A schematic diagram of a strategy configuration page provided in an embodiment of this application;

[0058] Figure 5 A schematic diagram of a traffic management application provided in an embodiment of this application;

[0059] Figure 6 A schematic diagram of a strategy configuration page provided in an embodiment of this application;

[0060] Figure 7 A simplified architecture diagram of dedicated network access provided in this application embodiment.

[0061] Figure 8 A schematic diagram of a dedicated network access architecture provided for an embodiment of this application;

[0062] Figure 9 A signaling interaction diagram of a data processing method provided in an embodiment of this application;

[0063] Figure 10 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0064] Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0065] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0066] Those skilled in the art will understand that, unless otherwise stated, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. The terms “comprising” and “including” as used in the embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, or operation, but do not exclude implementation as other features, information, data, steps, or operations supported by this art.

[0067] It is understood that in the specific implementation of this application, any data related to the object or the object's device, such as object login information, communication link information, source address, target address, target port, source port, device information, operating system, and process information, is involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the object is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0068] Figure 1 This is a schematic diagram of the implementation environment of a data processing method provided in an embodiment of this application, such as... Figure 1 As shown, the implementation environment includes: a requesting device 11, a management server 12, a target gateway 13, and a target server 14. The requesting device 11 runs a traffic redirection management application, and the management server 12 is the backend server for this application. The traffic redirection management application provides the function of intercepting resources requiring redirection and redirecting traffic to a designated gateway for access. The target server 14 is used to provide the network resources accessed by the requesting device 11, and the target gateway 13 is used to forward the access requests from the requesting device 11 to the target server 14.

[0069] The management server 12 is configured with a target traffic redirection policy, which indicates the network resources that need to be redirected. The requesting device 11 can obtain the target traffic redirection policy based on the traffic redirection management application. The requesting device 11 initiates an access request to access the network resource and determines whether the network resource is a traffic redirection resource based on the target traffic redirection policy. If the network resource is a traffic redirection resource, the access request is redirected to the target gateway 13 to access the target server 14 based on the traffic redirection management application. For example, the network resource to be redirected may be a business resource with restricted access in the enterprise intranet. The enterprise administrator can configure the business resource as a traffic redirection resource in the target traffic redirection policy of the management server 12. When the requesting device 11 initiates an access request to the business resource, the requesting device 11 determines that the resource accessed by the access request is a traffic redirection resource based on the target traffic redirection policy. Then, the requesting device 11 can redirect the access request to the target gateway 13 based on the traffic redirection management application to access the target server 14 where the business resource is located.

[0070] In one possible scenario, if the network resource is a referral resource, the management server 12 can authenticate the access request. If the authentication is successful, the requesting device 11 can then access the target server 14 via the target gateway 13. For example, the referral management application could be a business access client. The current object logs into the business access client on the requesting device 11. Based on the object login information, the requesting device 11 retrieves the target referral policy corresponding to the current object from the management server 12. When the requesting device 11 receives an access request from any application, it can determine whether the network resource to be accessed is a referral resource based on the target referral policy. When the target referral policy determines that the network resource to be accessed is a referral resource, the requesting device 11 intercepts the access request based on the target address and referral port. The requesting device 11 can also send an authentication request to the management server 12 based on the object login information and the network resource to be accessed by the current object. After successful authentication, the intercepted access request to the referral port is sent to the target server 14 via the target gateway 13.

[0071] In one possible scenario, access requests can be redirected to the target gateway 13 to access the target server 14 via a pre-configured process or component. For example, the requesting device 11 may be pre-configured with a control process. When the current object logs into the redirection management application on the requesting device 11, it can obtain the target redirection policy from the management server 12 through the control process and launch a proxy process. The proxy process loads the kernel component and calls its initialization logic to complete the initialization of the kernel component. The proxy process stores the target redirection policy in the corresponding memory storage space of the kernel component. This kernel component is the execution logic configured in the operating system of the requesting device 11. The target redirection policy stored in the kernel component can be used to determine the network resource to be accessed by any access request received by the requesting device 11. When the network resource belongs to the redirection resource, the kernel component modifies the target address of the access request to the redirection port, thereby intercepting the request data of the access request to that redirection port. The proxy process executes the callback function corresponding to the protocol type of the access request, so that the access request intercepted to the redirection port is authenticated and sent to the target server proxy process through the target gateway.

[0072] For example, the requesting device 11 can be a server or a terminal. The server mentioned above can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server or server cluster providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The network mentioned above can include, but is not limited to, wired networks and wireless networks. The wired network includes local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs). The wireless network includes Bluetooth, Wi-Fi, and other networks that enable wireless communication. The terminal can be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a laptop computer, a digital radio receiver, a MID (Mobile Internet Device), a PDA (Personal Digital Assistant), a desktop computer, an in-vehicle terminal (such as an in-vehicle navigation terminal, an in-vehicle computer, etc.), a smart speaker, a smartwatch, etc. The terminal and the server can be directly or indirectly connected through wired or wireless communication methods, but are not limited to these. The specific requirements can be determined based on the actual application scenario, and are not limited here.

[0073] Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The executing entity of this method can be a requesting device. Figure 2 As shown, the method includes the following steps.

[0074] Step 201: Request the device to obtain the target traffic redirection strategy.

[0075] This target redirection policy specifies the resources that need to be redirected; in other words, it defines which resources should be redirected. The requesting device can obtain this target redirection policy from the management server to determine whether to redirect the requested resources based on the policy. Redirecting resources refer to network resources configured with restricted access. For access requests to redirecting resources, the requesting device will intercept and redirect the request to the designated gateway. It can also perform verification and authentication operations on the access request, the requesting object, the application, and the device. Only after successful verification and authentication will the request be redirected to the designated gateway. Non-redirecting resources are unrestricted network resources, such as public network resources. Requests to access non-redirecting resources can be directly passed through without interception or redirection.

[0076] In one possible implementation, the resources to be redirected can be defined from the perspectives of domain name, port, network address, protocol type of the communication protocol used, process information, etc. For example, the target redirection strategy includes at least one of the following: pre-configured redirection resource domain name and port, redirection resource network address and port, redirection resource protocol type, and redirection resource process characteristic information.

[0077] The referral resource domain name and port can be the domain name and port of the network resource to be redirected. For example, an enterprise administrator can configure the enterprise's internal domain name and access port as the referral resource domain name and port in the management server. The referral resource domain name can be a wildcard domain or a precise domain name; a wildcard domain name refers to domain information containing the wildcard character *, representing all subdomains that meet a certain characteristic. For example, if an enterprise's network domain name is "www.ABCD.com", the wildcard domain name can be "*ABCD.com", then "www.ABCD.com", "mail.ABCD.com", etc., all fall within the domain name covered by the wildcard domain name "*ABCD.com". The referral resource port can be one or more specified ports. For example, the referral resource port can be a port list or all ports. Of course, if it is all ports, then the port filtering under the referral resource domain name is ignored.

[0078] The network address and port of the redirected resource can be the network address and port of the network resource to be redirected. The network address can be an IP (Internet Protocol) address. For example, an enterprise administrator can configure the enterprise's business IP and access port in the management server. All access requests initiated by the requesting device to these business IPs and access ports need to be intercepted and redirected.

[0079] The redirection resource protocol type can be a redirection-required protocol type. When a requesting device uses an access request with a redirection-required protocol type to access network resources, the access request needs to be intercepted and redirected. For example, the redirection resource protocol type can include at least one of TCP or UDP. For instance, when accessing a specified network resource using a specific TCP protocol, redirection is required, while accessing network resources using the UDP protocol does not require redirection, thereby achieving traffic interception and allowing for specific protocols.

[0080] The process characteristic information for redirecting traffic can be the process that needs to be redirected. When a requesting device initiates an access request to network resources through a process with this process characteristic information, the access needs to be intercepted and redirected. Process information may include one or more of the following: process ID (PID), process name, process path, hash value of the process executable file (e.g., MD5), version information, whether it has specified signature information, and other attribute information of the process executable file. This process characteristic information may include redirection conditions, such as no specified signature or the process path being a pre-configured path that needs to be redirected.

[0081] In one possible implementation, the target redirection policy can also indicate non-redirection resources that do not require redirection; that is, the target redirection policy can also define which resources will not be redirected. For example, the target redirection policy may further include at least one of the following: pre-configured non-redirection resource domain names and ports, non-redirection resource network addresses and ports, non-redirection resource protocol types, or non-redirection resource process characteristic information. For example, an enterprise administrator can configure blocked resource domain names and ports on the management server. For instance, to avoid affecting access to designated business systems, the enterprise administrator can configure the domain name of the designated business system as a non-redirection resource domain name. For example, the non-redirection resource network address refers to the network address of a network resource that does not require redirection. For example, the enterprise administrator can also specify a subset of IP addresses in the enterprise network address as a list or range of IPs to be blocked and redirected. When the target address of an access request from a requesting device matches the specified IP list or IP range, the access request is allowed without blocking or redirection.

[0082] In one possible example, the requesting device can access the management server without being intercepted or redirected. That is, the access request initiated by the requesting device to the management server does not need to be intercepted or redirected. For example, the non-redirecting resource domain name and port include the domain name and port bound to the management server. For instance, the requesting device might send a policy update request to the management server to update the redirection policy, or a login request to the redirection management application. For example, the non-redirecting resource network address and port can include the network address and port bound to the management server. For example, the server cluster address, load balancer address, and access gateway address deployed in the background of the redirection management application can be designated as resources prohibited from redirection, allowing the requesting device to directly connect and access them.

[0083] In another possible example, the requesting device can also configure some network resources in the target network as resources requiring redirection and others as resources not requiring redirection. For example, the domain names and ports of the redirecting resources include the domain names and ports bound to resource servers in the private network of the target network, and the domain names and ports of the non-redirecting resources include the domain names and ports bound to resource servers in the public network of the target network. For example, the target network can be a corporate intranet; for instance, a portion of the IP addresses within the corporate intranet can be used for direct access to sites that do not require redirection, while another portion can be used for restricted access sites requiring redirection.

[0084] In one possible implementation, the management server can configure a referral strategy for each object at the object-to-object level. The requesting device can then obtain the target referral strategy based on the information of the current object. For example, the process of the requesting device obtaining the target referral strategy may include: in response to the current object logging into the referral management application, the requesting device obtains the target referral strategy corresponding to the current object from the management server of the referral management application based on the object login information of the current object; the requesting device stores the target referral strategy in the memory space corresponding to the pre-configured kernel component. For example, the requesting device may also periodically update the referral strategy stored in the memory of the kernel component. This update process may include: according to a target update cycle, the requesting device periodically executes the process of obtaining the target referral strategy from the management server based on the object login information of the current object, and updating the referral strategy already stored in the memory space of the kernel component based on the target referral strategy. For example, the object login information may include, but is not limited to: the current object's login account, login address, login device information, login time, etc., and the login device information may include device name, model, operating system type, etc.

[0085] For example, when the current object logs into the traffic management application, the requesting device can use a control process to retrieve the target traffic redirection policy corresponding to the current object from the management server; and then use the control process to launch an agent process; through the agent process, it calls the kernel component initialization logic to insert a pre-configured kernel component into the requesting device's operating system. Specifically, the requesting device, through the control process, performs format checks and parsing on the target traffic redirection policy retrieved from the management server, and pushes the target traffic redirection policy to the application-layer agent process via IPC (Inter-Process Communication) or the agent process's interface. The agent process then calls the SDK (Software Development Kit) interface provided by the kernel component to store the target traffic redirection policy in the memory space corresponding to the kernel component. Alternatively, the update process of the traffic redirection policy can be completed collaboratively by the control process, agent process, and kernel component. For example, if the traffic redirection policy already stored in the memory corresponding to the kernel component is different from the latest target traffic redirection policy retrieved through the control process, the requesting device updates the traffic redirection policy in the memory corresponding to the kernel component to the latest target traffic redirection policy. Through the above collaborative process, when the server-side policy changes, both the kernel components and the agent process can quickly complete the policy storage, policy update synchronization, and updates of memory-related data structures within a short period of time.

[0086] It should be noted that the requesting device can subsequently use the proxy process, kernel components, and control process to intercept, authenticate, and redirect the access request to the target gateway to access the target server.

[0087] like Figure 3 As shown, Figure 3 This allows enterprise administrators to configure the resources that need to be redirected for individual objects within the management server, on an object-by-object basis. For example, for object 1, the business system configuration can be set to redirect all URLs (Uniform Resource Locator) within the business system. This means object 1 has access permissions to all resources in the business system, and any URL request initiated by object 1 to any resource must be intercepted and redirected. Furthermore, permissions can be configured for the applications initiating access by object 1. Applications with access permissions can be configured as trusted applications. Trusted applications are those authorized by the management server and whose requesting devices are allowed to access the internal business system. Figure 3As shown, the trusted application configuration supports different configurations for trusted applications across different systems, such as Windows and macOS; any application from a Windows device belonging to Object 1 is considered a trusted application. Alternatively, applications can be grouped, with each group containing one or more trusted applications, allowing configuration of corresponding groups for each object. For example... Figure 4 As shown, there can be multiple objects under a single network account. The management server can also configure business systems and trusted applications for different objects.

[0088] like Figure 5 As shown, Figure 5 This provides a sample page layout for a traffic management application. (Example:) Figure 5 As shown, the traffic management application provides zero-trust office services, and also offers other services such as virus scanning, compliance testing, vulnerability patching, and computer tools. For this zero-trust office service, when the current user logs into the traffic management application, the requesting device can connect to the company's intranet based on the user's login information, allowing the user to access the company's internal network resources using the dedicated network access method provided in this application. The zero-trust office service page can also display functions provided by the traffic management application, such as real-time office security protection, trusted software configuration, compliance policy configuration, and account login. Figure 5 As shown, if no compliance policy is currently configured, a label indicating that the compliance policy is not configured will be displayed. For example, the current page may display a "Trusted Software Configured" page, which shows that the configured trusted software can include any application. Alternatively, it can display blocked software. This allows the user to clearly understand their access to company content, facilitating their use of specified trusted applications to access the company's business systems configured by the administrator.

[0089] Step 202: The requesting device responds to the received access request for network resources and determines the communication link information corresponding to the access request.

[0090] The communication link information includes a source address and a destination address. The source address refers to the device initiating the access request, i.e., the address of the requesting device. The destination address refers to the network address of the network resource to be accessed in the access request. In one possible implementation, the communication link information can be a communication 5-tuple for the access request, which may include: source address, source port, destination address, destination port, and protocol type.

[0091] In one possible example, the requesting device can obtain communication link information through a pre-configured kernel component. This kernel component may include execution logic for obtaining the communication link of an access request upon receipt. This kernel component, inserted as execution logic within the operating system by the requesting device, allows the requesting device to execute step 202.

[0092] In one possible implementation, the requesting device can also obtain information such as the domain name and port, process information, and initiating application of the access request through the kernel component. For example, the requesting device can also obtain the domain name and port of the access request through the kernel component; this domain name and port refer to the domain name and port of the network resource to be accessed. In one example, the requesting device can also obtain the process information of the access request through the kernel component; this process information refers to the information of the process that initiated the access request, and may include, but is not limited to, one or more of the following: process name, process path, hash value (e.g., MD5) of the process executable file, version information, whether it has specified signature information, and other attribute information of the process executable file. In one example, the requesting device can also obtain the application that initiated the access request through the kernel component; this application refers to the program that triggered the access request in the current object; for example, if the current object triggers a browsing request for a restricted file in an enterprise application, then the enterprise application is the application that initiated the access request. The requesting device can then execute the following steps 203-204 through a traffic management application to intercept and redirect the browsing request.

[0093] Step 203: The requesting device responds by determining that the network resource belongs to the redirection resource based on the pre-configured target redirection policy. Based on the target address and the pre-configured redirection port, the access request is redirected to the target gateway to access the target server, and the association between the source address and process information is recorded.

[0094] Specifically, the target gateway forwards the access request to the target server and forwards the target server's response data to the source address. The process information indicates the process that initiated the access request. The referral port indicates the address of the intercepted access request.

[0095] In this step, the requesting device can determine whether the network resource to be accessed is a redirection resource based on the target redirection policy. If the network resource is a redirection resource, the requesting device modifies the target address of the access request to the redirection port to intercept the access request; after the requesting device authenticates the access request, it sends the access request to the target server through the target gateway. In one possible implementation, step 203 may include the following steps 2031-2032.

[0096] Step 2031: Request the device to determine whether the network resource belongs to the traffic redirection resource based on the target traffic redirection strategy.

[0097] The requesting device can determine whether the network resource belongs to the referral resource based on at least one of the domain name, target address, protocol type, and process information of the access request.

[0098] For example, the requesting device can use a domain name for determination. Step 2031 may include: the requesting device responding to the fact that the domain name and port of the access request belong to the redirecting resource domain name and port, and determining that the network resource belongs to the redirecting resource. For example, the requesting device can compare the domain name and port of the access request with the redirecting resource domain name and port in the corresponding memory space of the kernel component through a kernel component. If the domain name and port of the access request belong to the redirecting resource domain name and port, the network resource is determined to be a redirecting resource. Alternatively, the requesting device can compare only the domain name of the access request with the redirecting resource domain name. If the domain name of the access request belongs to the redirecting resource domain name, the network resource can also be determined to be a redirecting resource. For example, taking the access request as a DNS (Domain Name System) request, the kernel component stores a DNS redirection list in its memory. This DNS redirection list includes the domain names of DNS requests that need to be redirected. If the domain name of the DNS request belongs to the DNS redirection list, then the resource to be accessed by the DNS request belongs to the redirecting resource.

[0099] For example, the requesting device can use the target address for determination. Step 2031 may include: the requesting device, in response to the target address and target port of the access request belonging to the network address and port of the redirecting resource, determines that the network resource belongs to the redirecting resource. For example, the requesting device can compare the target address and target port of the access request with the network address and port of the redirecting resource in the corresponding memory space of the kernel component through a kernel component. If the target address and target port of the access request belong to the network address and port of the redirecting resource, the network resource is determined to be a redirecting resource. For example, the kernel component may store a list of IP addresses and ports that need to be redirected in its corresponding memory; if the target address belongs to that IP address, or the target address and target port belong to that list of IP addresses and ports, then the network resource belongs to the redirecting resource.

[0100] For example, the requesting device can make the determination based on the protocol type. Step 2031 may include: the requesting device responding to the fact that the protocol type of the access request belongs to the redirecting resource protocol type, and determining that the network resource belongs to the redirecting resource. For example, the requesting device can compare the protocol type of the access request with the redirecting resource protocol type in the corresponding memory space of the kernel component through a kernel component. If the protocol type of the access request belongs to the redirecting resource network protocol type, the network resource is determined to be a redirecting resource.

[0101] For example, the requesting device can make a determination based on process information. Step 2031 may include: the requesting device responding to the process information of the access request matching the process characteristic information of the redirecting resource, and determining that the network resource belongs to the redirecting resource. For example, the requesting device can compare the process information of the access request with the process characteristic information in the corresponding memory space of the kernel component through a kernel component. If the process information of the access request matches the process characteristic information of the redirecting resource, the network resource is determined to belong to the redirecting resource. For example, if the process path of the access request is a specified pre-configured redirecting process path, or if the process of the access request does not have the specified signature information, then it can be determined that the network resource accessed by the process belongs to the redirecting resource.

[0102] It should be noted that the requesting device can combine one or more of the following for judgment: domain name, network address, protocol type, or process information. For example, combining network address and protocol type is used as an example. For instance, the target redirection policy in the memory corresponding to the kernel component may include the network address, port, and protocol type of the redirection resource. The requesting device can then compare the target address, target port, and protocol type of the access request with the network address, port, and protocol type of the redirection resource in the kernel component's corresponding memory space. If the target address and target port of the access request belong to the network address and port of the redirection resource, and the protocol type belongs to the network protocol type of the redirection resource, then the network resource is determined to be a redirection resource. For example, access requests belonging to a specified IP segment of enterprise content and using the TCP protocol need to be intercepted and redirected.

[0103] In one possible implementation, the target redirection strategy also defines network resources that will not be redirected. The requesting device can also make a judgment based on the target redirection strategy, including the following four cases: Case 1: If the domain name and port of the requesting device responding to the access request belong to a non-redirection resource domain name and port, the network resource is determined to be a non-redirection resource. Case 2: If the process information of the requesting device responding to the access request matches the process characteristic information of a non-redirection resource, the network resource is determined to be a non-redirection resource. For example, after the requesting device obtains the process information through the kernel component based on the process identifier information (such as the process ID PID), it compares it with the list of non-redirection processes in the target redirection strategy. If a match is found, the access request is directly allowed without interception or redirection. If a match is not found, step 2032 is executed for the next step. Case 3: If the communication 5-tuple of the requesting device responding to the access request does not match any of the following: network address and port of the redirection resource, protocol type of the redirection resource, or process characteristic information of the redirection resource, the network resource is determined to be a non-redirection resource. Scenario 4: The requesting device responds to the access request if the target address and target port are non-redirecting resource network addresses and ports, thus determining that the network resource is a non-redirecting resource.

[0104] For example, if the network resource is a non-redirecting resource, the requesting device can send the access request based on the communication link information. For instance, if the domain name in the DNS request is a domain that is prohibited from redirection, the core component will directly allow direct connection processing without intercepting or redirecting the DNS request. For instance, for an IP list or IP range configured by an enterprise administrator to block traffic, if the target address of the access request matches that IP list or IP range, the access request will be directly forwarded without interception or redirection. For instance, for an access request to the management server, the access request will be directly forwarded.

[0105] Of course, the requesting device can also combine the characteristics of redirecting and non-redirecting resources for determination. For example, based on the list of network segments of non-redirecting resources in the target redirection policy, it can determine whether the target address matches the list of directly connected network segments. If it matches, the access request is directly allowed for direct access. If it does not match, the target address, target port, and protocol type in the five-tuple are combined, and a filter search is performed based on at least one item in the list of IPs, ports, or protocols corresponding to the redirected resources in the target redirection policy. If any of the following conditions are met: Condition 1, if the target address matches the IP of the redirected resource; or Condition 2, if the target address and target port match the IP and port of the redirected resource; or Condition 3, if the target address, target port, and protocol type match the list of IPs, ports, and protocols corresponding to the redirected resource, then the network resource is determined to be a redirecting resource, and the access request needs to be redirected to the proxy process. If none of the above conditions are met, the network resource is determined to be a non-redirecting resource, and the request is directly allowed through the kernel component.

[0106] If the network resource is a redirection resource, the requesting device shall intercept, authenticate and redirect the access request by performing the following steps 2032.

[0107] In one possible implementation, if the domain name of the access request belongs to a referral resource domain name, the requesting device can also configure a virtual IP address for the access request. Therefore, before performing step 2032, the requesting device performs step A. In step A, the requesting device, in response to the fact that the domain name and port of the access request belong to a referral resource domain name and port, redirects the domain name of the access request to a virtual network address, which is not the real network address corresponding to the domain name of the access request.

[0108] For example, when the requesting device determines through kernel components that the domain name of the access request belongs to a redirecting resource domain, the requesting device resolves the domain name of the access request to a virtual network address through a proxy process. For instance, taking a DNS request as an example, if the kernel component determines that the domain name of the DNS request belongs to a redirecting domain, the kernel component requests the application-layer proxy process to further determine whether the domain name of the DNS request truly belongs to a domain that needs redirection. If it is an enterprise domain that needs to restrict access, the proxy process performs DNS resolution on that domain to allocate a virtual IP address to the DNS request. Of course, if the proxy process further determines that the domain name of the DNS request does not belong to a domain that needs redirection, the proxy process directly forwards the DNS request to an upstream DNS server to perform the actual DNS domain name resolution process, allocating the real network address corresponding to the domain name of the DNS request.

[0109] Step 2032: The requesting device responds that the network resource is a redirection resource, and based on the target address and the pre-configured redirection port, redirects the access request to the target gateway to access the target server.

[0110] The referrer port indicates the address used to carry the intercepted access requests.

[0111] In one possible implementation, the requesting device can intercept the access request using the referral port, and authenticate and redirect the request data of the intercepted access request to the target gateway. For example, step 2032 may include: in response to determining that the network resource belongs to the referral resource based on the target referral policy, the requesting device modifies the target address of the access request to the referral port at the network layer, and calls the callback processing function corresponding to the protocol type of the access request to execute the authentication of the access to the referral port and send it to the target server through the target gateway. For example, the requesting device can modify the target address to the referral port of the proxy process at the network layer through a kernel component; the requesting device intercepts the access request sent to the referral port through the proxy process; and calls the callback processing function corresponding to the protocol type of the access request through the kernel component to complete the execution process corresponding to the callback processing function.

[0112] For example, the referral port is a port detected by a proxy process. Before the requesting device executes step 2032, that is, before redirecting the access request to the target gateway to access the target server based on the target address and the pre-configured referral port, the requesting device first starts data detection of the referral port through the pre-configured proxy process. For example, the proxy process can open a specified port on the locally configured loopback network card as the referral port to detect the data received by the referral port. Therefore, when the requesting device modifies the target address of the access request to the referral port at the network layer, the requesting device can detect the access request sent to the referral port through the proxy process, thereby obtaining the request data of the access request.

[0113] For example, this callback function is used to authenticate the access request and send it to the target server based on the corresponding protocol type and transmission method. The protocol type and transmission method include, but are not limited to, TCP protocol transmission method, UDP protocol transmission method, etc.

[0114] For the authentication process, the requesting device can send one or more of the following information to the control process via inter-process communication through a proxy process: process information of the access request, the target address and target port before modification, the source address and source port, the protocol type, the application initiating the access request, and the object login information. The requesting device, through the control process, authenticates the access request based on the information sent by the proxy process. For example, the authentication process may include at least one of the following verification operations: verifying whether the application initiating the access request is a trusted application, verifying whether the target address and target port are the specified site, verifying whether the access request is a compliant request, verifying whether the process initiating the access request is a compliant process, verifying whether the device environment of the access request is secure, and verifying whether the current object has access rights to the resources of the target address and target port. If authentication is successful, the requesting device, through the control process, sends a credential request to the management server. This credential request is used to request gateway access credentials from the management server. The credential request may carry authentication information, which may include at least one piece of information sent by the proxy process to the control process. The management server can authenticate the access request based on the authentication information carried in the credential request. Once authentication is successful, the management server sends a gateway access credential to the requesting device. The requesting device receives the gateway access credential and passes it to the proxy process through the control process. The requesting device then sends the gateway access credential to the target gateway through the proxy process. The target gateway can send the gateway access credential to the target server for further authentication. Based on the authentication success message returned by the target server, the target gateway sends an authentication success message to the requesting device. The requesting device then sends the access request to the target gateway. Finally, the access request is sent to the target server through the target gateway.

[0115] In one possible implementation, the requesting device can pass the address of a callback function to the kernel component via a proxy process, so that the callback function can be invoked through the kernel component. Therefore, before invoking the callback function corresponding to the protocol type of the access request, the requesting device can execute step B: Step B, the requesting device passes the function entry address corresponding to at least one protocol type to the pre-configured kernel component via a pre-configured proxy process. Correspondingly, the implementation of step 2032 can include: the requesting device can modify the target address to the referrer port of the proxy process at the network layer through the kernel component; and through the kernel component, based on the function entry address passed by the proxy process, invoke the callback function corresponding to the protocol type to execute the authentication of the access request intercepted at the referrer port and send it to the target server through the target gateway.

[0116] For example, the proxy process stores the function entry address corresponding to at least one protocol type in its memory space, such as the function entry address of the TCP callback handling function and the function entry address of the UDP callback handling function. For example, the proxy process can directly read and write kernel driver handle operations to call the SDK interface of the kernel component; and the proxy process can also pass the function entry addresses of the TCP callback handling function and the UDP callback handling function to the SDK interface of the kernel component, so that the kernel component can call the corresponding callback handling function based on the passed function entry address.

[0117] For example, the target gateway is the gateway corresponding to the target address in the association relationship between gateway service addresses and gateways. For instance, an enterprise administrator can configure the association relationship between gateway service addresses and gateways in the management server. The gateway service address can include the address of the server providing traffic redirection resources. Then, the requesting device can use the gateway corresponding to the target address as the target gateway based on the association relationship between the gateway service address and gateways.

[0118] like Figure 6 As shown, after configuring traffic redirection policies in the management server, enterprise administrators can also configure corresponding accessible gateways for each business system. For example, different gateways can provide gateway services to different business addresses. For instance, the address corresponding to the service of gateway A can be "9.134.65.163:9443". Of course, after configuring multiple gateways, enterprise administrators can also configure the access order of each gateway, such as defining the sorting of each gateway so that each smart gateway is accessed based on this sorting.

[0119] Step 2033: Request the device to record the association between the source address and the process information.

[0120] In this step, since the requesting device starts data detection of the redirection port through a pre-configured proxy process, when the requesting device detects an access request for the redirection port through the proxy process, the requesting device records the association between the source address and process information of the access request.

[0121] In one possible implementation, the communication link information also includes a source port, and the requesting device can store the source address and process information in a key-value pair manner. Accordingly, the implementation of this step may include: in response to detecting the access request intercepted by the redirection port, the requesting device, through the proxy process, stores the association between the source address, source port, and process information, using the source address and source port of the access request as keys and the process information as values.

[0122] For example, the proxy process can detect access requests sent to the redirecting port through the redirecting port, and use the source address (LocalAddr) and source port (LocalPort) in the communication 5-tuple of the access request as the key. The requesting device can report the process information of the access request to the proxy process through the kernel component; the requesting device uses the process information as the value through the proxy process, thereby constructing a key-value mapping table structure in the memory space corresponding to the proxy process. For example, the process information may include process ID (e.g., process ID can be process number pid), process name, full process path, etc.; of course, it may also include one or more of the following: process executable file hash value (e.g., MD5), version information, whether it has specified signature information, and other attribute information of the process executable file; this application does not limit the specific content of the process information, this paragraph only uses process ID, process name, full process path, etc. as examples. In one possible example, the requesting device can also report detailed information such as the traffic ID and communication 5-tuple of the access request to the proxy process through the kernel component. Therefore, the requesting device can also use the proxy process to construct a mapping between the source address and source port, process information, and the communication 5-tuple, using the source address and source port in the communication 5-tuple as the key and the process information and communication 5-tuple as the value. For example, it can also use the source address and source port in the communication 5-tuple as the key and the traffic ID, process information, and communication 5-tuple as the value to construct a mapping between the source address and source port, traffic ID, process information, and communication 5-tuple. For example, the detailed information reported by the kernel component received by the requesting device through the proxy process may include at least one of the following:

[0123]

[0124]

[0125] It should be noted that steps 2032 and 2033 can be executed simultaneously, or they can be executed sequentially. The order of execution of steps 2032 and 2033 is not restricted by their sequence numbers.

[0126] Step 204: The requesting device receives the response data returned by the target server through the target gateway, and displays the response page corresponding to the access request based on the response data and the correlation between the source address and process information.

[0127] The requesting device receives the response data and, based on the association between the source address and process information, determines the application corresponding to the response data. Based on the response data, it displays the response page of that application that responded to the access request. The application corresponding to the response data refers to the application that initiated the access request. The requesting device can determine the application corresponding to the response data based on the process information; for example, the process information may include the application ID of the application that initiated the access request. For instance, if the current object initiates a request to browse a specified file in an enterprise application, the requesting device receives file data returned by the enterprise's business server, locates the enterprise application corresponding to the file data based on the association, and displays the file data on the enterprise application's page.

[0128] In one possible implementation, the association includes a mapping relationship with source address and source port as keys and process information as values; then step 204 may include: the requesting device determining the receiving address and receiving port for receiving the response data; the requesting device determining the process information corresponding to the receiving address and receiving port from the mapping relationship with source address and source port as keys and process information as values; the requesting device sending the response data back to the application that initiated the access request based on the process information corresponding to the receiving address and receiving port, and displaying the response page in the application based on the response data. Here, the receiving address and receiving port of the response data refer to the address and port for receiving the response data. The receiving address and receiving port of the response data are the source address and source port of the access request corresponding to the response data. In the Go language, `net.TCPConn` can be used to obtain the IP address and port of the TCP communication peer; `net.UDPConn` can be used to obtain the IP address and port of the UDP communication peer, which are also the receiving address and receiving port.

[0129] For example, the callback function is also used to determine the process information corresponding to the response data. When the requesting device receives the response data, it calls the callback function to determine the process information corresponding to the response data based on the receiving address and receiving port of the response data. For instance, the requesting device can obtain the receiving address and receiving port of the response data through a proxy process, and pass the receiving address, receiving port, and response data to the kernel component through read / write kernel driver handle operations. The kernel component then executes the callback function based on the data passed in by the proxy process to determine the process information corresponding to the response data from the mapping relationship maintained by the proxy process, where the source address and source port are the keys and the process information is the value. The response data is then sent back to the application so that the response page can be displayed in the application.

[0130] In one possible implementation, after receiving the response data returned by the target server via the target gateway, the requesting device can release the resources involved in the access process based on the sending and responding process of the access request. For example, it can release the occupied source port. In one possible example, if the communication connection between the target server and the requesting device is a short connection, the requesting device can release the source port in the process that initiated the access request and delete the mapping relationship with the source address and source port as keys and the process information as values. For example, if a short connection is established between the target server and the requesting device, the current access between the target server and the requesting device ends upon receiving the response data, and the requesting device can release the source port occupied by this access. In another possible example, if the communication connection between the target server and the requesting device is a persistent connection, the requesting device can maintain the source port during the process until the communication connection between the target server and the terminal device reaches the persistent connection termination condition. At this point, the source port is released during the process, and the mapping relationship with the source address and source port as keys and the process information as values ​​is deleted. The persistent connection termination condition may include, but is not limited to: the communication duration exceeding a persistent connection duration threshold, or receiving a trigger operation that initiates the termination of the persistent connection. For example, when the current object is watching video resources on the enterprise intranet, a persistent connection can be established between the requesting device and the target server. When the persistent connection duration exceeds the threshold, or when the current object triggers an operation to close the video viewing, the requesting device releases the source port.

[0131] It should be noted that by releasing the source port in a timely manner in the case of short or long connections, it is ensured that one source port corresponds to only one access request at a time, thereby ensuring an accurate one-to-one correspondence between access and response based on access request and guaranteeing access accuracy.

[0132] Figure 7 A simplified diagram of the framework structure I obtained is provided for accessing specific data. For example... Figure 7 As shown, the traffic management application acts as the provider of zero-trust network security services, the requesting device acts as the access subject initiating the access request, the resource server of the private network acts as the access object being accessed, and the zero-trust proxy and access gateway provide a unified entry point between the access subject and the access object, thus realizing the entire access process from steps 201 to 204 above.

[0133] Figure 8 A schematic diagram of a framework for dedicated network access is provided, such as... Figure 8 As shown, this framework includes requesting devices, a management server, a smart gateway, and a service server. The various devices within this framework interact to access the dedicated network, specifically including:

[0134] Step 1: The requesting device intercepts the access request that needs to be redirected through the proxy process and obtains information such as the URL, process pid (process ID), communication quintuple, and domain name of the access request.

[0135] Step 2: The requesting device can request a ticket from the traffic management application through the agent process. This ticket may include credentials for logging into the traffic management application, credentials for accessing network resources, etc.

[0136] Step 3: The requesting device obtains information such as the application that initiated the access request and the process characteristics that initiated the access request through the traffic management application.

[0137] Step 4: The requesting device sends a ticket replacement request to the management server. This ticket replacement request is used to obtain access to the private network based on the ticket replacement.

[0138] Step 5: The requesting device will send the information obtained in Step 3 to the management server to perform process inspection. This management server is configured with a policy center, inspection service, and ticket center. The inspection service can be used to verify whether the requesting device has the necessary access permissions based on the information sent. The policy center is used to manage traffic redirection strategies, such as configuring traffic redirection strategies for each object; the ticket center is used to manage tickets, such as ticket replacement.

[0139] Step 6: After the requesting device is authenticated by the management server, it returns a ticket response to the agent process.

[0140] Step 7: The requesting device forwards the ticket and access request to the smart gateway through the agent process.

[0141] Step 8: Based on the ticket, the smart gateway sends a ticket verification request to the management server.

[0142] Step 9: The smart gateway receives the verification result returned by the management server.

[0143] Step 10: If the verification result indicates that the user has access rights, please have the smart gateway verify and forward the access request to the corresponding business server.

[0144] step The business server returns response data to the target gateway based on the access request.

[0145] step The target gateway returns the response data to the proxy process of the requesting device.

[0146] step The requesting device uses a proxy process to determine the process information corresponding to the response data. Based on this process information, it sends the response data back to the corresponding application so that the response result can be accessed on the application's response page.

[0147] The data processing method provided in this application determines the communication link information corresponding to the access request. When the network resource is a redirection resource, based on the target address and the pre-configured redirection port, the access request is redirected to the target gateway to access the target server. The target gateway can then forward the access request to the target server, thereby automatically redirecting access to the resource requiring redirection to the corresponding gateway. By recording the association between the source address and the process information of the process that initiated the access request, the response page corresponding to the access request can be displayed based on the association between the source address and the process information when the response data returned by the target server is received. This ensures that the entire access process initiated by the access request is executed accurately, without the need to install a virtual network card or modify the system routing table. This effectively solves the problem of poor practicality in related technologies and improves the accuracy and practicality of accessing private networks.

[0148] Furthermore, this application does not require the installation of a virtual network adapter, nor does it require modification of the system routing table or local DNS configuration, thus avoiding risky and conflicting operations. Therefore, the entire access process can avoid the intractable compatibility issues present in related technologies.

[0149] Furthermore, this application enables access to dedicated networks by providing streamlined kernel components at the driver layer and interacting with application layer proxy and control processes. Through inter-process communication between the proxy process, kernel components, and control process, traffic that does not need to be redirected is output through the system's original path, while traffic that needs to be redirected is automatically processed by the callback function through the proxy process; thus ensuring that the entire access process is executed accurately. In terms of stability and compatibility, there are no global configuration requirements for the system, thereby significantly improving system stability and compatibility.

[0150] Furthermore, regarding performance improvements, there is no additional resource initialization process. Through the data processing method of this application, the traffic redirection driver starts and operates instantly, enabling rapid redirection of access requests, access, and return of response data, thus improving access efficiency. Moreover, using the method of this application, after accurately redirecting traffic to resources requiring redirection based on the target traffic redirection strategy, services outside the strategy use the system's original exit points and are unaffected by the traffic redirection. In summary, this application offers significant improvements in stability, compatibility, and performance.

[0151] Figure 9 This is a signaling interaction diagram of a data processing method provided in this application, such as... Figure 9As shown, this method is achieved through interaction between the requesting device, the management server, the target gateway, and the target server. This information interaction process includes the following steps.

[0152] Step 901: Request the device to send a login request to the management server.

[0153] This login request is used to request login to the traffic management application. The login request can carry the object login information of the current object. The requesting device can start and run the traffic management application based on the triggering operation of the current object; the requesting device can display the login page of the traffic management application, and the current object can enter information such as login name and login key on the login page. The requesting device sends a login request to the management device based on the object login information.

[0154] Step 902: Based on the login request, the management server returns the target referral strategy to the requesting device.

[0155] The management server can determine the target traffic redirection strategy corresponding to the current object based on the object's login information.

[0156] Step 903: Request the device to receive the target traffic diversion strategy.

[0157] The implementation method of step 903 is the same as that of step 201, and will not be described in detail here.

[0158] Step 904: The requesting device responds to the received access request for network resources and determines the communication link information corresponding to the access request.

[0159] For example, the access request could be for a private network. In a remote work scenario, the current user can connect to the enterprise intranet through this traffic management application and initiate an access request for network resources within the intranet. For instance, this could be a request to browse files on the enterprise intranet or a request to watch videos on the enterprise intranet.

[0160] The communication link information includes the source address and the destination address; wherein, the implementation of step 904 is the same as that of step 202, and will not be described in detail here.

[0161] Step 905: Request the device to determine whether the network resource is a traffic redirection resource based on the target traffic redirection strategy.

[0162] For example, this referral resource can be considered a network resource within the enterprise intranet that requires restricted access.

[0163] Step 906: If the network resource is a redirection resource, request the device to modify the target address of the access request to the redirection port so as to intercept the access request to the redirection port and record the association between the source address and the process information.

[0164] The target gateway is used to forward the access request to the target server and forward the response data from the target server to the source address. The process information is used to indicate the process that initiated the access request.

[0165] Step 907: The requesting device will send the access requests intercepted to the redirection port to the target gateway after authentication.

[0166] For example, the target gateway could be a gateway that provides services to the enterprise's intranet servers, such as providing authentication, authorization, and forwarding for each access request to enterprise resources.

[0167] The implementation methods of steps 905-907 are similar to those of step 203, and will not be described in detail here.

[0168] The authentication process described herein is similar to the authentication process described in step 2032 above, and has adopted the following methods. Figure 8 The corresponding steps and procedures are illustrated with examples, and will not be repeated here.

[0169] Step 908: The target gateway sends the access request to the target server.

[0170] For example, the target server can be a server within the enterprise's intranet, used to provide target resources within the enterprise's intranet.

[0171] Step 909: Based on the access request, the target server returns the corresponding response data to the target gateway.

[0172] For example, the response data could be the file data corresponding to the browsing request; or it could be the video data stream, audio data stream, etc. corresponding to the viewing request.

[0173] Step 910: The target gateway receives the response data and sends it to the requesting device.

[0174] Step 911: The requesting device receives the response data returned by the target server through the target gateway; based on the response data and the correlation between the source address and process information, the response page corresponding to the access request is displayed.

[0175] For example, the requesting device can display the file to be viewed on the file display page of an enterprise application based on the file data, or display a download entry for the file on the file download page so that the current user can download the file. Similarly, the requesting device can play the video on the video playback page of an enterprise application based on video or audio data streams, or display a download entry for the video on the video download page so that the current user can download the video.

[0176] The implementation method of step 911 is the same as that of step 204, and will not be described in detail here.

[0177] The data processing method provided in this application involves cloud security, cloud computing technologies, etc. For example, cloud security technologies can be used in this application to authenticate access requests and redirect access requests to a target gateway to access the target server, thereby ensuring the security of each step in the access process to the redirected resources.

[0178] It should be understood that cloud security refers to the collective term for security software, hardware, objects, organizations, and security cloud platforms based on cloud computing business models. The main research directions of cloud security include: 1. Cloud computing security: This mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of object data, object access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure: This mainly studies how to use cloud computing to build and integrate security infrastructure resources, optimize security protection mechanisms, including building large-scale security incident and information collection and processing platforms through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information, and improve the ability to control and manage network-wide security incidents and risks; 3. Cloud security services: This mainly studies various security services provided to objects based on cloud computing platforms, such as antivirus services.

[0179] It should be understood that cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, the resources in the "cloud" are infinitely scalable, readily available, on-demand, expandable, and pay-as-you-go.

[0180] Figure 10 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. Figure 10 As shown, the device includes:

[0181] The communication link determination module 1001 is used to determine the communication link information corresponding to the received access request for network resources, the communication link information including the source address and the destination address;

[0182] The traffic redirection module 1002 is used to respond to the determination that the network resource belongs to the traffic redirection resource based on the pre-configured target traffic redirection strategy, and based on the target address and the pre-configured traffic redirection port, redirect the access request to the target gateway to access the target server, and record the association between the source address and process information;

[0183] The target gateway is used to forward the access request to the target server and forward the response data of the target server to the source address. The process information is used to indicate the process that initiated the access request.

[0184] The receiving module 1003 is used to receive response data returned by the target server through the target gateway;

[0185] Display module 1004 is used to display the response page corresponding to the access request based on the response data and the relationship between the source address and process information.

[0186] In one possible implementation, the referral port indicates the address used to carry the intercepted access request;

[0187] The referral module 1002 is used to respond to the determination that the network resource belongs to the referral resource based on the target referral strategy, modify the target address of the access request to the referral port at the network layer, and call the callback processing function corresponding to the protocol type of the access request to execute the authentication of the access request intercepted to the referral port and send it to the target server through the target gateway.

[0188] The callback function is used to authenticate the access request and send it to the target server based on the transmission method of the corresponding protocol type.

[0189] In one possible implementation, the device further includes:

[0190] The input module is used to pass the function entry address corresponding to at least one protocol type to a pre-configured kernel component through a pre-configured proxy process;

[0191] The diversion module 1002 is used for:

[0192] This kernel component modifies the target address to the proxy process's redirection port at the network layer.

[0193] Through this kernel component, based on the function entry address passed by the proxy process, the callback handling function corresponding to the protocol type is called to execute the intercepted access request to the redirection port, which is then authenticated and sent to the target server through the target gateway.

[0194] In this context, the target gateway is the gateway corresponding to the target address in the association relationship between gateway service addresses and gateways.

[0195] In one possible implementation, the device further includes:

[0196] Enable data detection for this redirection port through a pre-configured proxy process;

[0197] The referral module 1002 is used to respond to the detection of the access request intercepted by the referral port, and through the proxy process, store the association relationship between the source address, source port and process information with the source address and source port of the access request as keys and the process information as values. The communication link information also includes the source port.

[0198] In one possible implementation, the communication link information also includes the source port, and the association includes a correspondence with the source address and source port as keys and the process information as values;

[0199] The display module 1004 is used to determine the receiving address and receiving port for receiving the response data; using the receiving address and receiving port as keys, it determines the process information corresponding to the receiving address and receiving port from the correspondence between the source address and source port as keys and the process information as values; based on the process information corresponding to the receiving address and receiving port, it sends the response data back to the application that initiated the access request, and displays the response page in the application based on the response data.

[0200] In one possible implementation, the device further includes any of the following:

[0201] The short connection release module is used to release the source port in the process that initiated the access request and delete the mapping relationship with the source address and source port as the key and the process information as the value. The communication connection between the target server and the requesting device is a short connection.

[0202] The long connection release module is used to maintain the source port in the process until the communication connection between the target server and the terminal device reaches the long connection termination condition. In the process, the source port is released and the mapping relationship with the source address and source port as the key and the process information as the value is deleted. The communication connection between the target server and the requesting device is a long connection.

[0203] In one possible implementation, the device further includes an acquisition module, which, when acquiring the target referral strategy, is configured to, in response to the current object logging into the referral management application, acquire the target referral strategy corresponding to the current object from the management server of the referral management application based on the object login information of the current object; and store the target referral strategy in the memory space corresponding to the pre-configured kernel component.

[0204] In one possible implementation, the target referral strategy includes at least one of the following: a pre-configured referral resource domain name and port, a referral resource network address and port, a referral resource protocol type, a referral resource process characteristic information, a non-referral resource domain name and port, a non-referral resource network address and port, a non-referral resource protocol type, or a non-referral resource process characteristic information.

[0205] In one possible implementation, the non-redirecting resource domain name and port include the domain name and port bound to the management server;

[0206] The referral resource domain name and port include the domain name and port bound to the resource server in the private network of the target network, while the non-referral resource domain name and port include the domain name and port bound to the resource server in the public network of the target network.

[0207] In one possible implementation, the referral module 1002 is also used for at least one of the following:

[0208] The domain name and port responding to the access request belong to the referral resource domain name and port, thus determining that the network resource is a referral resource;

[0209] Since the target address and target port of the access request belong to the network address and port of the referral resource, it is determined that the network resource belongs to the referral resource.

[0210] The protocol type responding to the access request belongs to the redirecting resource protocol type, thus determining that the network resource is a redirecting resource;

[0211] The process information responding to the access request matches the process characteristics of the redirecting resource, thus determining that the network resource belongs to the redirecting resource.

[0212] In one possible implementation, the device further includes:

[0213] The redirect module is used to respond to the fact that the domain name and port of the access request belong to the domain name and port of the referral resource, and redirect the domain name of the access request to a virtual network address. This virtual network address is not the real network address corresponding to the domain name of the access request.

[0214] In one possible implementation, the device further includes a non-draining resource sending module, which is used to:

[0215] The domain name and port responding to the access request belong to non-traffic-driving resource domain name and port, and the access request is sent based on the communication link information;

[0216] In response to the process information matching the characteristics of a non-traffic-driving resource process, the access request is sent based on the communication link information.

[0217] If the communication quintuple responding to the access request does not match any of the following: the network address and port of the referral resource, the protocol type of the referral resource, or the process characteristics of the referral resource, the access request is sent based on the communication link information.

[0218] The data processing apparatus provided in this application, by determining the communication link information corresponding to the access request, when the network resource belongs to the redirection resource, redirects the access request to the target gateway to access the target server based on the target address and the pre-configured redirection port. The target gateway can then forward the access request to the target server, thereby automatically redirecting access to the resource requiring redirection to the corresponding gateway. By recording the association between the source address and the process information of the process that initiated the access request, the apparatus can display the response page corresponding to the access request based on the association between the source address and the process information when receiving the response data returned by the target server. This ensures the accurate execution of the entire access process initiated by the access request, without requiring the installation of a virtual network card or modification of the system routing table. This effectively solves the problem of poor practicality in related technologies and improves the accuracy and practicality of accessing private networks.

[0219] Furthermore, this application does not require the installation of a virtual network adapter, nor does it require modification of the system routing table or local DNS configuration, thus avoiding risky and conflicting operations. Therefore, the entire access process can avoid the intractable compatibility issues present in related technologies.

[0220] Furthermore, this application enables access to dedicated networks by providing streamlined kernel components at the driver layer and interacting with application layer proxy and control processes. Through inter-process communication between the proxy process, kernel components, and control process, traffic that does not need to be redirected is output through the system's original path, while traffic that needs to be redirected is automatically processed by the callback function through the proxy process; thus ensuring that the entire access process is executed accurately. In terms of stability and compatibility, there are no global configuration requirements for the system, thereby significantly improving system stability and compatibility.

[0221] Furthermore, regarding performance improvements, there is no additional resource initialization process. Through the data processing method of this application, the traffic redirection driver starts and operates instantly, enabling rapid redirection of access requests, access, and return of response data, thus improving access efficiency. Moreover, using the method of this application, after accurately redirecting traffic to resources requiring redirection based on the target traffic redirection strategy, services outside the strategy use the system's original exit points and are unaffected by the traffic redirection. In summary, this application offers significant improvements in stability, compatibility, and performance.

[0222] The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0223] Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. For example... Figure 11 As shown, the computer device includes: a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of a data processing method, which, compared with related technologies, enables:

[0224] The data processing method provided in this application determines the communication link information corresponding to the access request. When the network resource is a redirection resource, based on the target address and the pre-configured redirection port, the access request is redirected to the target gateway to access the target server. The target gateway can then forward the access request to the target server, thereby automatically redirecting access to the resource requiring redirection to the corresponding gateway. By recording the association between the source address and the process information of the process that initiated the access request, the response page corresponding to the access request can be displayed based on the association between the source address and the process information when the response data returned by the target server is received. This ensures that the entire access process initiated by the access request is executed accurately, without the need to install a virtual network card or modify the system routing table. This effectively solves the problem of poor practicality in related technologies and improves the accuracy and practicality of accessing private networks.

[0225] Furthermore, this application does not require the installation of a virtual network adapter, nor does it require modification of the system routing table or local DNS configuration, thus avoiding risky and conflicting operations. Therefore, the entire access process can avoid the intractable compatibility issues present in related technologies.

[0226] Furthermore, this application enables access to dedicated networks by providing streamlined kernel components at the driver layer and interacting with application layer proxy and control processes. Through inter-process communication between the proxy process, kernel components, and control process, traffic that does not need to be redirected is output through the system's original path, while traffic that needs to be redirected is automatically processed by the callback function through the proxy process; thus ensuring that the entire access process is executed accurately. In terms of stability and compatibility, there are no global configuration requirements for the system, thereby significantly improving system stability and compatibility.

[0227] Furthermore, regarding performance improvements, there is no additional resource initialization process. Through the data processing method of this application, the traffic redirection driver starts and operates instantly, enabling rapid redirection of access requests, access, and return of response data, thus improving access efficiency. Moreover, using the method of this application, after accurately redirecting traffic to resources requiring redirection based on the target traffic redirection strategy, services outside the strategy use the system's original exit points and are unaffected by the traffic redirection. In summary, this application offers significant improvements in stability, compatibility, and performance.

[0228] In one alternative embodiment, a computer device is provided, such as Figure 11 As shown, Figure 11 The computer device 1100 shown includes a processor 1101 and a memory 1103. The processor 1101 and the memory 1103 are connected, for example, via a bus 1102. Optionally, the computer device 1100 may further include a transceiver 1104, which can be used for data interaction between the computer device and other computer devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 1104 is not limited to one type, and the structure of the computer device 1100 does not constitute a limitation on the embodiments of this application.

[0229] Processor 1101 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 1101 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0230] Bus 1102 may include a pathway for transmitting information between the aforementioned components. Bus 1102 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 1102 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0231] The memory 1103 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0232] The memory 1103 is used to store computer programs that execute the embodiments of this application, and the execution is controlled by the processor 1101. The processor 1101 is used to execute the computer programs stored in the memory 1103 to implement the steps shown in the foregoing method embodiments.

[0233] Electronic devices include, but are not limited to, servers, terminals, or cloud computing center equipment.

[0234] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0235] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0236] Those skilled in the art will understand that, unless otherwise stated, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. The terms “comprising” and “including” as used in the embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, or operation, but do not exclude implementation as other features, information, data, steps, or operations supported by this art.

[0237] The terms "first," "second," "third," "fourth," "1," "2," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that shown in the figures or text.

[0238] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0239] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application without departing from the technical concept of this application also fall within the protection scope of the embodiments of this application.

Claims

1. A data processing method, characterized in that, The method includes: In response to receiving an access request for network resources, the communication link information corresponding to the access request is determined, the communication link information including the source address and the destination address; In response to determining that the network resource belongs to a referral resource based on a pre-configured target referral strategy, the access request is referred to a target gateway to access the target server based on the target address and the pre-configured referral port. This includes: in response to determining that the network resource belongs to a referral resource based on the target referral strategy, modifying the target address of the access request to the referral port at the network layer, and calling a callback function corresponding to the protocol type of the access request to authenticate the access request intercepted at the referral port and send it to the target server through the target gateway; wherein the referral port indicates the address used to carry the intercepted access request, the target gateway is used to forward the access request to the target server and forward the response data of the target server to the source address, and the callback function is used to authenticate the access request and send the access request to the target server based on the transmission method of the corresponding protocol type. Record the association between the source address and process information; wherein the process information is used to indicate the process that initiated the access request; Receive the response data returned by the target server through the target gateway, and display the response page corresponding to the access request based on the response data and the correlation between the source address and process information.

2. The method according to claim 1, characterized in that, Before invoking the callback function corresponding to the protocol type of the access request, the method further includes: The pre-configured proxy process passes the function entry address corresponding to at least one protocol type to the pre-configured kernel component. The step of modifying the target address of the access request to the referral port at the network layer and calling the callback function corresponding to the protocol type of the access request to execute the authentication of the access request intercepted to the referral port and send it to the target server through the target gateway includes: The kernel component modifies the target address to the proxy process's redirection port at the network layer. Through the kernel component, based on the function entry address passed by the proxy process, the callback processing function corresponding to the protocol type is called to execute the authentication of the access request intercepted to the redirection port and send it to the target server through the target gateway; Wherein, the target gateway is the gateway corresponding to the target address in the association relationship between gateway service addresses and gateways.

3. The method according to claim 1, characterized in that, Before redirecting the access request to the target gateway to access the target server based on the target address and the pre-configured redirection port, the method further includes: Data detection of the referral port is enabled through a pre-configured proxy process; The record of the association between the source address and process information includes: In response to detecting the access request intercepted by the referral port, the proxy process stores the association between the source address, source port and process information using the source address and source port of the access request as keys and the process information as values. The communication link information also includes the source port.

4. The method according to claim 1, characterized in that, The communication link information also includes the source port, and the association relationship includes a correspondence with the source address and source port as keys and the process information as values; The process of displaying the response page corresponding to the access request based on the response data and the correlation between the source address and process information includes: Determine the receiving address and receiving port for receiving the response data; Using the receiving address and receiving port as keys, determine the process information corresponding to the receiving address and receiving port from the correspondence between the source address and source port as keys and the process information as values; Based on the process information corresponding to the receiving address and receiving port, the response data is sent back to the application that initiated the access request, and the response page is displayed in the application based on the response data.

5. The method according to claim 4, characterized in that, After receiving the response data returned by the target server via the target gateway, the method further includes any one of the following: In the process that initiates the access request, the source port is released, and the correspondence between the source address and source port as keys and the process information as values ​​is deleted. The communication connection between the target server and the requesting device is a short connection. The source port is maintained during the process until the communication connection between the target server and the terminal device reaches the long connection termination condition. The source port is then released during the process, and the correspondence between the source address and source port as keys and the process information as values ​​is deleted. The communication connection between the target server and the requesting device is a long connection.

6. The method according to claim 1, characterized in that, The methods for obtaining the target traffic acquisition strategy include: When the current object logs into the traffic management application, the target traffic acquisition strategy corresponding to the current object is obtained from the management server of the traffic management application based on the object login information of the current object. The target traffic redirection strategy is stored in the memory space corresponding to the pre-configured kernel component.

7. The method according to claim 6, characterized in that, The target traffic redirection strategy includes at least one of the following: pre-configured traffic redirection resource domain name and port, traffic redirection resource network address and port, traffic redirection resource protocol type, traffic redirection resource process characteristic information, non-traffic redirection resource domain name and port, non-traffic redirection resource network address and port, non-traffic redirection resource protocol type, or non-traffic redirection resource process characteristic information.

8. The method according to claim 7, characterized in that, The non-traffic-driving resource domain names and ports include the domain names and ports bound to the management server; The referral resource domain names and ports include the domain names and ports bound to resource servers in the private network of the target network, while the non-referral resource domain names and ports include the domain names and ports bound to resource servers in the public network of the target network.

9. The method according to claim 7, characterized in that, The determination that the network resource belongs to the traffic redirection resource based on the pre-configured target traffic redirection strategy includes at least one of the following: If the domain name and port of the access request belong to the domain name and port of the referral resource, it is determined that the network resource belongs to the referral resource. In response to the fact that the target address and target port of the access request belong to the network address and port of the referral resource, it is determined that the network resource belongs to the referral resource. If the protocol type of the access request is a referral resource protocol type, then the network resource is determined to be a referral resource. If the process information of the access request matches the process characteristic information of the referral resource, it is determined that the network resource belongs to the referral resource.

10. The method according to claim 7, characterized in that, Before redirecting the access request to the target gateway to access the target server based on the target address and the pre-configured redirection port, the method further includes: In response to the fact that the domain name and port of the access request belong to the domain name and port of the redirecting resource, the domain name of the access request is redirected to a virtual network address, which is not the real network address corresponding to the domain name of the access request.

11. The method according to claim 7, characterized in that, The method further includes: If the domain name and port of the access request are non-traffic-driving resource domain names and ports, the access request is sent based on the communication link information; In response to the process information matching the characteristics of a non-traffic-driving resource process, the access request is sent based on the communication link information; When the communication quintuple of the access request does not match any of the following: the network address and port of the referral resource, the protocol type of the referral resource, or the process characteristics of the referral resource, the access request is sent based on the communication link information.

12. A data processing apparatus, characterized in that, The device includes: A communication link determination module is used to determine the communication link information corresponding to the access request in response to receiving an access request for network resources. The communication link information includes a source address and a destination address. The traffic redirection module is configured to, in response to determining that the network resource belongs to the traffic redirection resource based on a pre-configured target traffic redirection strategy, redirect the access request to the target gateway to access the target server based on the target address and the pre-configured traffic redirection port. Specifically, it is configured to: in response to determining that the network resource belongs to the traffic redirection resource based on the target traffic redirection strategy, modify the target address of the access request to the traffic redirection port at the network layer, and call the callback processing function corresponding to the protocol type of the access request to execute the authentication of the access request intercepted at the traffic redirection port and send it to the target server through the target gateway; wherein, the traffic redirection port indicates the address used to carry the intercepted access request, the target gateway is used to forward the access request to the target server and forward the response data of the target server to the source address, and the callback processing function is used to execute the authentication of the access request and send the access request to the target server based on the transmission method of the corresponding protocol type; The referral module is also used to record the association between the source address and process information; The process information is used to indicate the process that initiated the access request; A receiving module is used to receive response data returned by the target server via the target gateway; The display module is used to display the response page corresponding to the access request based on the response data and the correlation between the source address and process information.

13. The apparatus according to claim 12, characterized in that, The device further includes: The input module is used to pass the function entry address corresponding to at least one protocol type to a pre-configured kernel component through a pre-configured proxy process; The diversion module is used for: The kernel component modifies the target address to the proxy process's redirection port at the network layer. Through the kernel component, based on the function entry address passed by the proxy process, the callback processing function corresponding to the protocol type is called to execute the authentication of the access request intercepted to the redirection port and send it to the target server through the target gateway; Wherein, the target gateway is the gateway corresponding to the target address in the association relationship between gateway service addresses and gateways.

14. The apparatus according to claim 12, characterized in that, The device further includes: Data detection of the referral port is enabled through a pre-configured proxy process; The referral module is used to respond to the detection of the access request intercepted by the referral port, and through the proxy process, store the association relationship between the source address, source port and process information, with the source address and source port of the access request as keys and the process information as values. The communication link information also includes the source port.

15. The apparatus according to claim 12, characterized in that, The communication link information also includes the source port, and the association relationship includes a correspondence with the source address and source port as keys and the process information as values; The display module is used to determine the receiving address and receiving port for receiving the response data; Using the receiving address and receiving port as keys, determine the process information corresponding to the receiving address and receiving port from the correspondence between the source address and source port as keys and the process information as values; based on the process information corresponding to the receiving address and receiving port, send the response data back to the application that initiated the access request, and display the response page in the application based on the response data.

16. The apparatus according to claim 15, characterized in that, The device further includes any one of the following: The short connection release module is used to release the source port in the process that initiates the access request and delete the correspondence between the source address and source port as keys and the process information as values. The communication connection between the target server and the requesting device is a short connection. The long connection release module is used to maintain the source port in the process until the communication connection between the target server and the terminal device reaches the long connection termination condition, release the source port in the process, and delete the correspondence with the source address and source port as keys and the process information as values. The communication connection between the target server and the requesting device is a long connection.

17. The apparatus according to claim 12, characterized in that, The device further includes an acquisition module, which, when acquiring the target traffic acquisition strategy, is used to, in response to the current object logging into the traffic acquisition management application, acquire the target traffic acquisition strategy corresponding to the current object from the management server of the traffic acquisition management application based on the object login information of the current object; The target traffic redirection strategy is stored in the memory space corresponding to the pre-configured kernel component.

18. The apparatus according to claim 17, characterized in that, The target traffic redirection strategy includes at least one of the following: pre-configured traffic redirection resource domain name and port, traffic redirection resource network address and port, traffic redirection resource protocol type, traffic redirection resource process characteristic information, non-traffic redirection resource domain name and port, non-traffic redirection resource network address and port, non-traffic redirection resource protocol type, or non-traffic redirection resource process characteristic information.

19. The apparatus according to claim 18, characterized in that, The non-traffic-driving resource domain names and ports include the domain names and ports bound to the management server; The referral resource domain names and ports include the domain names and ports bound to resource servers in the private network of the target network, while the non-referral resource domain names and ports include the domain names and ports bound to resource servers in the public network of the target network.

20. The apparatus according to claim 18, characterized in that, The drainage module is also used for at least one of the following: If the domain name and port of the access request belong to the domain name and port of the referral resource, it is determined that the network resource belongs to the referral resource. In response to the fact that the target address and target port of the access request belong to the network address and port of the referral resource, it is determined that the network resource belongs to the referral resource. If the protocol type of the access request is a referral resource protocol type, then the network resource is determined to be a referral resource. If the process information of the access request matches the process characteristic information of the referral resource, it is determined that the network resource belongs to the referral resource.

21. The apparatus according to claim 18, characterized in that, The device further includes: The redirection module is used to redirect the domain name of the access request to a virtual network address in response to the fact that the domain name and port of the access request belong to the domain name and port of the traffic redirection resource. The virtual network address is not the real network address corresponding to the domain name of the access request.

22. The apparatus according to claim 18, characterized in that, The device further includes a non-traffic-driving resource sending module, the non-traffic-driving resource sending module being used for: If the domain name and port of the access request are non-traffic-driving resource domain names and ports, the access request is sent based on the communication link information; In response to the process information matching the characteristics of a non-traffic-driving resource process, the access request is sent based on the communication link information; When the communication quintuple of the access request does not match any of the following: the network address and port of the referral resource, the protocol type of the referral resource, or the process characteristics of the referral resource, the access request is sent based on the communication link information.

23. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 11.

24. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

25. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

Images