A method and system for remote management of wide area network intelligent gateway equipment based on web

Abstract

The present invention discloses a web-based method and system for remote management of wide area network intelligent gateway devices. The method includes: first logging into a web server, the web server performing two-factor authentication on an account, password, and mobile phone verification code, then registering a device whitelist, sending a registration request to the web server using the unique ID serial number of the target intelligent gateway CPE, and then the target intelligent gateway CPE reporting device information. When the target intelligent gateway CPE is online, the user can initiate a remote connection request to the target CPE device through a web browser to start remote operation. When the web socket is actively closed, the web server will actively initiate a request to close the remote device SSH service previously operated by the user to the remote server. By webifying the service, the web server forwards the request to the remote server for forwarding configuration. The remote server only needs to meet the requirements of remote control software and specific network. The access terminal only needs to meet the requirements of accessing the public network to handle emergency events on the target intelligent gateway through the Internet terminal anytime and anywhere.

Description

Technical Field

[0001] The present invention belongs to the fields of cache technology, data encryption and decryption, security authentication, SSH tunnel technology, NETCONF technology, and session authentication technology, and in particular to a method and system for remote management of wide area network intelligent gateway equipment based on a web. Background Art

[0002] With the rapid development of wide area network (WAN) technology, we are increasingly demanding remote control and troubleshooting of intelligent gateway devices over WANs, as well as timely, convenient, and secure troubleshooting. We often encounter emergencies requiring urgent remote access to intelligent gateway devices. However, the commonly used SSH remote access method places high and demanding requirements on the terminal software and network. In actual project implementation, we often encounter the following issues.

[0003] Personal terminals cannot meet the software and network requirements for SSH access;

[0004] In real life, we can't guarantee a working environment anytime and anywhere. Often, we only have simple personal terminals such as mobile phones or tablets. These simply cannot meet the software and secure network requirements for SSH access.

[0005] It is impossible to conduct security audits and high-risk interception measures on operation instructions;

[0006] Since direct SSH access to a target device allows for any operation, it places high demands on the operator's understanding of security and technical skills. Device security fluctuates with the operator's understanding and technical skills, making it difficult to effectively guarantee device security.

[0007] There is no unified logging system, which makes it difficult to track and troubleshoot any failures.

[0008] Direct SSH access to the target gateway device for operation, without a unified logging module, makes it difficult to restore the operator's operation site in the event of an operation failure. The resulting security issues are also difficult to track and troubleshoot. Summary of the Invention

[0009] The purpose of the present invention is to provide a web-based method and system for remote management of wide area network intelligent gateway devices to solve the problems of software and network restrictions on local devices when remotely accessing network devices, improve the security of operating remote devices, and track and analyze operation logs.

[0010] An embodiment of the present application provides a method for remote management of a wide area network intelligent gateway device based on a web, the method comprising:

[0011] Step 1: Log in to the web server. The user enters their account, password, and mobile phone verification code. The web server performs two-factor authentication using the account, password, and mobile phone verification code. After successful authentication, the web server generates a session valid for 60 minutes and an authentication token valid for 20 minutes. The token is stored in the Redis server and the token and authentication result are returned to the web front-end.

[0012] Step 2: Register the device whitelist and send a registration request to the web server with the unique ID serial number of the target smart gateway CPE;

[0013] Step 3: The smart gateway CPE reports device information. When the target smart gateway CPE device comes online, it will actively report device information to the remote server. After receiving the request, the remote server will perform a whitelist check on the unique ID serial number of the requesting device.

[0014] Step 4: Initiate a remote connection request. When the target smart gateway CPE is online, the user can initiate a remote connection request to the target CPE device through a web browser. After receiving the request, the web server will also verify the request token and request parameters. If successful, it will encapsulate the connection request and forward it to the remote server.

[0015] Step 5: Start remote operation. After receiving the remote control request, the web server will first perform token authentication, request parsing verification, and verify the target smart gateway CPE device information. It will then report the request to the logging module for recording. Once the authentication and request parsing verification pass, the web server will conduct a security audit based on the operational scope and high-risk factors of different users registered on the target smart gateway CPE device. It will block illegal and high-risk operations to ensure high security.

[0016] Step 6: Close the remote access service. When the web socket is closed or the web server user session times out, the web server will initiate a request to the remote server to close the SSH service of the remote device previously operated by the user.

[0017] Optionally, the method further includes:

[0018] Step 2.1: After receiving the registration request, the web server authenticates the request token;

[0019] Step 2.2: Request parsing and verification: the web server will parse and verify the information carried in the request header and request parameters;

[0020] Step 2.3: The remote server registers the whitelist. After receiving the request, the remote server will perform AKSK authentication on the request.

[0021] Optionally, if the token authentication is successful in step 2.1, the web server updates the current user's session and token expiration time, and continues to step 2.2. If the token authentication fails, the reason for the request failure is returned, and the request is logged and saved. If the token authentication expires, the front-end token time-out code is returned to the front-end, and the front-end obtains a token within the current validity period by requesting a token refresh, and then executes step 2.1 again.

[0022] Optionally, the method for registering the remote server in the whitelist in step 2.3 further includes:

[0023] Step 2.3.1: Remote server AKSK authentication, parse and verify the access key and access_secret carried in the registration request;

[0024] Step 2.3.2: The remote server parses and verifies the request, similar to step 2.2. The remote server parses and verifies the request route, request initiation time, request parameters, and other information carried in the request.

[0025] Optionally, if the AKSK authentication passes in step 2.3, the remote server parsing and verification request of step 2.3.2 is executed; if the AKSK authentication fails, the current request is terminated and the accounting storage is updated; if the remote server parsing and verification request passes the verification, the unique ID value serial number of the target smart gateway CPE is registered in the CPE whitelist information of the remoteserver and stored; if the remote server parsing and verification request fails the verification, the current request is terminated.

[0026] Optionally, if the whitelist check passes in step 3, the remote server receives and parses the request, updating the smart gateway IP address, online status, SSH service information, and other information on the remote server. The CPE's online status information is then fed back to the web server for storage and record. If the whitelist check fails, the remote server refuses to respond to the request and parses and stores the request source information in the log accounting module to provide data support for subsequent illegal request analysis.

[0027] Optionally, initiating the remote connection establishment request in step 4 further includes:

[0028] Step 4.1: After issuing the netconf configuration file, the remote server will first perform AKSK authentication and request parsing verification on the request after receiving the request from the web server. If the authentication passes, it will retrieve and verify the SSH service related information of the target smart gateway CPE in the remote server.

[0029] Step 4.2: Receive the Netconf configuration file. After receiving the Netconf configuration file, the target smart gateway CPE device generates a new user, "remote user," based on the configuration file's contents. It then uses autossh to configure the SSH protocol service on the smart gateway CPE device based on the reverse SSH port information in the Netconf configuration file. The remote server's public key information is then configured on the target smart gateway device. Finally, the configuration results are reported to the remote server.

[0030] Step 4.3: The remote server updates the configuration result. After receiving the configuration information reported by the target intelligent gateway CPE, the remote server updates the device information record.

[0031] Step 4.4: The web server starts the web socket service and maintains real-time communication with the web page in the browser. At the same time, the validity period of the token and session is updated in real time based on the interaction.

[0032] Optionally, if the SSH service is enabled in step 4.1, a Netconf configuration file containing information such as the remote user, password, reverse SSH port, and SSH public key of the remote server is randomly generated for the current user, and sent to the smart gateway CPE device through the Netconf protocol. The Netconf configuration information is saved in the smart gateway-related module information of the remote server for storage.

[0033] Optionally, if the configuration information reported by the target intelligent gateway CPE in step 4.3 is successful, the target intelligent gateway reports its IP address and online status to the remote server. The remote server receives the information reported by the target CPE and stores and updates the SSH-related configuration information of the target CPE on the remote server. It then times the SSH service activation status and responds to the web server with the configuration results. If no SSH operation occurs within the validity period, the remote server automatically initiates an event to clear the current user's SSH access configuration information, clearing the remote user-related configuration information and SSH reverse port information generated by the current user on the target intelligent gateway. It also clears the configuration information related to the target intelligent gateway stored by the current user on the remote server. If an SSH operation occurs within the validity period, the remote server updates the SSH validity period. If the configuration information reported by the target intelligent gateway CPE fails, the SSH configuration information of the target device generated on the remote server is cleared and the configuration results are responded to the web server.

[0034] Optionally, in step 4.4, when the session or token validity period expires, the web server will actively disconnect the web socket connection, and then initiate a service request to close the current user's SSH access to the target intelligent gateway. The remoteserver service generates a related netconf configuration file, automatically initiates an event to clear the current user's SSH access configuration information, and clears the remote user-related configuration information and SSH reverse port information generated by the current user on the target intelligent gateway CPE. At the same time, the configuration information related to the target intelligent gateway saved by the current user on the remote server is cleared.

[0035] Optionally, if a remote operation request needs to be initiated again in step 6, step 1 is repeated; if the target smart gateway CPE device has completed whitelist registration, step 2 is skipped.

[0036] Another embodiment of the present application provides a web-based system for remote management of wide area network intelligent gateway devices, characterized in that the system includes:

[0037] The task initiation module is used by the current user to initiate a remote operation request to the target smart gateway CPE device;

[0038] The web socket module is responsible for maintaining the session, issuing commands, and displaying real-time operation responses after the web server establishes a connection with the target intelligent gateway CPE.

[0039] The web server module is responsible for system access authentication, target smart gateway security whitelist entry, remote operation security audit, high-risk interception, web socket operation command encapsulation and forwarding, remote server operation echo reception and forwarding, etc.

[0040] The remote server module is responsible for receiving web server requests, requesting AKSK authentication, requesting operation parsing and verification, registering the target smart gateway CPE whitelist, generating and issuing netconf configurations, and issuing SSH remote operations.

[0041] Remote device module, the Remote device module is the target intelligent gateway CPE device, the Remote device module is responsible for receiving operation requests and responding to remote operations through the SSH protocol;

[0042] The log accounting module is used to review request accounting, analyze request logs, and troubleshoot problems. The target intelligent gateway module is mainly responsible for this.

[0043] The Redis server module is used to store and access data, including setting key-value pairs, getting key values, and deleting key values.

[0044] Compared with existing technologies, the access terminal of the present invention is no longer restricted by software and specific networks, enabling access to work anytime and anywhere. The technical solution webifies services, forwarding requests to a remote server via a web server for forwarding configuration. As long as the remote server meets the requirements of remote control software and specific networks, the access terminal only needs to meet the requirements of public network access to handle emergency events on the target intelligent gateway through the Internet terminal anytime and anywhere. This minimizes user restrictions on the terminal and maximizes the user's response efficiency to emergency events. At the same time, this solution can maximize the security of remote access to intelligent gateway devices. Through multiple security measures such as two-way authentication between the initiator and the receiver, session and token time control, AKSK authentication, nefconf protocol security technology, SSH tunneling technology, web server security operation audit scanning and verification, random SSH service configuration generated by the remote server, and SSH service time control, the security and reliability of remote access are maximized. The operation log accounting provided by this solution improves troubleshooting efficiency and provides data support for security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A schematic diagram of the architecture of a web-based wide area network intelligent gateway device remote management system provided by an embodiment of the present invention;

[0046] Figure 2 A web server login flow chart of a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention;

[0047] Figure 3 A remote CPE registration flow chart of a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention;

[0048] Figure 4 A flowchart of a request to initiate a connection for a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention;

[0049] Figure 5 A remote operation flow chart of a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention

[0050] Figure 6 A task execution flow chart of a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention

[0051] Figure 7This is a main flow chart of system task execution of a web-based wide area network intelligent gateway device remote management method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limiting the present invention.

[0053] The embodiment of the present invention first provides a web-based remote management method for a wide area network intelligent gateway device. The method can be applied to electronic devices such as computer terminals, specifically ordinary computers, quantum computers, etc.

[0054] The following describes it in detail by taking running on a computer terminal as an example.

[0055] See also Figure 1 , an embodiment of the present invention provides an error correction method for editing information based on a rich text editor, comprising Figure 1 It can be seen that the present invention mainly consists of six parts: task initiation module, web socket module, web server module, remote server module, log accounting module, and target intelligent gateway. The web socket module is mainly responsible for session maintenance, command issuance, and real-time echo of operation responses after the web server establishes a connection with the target intelligent gateway CPE. The webserver module is mainly responsible for system access authentication, target intelligent gateway security whitelist entry, remote operation security audit, high-risk interception, web socket operation command encapsulation and forwarding, remote server operation echo reception and forwarding, etc. The remoteserver module is mainly responsible for receiving web server requests, requesting AKSK authentication, request operation parsing and verification, target intelligent gateway CPE whitelist registration, netconf configuration generation, configuration issuance, ssh remote operation issuance, etc. The log accounting module is mainly responsible for request accounting review, request log analysis, troubleshooting, etc. The target intelligent gateway module is mainly responsible for receiving operation requests and responding to remote operations through the ssh protocol.

[0056] like Figure 2As shown, users must log in to the web server through a browser before performing remote operations. To ensure account security, the web server uses two-factor authentication. Users must first receive a verification code via SMS text message using the mobile phone account associated with their account. Once the account passes two-factor authentication, a corresponding token and session are generated, and the request is logged to facilitate troubleshooting and alerts. Only accounts that have successfully logged in can obtain subsequent access tokens, and the validity period of the access token and session is updated after the request verification is successful.

[0057] like Figure 3 As shown in the figure, after obtaining an access token, the user must register the target smart gateway CPE device on the whitelist. Otherwise, the remote server will deny the target smart gateway CPE access and connection. After the registration request is authenticated by the web server, its request parameters are parsed and verified, and then the registration request is sent to the remote server for registration. The remote server also performs AKSK authentication, parsing and verifying the request parameters, and then updates the remote server's device whitelist. The remote server also records and stores received requests. Once registration is complete and the target smart gateway comes online, it will proactively report device status, IP address, and other information to the remote server via the NETCONF protocol.

[0058] like Figure 4 As shown in the figure, a user initiates a connection request to an online target smart gateway device through a web server. After the remote server completes ASKS authentication and request parsing verification, it randomly generates SSH access configuration information for the target smart gateway CPE, including the remote user, password, and reverse SSH port. It then generates a Netconf configuration file and distributes it to the target smart gateway device via the Netconf protocol. The web server then enables the WebSocket service to maintain real-time interaction with the browser page.

[0059] like Figure 5As shown in the figure, after a Web Socket session is established, the user can send an SSH remote operation command to the target smart gateway CPE via the Web Socket. Upon receiving the SSH operation command, the web server performs token authentication, request parsing verification, and high-risk whitelist verification on the operation request. If all verifications pass, the request is forwarded to the remote server and the session and token validity periods are updated. The remote server then forwards the operation to the target smart gateway CPE. The CPE's operation response is reported to the web server in real time via the remote server. The web server then pushes the response to the browser page via the Web Socket in real time.

[0060] When the token or session times out, the web server and remote server trigger a timeout disconnection event. The web server disconnects the web socket service and refuses to respond to requests for tokens or sessions. The remote server automatically generates a NETCONF configuration file to clear the remote user, reverse SSH port, and other configuration information generated by the current user during the connection request, ensuring the device's security.

[0061] In an optional embodiment, the present invention takes setting the target intelligent gateway CPE configuration as an example. Figure 6 Execution flowchart and Figure 7 The embodiment is further explained shown in the main flow chart:

[0062] Step 1: Log in to web_server

[0063] The user logs in to the web server using their account, password, and mobile phone verification code. The web server then performs two-factor authentication using the account, password, and mobile phone verification code. Upon successful authentication, the web server generates a session valid for 60 minutes and an authentication token valid for 20 minutes. This token is stored in the Redis server and then returned to the web front-end along with the authentication result.

[0064] Step 2: Register device whitelist

[0065] Send a registration request with the unique ID serial number of the target intelligent gateway CPE to the web server;

[0066] Step 2.1 After receiving the registration request, the web server authenticates the request token.

[0067] If the token authentication is successful, the web server updates the current user's session and token expiration time. Go to step 2.2

[0068] If authentication fails, the reason for the request failure is returned and the request is logged and saved.

[0069] If the authentication token expires, the front-end will return a token time-out code, and the front-end will request a token refresh to obtain a token within the current validity period. Then, execute step 2.1 again.

[0070] If the authentication fails and the request is illegal, the request ends.

[0071] Step 2.2 Request parsing verification

[0072] The web server will parse and verify the information carried in the request header and the request parameters.

[0073] If the request parsing verification passes, the request is encapsulated and forwarded to the remote server to execute step 2.3

[0074] If the request parsing and verification fails, the current operation ends and the log is stored.

[0075] Step 2.3 Remote server registration whitelist

[0076] After receiving the request, the remote server will perform AKSK authentication on the request.

[0077] Step 2.3.1 Remote Server AKSK Authentication

[0078] Parse and verify the access key and access_secret carried in the registration request.

[0079] If AKSK authentication is successful, proceed to step 2.3.2 to parse the verification request

[0080] If AKSK authentication fails, the current request is terminated and the accounting storage is updated.

[0081] Step 2.3.2 Remote server parses and verifies the request

[0082] As in step 2.2, the remote server parses and verifies the request route, request initiation time, request parameters, and other information carried in the request.

[0083] If the verification passes, the unique ID value serial number of the target intelligent gateway CPE is registered and stored in the CPE whitelist information of the remoteserver.

[0084] If the verification fails, the current request is terminated.

[0085] Step 3: The smart gateway CPE reports device information

[0086] When the target smart gateway CPE device comes online, it will proactively report device information to the remote server. After receiving the request, the remote server will perform a whitelist check on the unique ID serial number of the requesting device.

[0087] If the whitelist check passes, the remote server receives and parses the request. It updates the smart gateway IP, online status, SSH service, and other information on the remote server. It also feeds the CPE's online status information back to the web server for storage.

[0088] If the whitelist check fails, the remote server refuses to respond to the current request and stores the request source information in the log accounting module. This provides data support for subsequent illegal request analysis.

[0089] Step 4: Initiate a remote connection request

[0090] When the target smart gateway CPE is online, users can initiate a remote connection request to the target CPE through a web browser. Upon receiving the request, the web server verifies the request token and parameters. If successful, it encapsulates the connection request and forwards it to the remote server.

[0091] Step 4.1: Send the netconf configuration file

[0092] After receiving the request from the web server, the remote server first performs AKSK authentication and request parsing verification on the request. If the authentication passes, the remote server retrieves and verifies the SSH service information of the target smart gateway CPE in the remote server.

[0093] If the SSH service is enabled, a Netconf configuration file is generated for the current user, including the remote user, password, reverse SSH port, and the remote server's SSH public key. This configuration file is then sent to the smart gateway CPE device via the Netconf protocol and saved in the remote server's smart gateway module information.

[0094] Step 4.2. Receive the netconf configuration file

[0095] After receiving the Netconf configuration file, the smart gateway CPE device will generate a new user remote user on the device according to the configuration file content. Then, according to the reverse SSH port information in the Netconf configuration file, it will be configured to the SSH protocol service on the smart gateway CPE device through autossh. Then, the public key information of the remote server will be configured on the target smart gateway device. Finally, the configuration results will be reported to the remote server.

[0096] Step 4.3. Remote server update configuration results

[0097] The remote server updates the device information record after receiving the configuration information reported by the target intelligent gateway CPE.

[0098] If the configuration is successful, the target intelligent gateway reports the IP address and online status of the device to the remote server. The remote server receives the information reported by the target CPE and stores and updates the SSH configuration information of the target CPE device on the remote server. It then times the SSH service activation status and responds to the web server with the configuration results. If there are no SSH operations within the valid time, the remote server automatically initiates an event to clear the current user's SSH access configuration information. The remote user-related configuration information and SSH reverse port information generated by the current user on the target intelligent gateway are cleared. At the same time, the current user's saved configuration information and the target intelligent gateway-related configuration information on the remote server are cleared. If there is an SSH operation within the valid period, the remote server updates the calculated SSH validity period.

[0099] If the configuration fails, the SSH configuration information of the target device generated on the remote server is cleared, and the configuration result is responded to the web server.

[0100] Step 4.4 web server starts web socket service

[0101] The web server will start the web socket service and maintain real-time communication with the web page in the browser. At the same time, the validity period of the token and session will be updated in real time based on the interaction.

[0102] When the session or token expires, the web server proactively disconnects the web socket connection. It then initiates a request to shut down the current user's SSH access to the target smart gateway. The remote server service generates the relevant Netconf configuration file and automatically initiates an event to clear the current user's SSH access configuration information. This clears the remote user configuration information and SSH reverse port information generated by the current user on the target smart gateway CPE. It also clears any configuration information stored on the remote server for the current user and the target smart gateway.

[0103] Step 5: Start remote operation

[0104] After receiving a remote control request, the web server first performs token authentication, request parsing verification, and verification of the target smart gateway CPE device information. It then reports the request to the logging module for recording. Once authentication and verification are successful, the web server conducts a security audit based on the operational scope and high-risk factors of each user registered with the target smart gateway CPE device. It blocks illegal and high-risk operations to ensure high operational security.

[0105] If the remote operation initiated by the current user passes the security whitelist audit of the target intelligent gateway device, the request is encapsulated and forwarded to the remote server. The operation request and response are stored in the log accounting module.

[0106] If the security audit fails, the current operation ends and the request is stored in the log accounting module.

[0107] After receiving the request, the remote server will also perform AKSK authentication, request parsing verification, and whitelist verification. It will then send the request to the target smart gateway device via the SSH protocol. The SSH protocol response will be pushed to the web server in real time, and the web server will push it to the web socket service in real time. The response will be displayed in real time on the web browser.

[0108] Step 6: Disable remote access services

[0109] When the web socket is actively closed, or the web server user session times out, the web server will proactively initiate a request to the remote server to close the remote device SSH service previously operated by the user.

[0110] After receiving the request, the remote server generates the relevant Netconf configuration file and automatically initiates an event to clear the current user's SSH access configuration information. This clears the current user's remote user configuration information and SSH reverse port information generated on the target smart gateway CPE. It also clears any configuration information saved on the remote server for the current user and the target smart gateway.

[0111] If you need to initiate remote operation again, repeat step 1. If the target smart gateway CPE device has completed whitelist registration, skip step 2.

[0112] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0113] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] In the several embodiments provided by the present invention, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the above-mentioned units is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0115] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0117] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a memory and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the above-mentioned methods of each embodiment of the present invention. The aforementioned memory includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0118] The embodiments of the present invention are described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A method for remote management of a wide area network intelligent gateway device based on a web, characterized in that: The method comprises: Step 1: Log in to the web server. This includes: the user logs in to the web server using their account, password, and mobile phone verification code. The web server performs two-factor authentication on the account, password, and mobile phone verification code. After successful authentication, the web server generates a session valid for 60 minutes and an authentication token valid for 20 minutes. The token is stored in the Redis service and the token and authentication result are returned to the web front end. Step 2: Registering the device whitelist includes: sending a registration request with the unique ID serial number of the target smart gateway CPE device to the web server; Step 3: The smart gateway CPE reports device information, including: when the target smart gateway CPE device comes online, it will actively report device information to the remote server. After receiving the request, the remote server will perform a whitelist check on the unique ID serial number of the requesting device; Step 4: Initiate a remote connection request, including: when the target smart gateway CPE device is online, the user initiates a remote connection request to the target smart gateway CPE device through a web browser. After receiving the request, the web server verifies the request token and request parameters. If successful, it encapsulates the connection request and forwards it to the remote server. Step 5: Start remote operation. This includes: After receiving the remote control request, the web server first performs token authentication, request parsing verification, and target smart gateway CPE device information verification on the request, and then reports the request to the logging module for recording. Once the authentication and request parsing verification pass, the web server performs a security audit based on the operational scope and high-risk factors of different users registered on the target smart gateway CPE device, blocking illegal and high-risk operations to ensure high security. Step 6: Close the remote access service, including: when the web socket is actively closed, or the web server user session times out, the web server will actively initiate a request to close the remote device SSH service previously operated by the user to the remote server, The initiating of the remote connection request in step 4 further includes: Step 4.1: Send the netconf configuration file, including: After receiving the request from the web server, the remote server will first perform AKSK authentication and request parsing verification on the request. If the request passes, it will retrieve and verify the SSH service related information of the target smart gateway CPE device in the remote server; Step 4.2: Receiving the Netconf configuration file includes: after receiving the Netconf configuration file, the target smart gateway CPE device generates a new user remote user on the device according to the configuration file content, then configures the reverse SSH port information in the Netconf configuration file to the SSH protocol service on the target smart gateway CPE device through autossh, then configures the public key information of the remote server on the target smart gateway CPE device, and finally reports the configuration result to the remote server; Step 4.3, the remote server updates the configuration result, including: the remote server updates the device information record after receiving the configuration result reported by the target smart gateway CPE device; Step 4.4: The web server starts the web socket service and maintains real-time communication with the web page in the browser. At the same time, the validity period of the token and session is updated in real time based on the interaction.

2. A web-based method for remote management of a wide area network intelligent gateway device according to claim 1, characterized in that: The method further comprises: Step 2.1: After receiving the registration request, the web server authenticates the request token. Step 2.2: Request parsing and verification, including: the web server will parse and verify the information carried in the request header and request parameters; Step 2.3: The remote server registers the whitelist. After receiving the request, the remote server will perform AKSK authentication on the request.

3. A web-based method for remote management of wide area network intelligent gateway devices according to claim 2, characterized in that: If the token authentication succeeds in step 2.1, the web server updates the current user's session and token expiration time, and continues to step 2.

2. If the token authentication fails, the reason for the request failure is returned and the request is logged and saved. If the token authentication expires, the front-end token time-out code is returned to the front-end, and the front-end obtains a token within the current validity period by requesting token refresh, and then executes step 2.1 again.

4. A web-based method for remote management of wide area network intelligent gateway devices according to claim 3, characterized in that: The method for registering the remote server on the whitelist in step 2.3 further includes: Step 2.3.1: Remote server AKSK authentication, including: parsing and verifying the access key and access_secret carried in the registration request; Step 2.3.2: The remote server parses and verifies the request, including: the remote server parses and verifies the request route, request initiation time, and request parameters carried in the request.

5. A web-based method for remote management of wide area network intelligent gateway devices according to claim 4, characterized in that: If the AKSK authentication passes in step 2.3, the remote server parses and verifies the request in step 2.3.

2. If the AKSK authentication fails, the current request is terminated and the accounting storage is updated. If the remote server parses and verifies the request and verifies it, the unique ID serial number of the target smart gateway CPE device is registered in the target smart gateway CPE device whitelist information of the remote server and stored. If the remote server parses and verifies the request and verifies it fails, the current request is terminated. If the whitelist verification passes in step 3, the remote server receives and parses the request, updates the smart gateway IP, online status, and SSH service information on the remote server, and feeds back the online status information of the target smart gateway CPE device to the web server for storage and record. If the whitelist verification fails, the remote server refuses to respond to the current request, and parses and stores the request source information in the log accounting module to provide data support for subsequent illegal request analysis.

6. The method for remote management of a web-based wide area network intelligent gateway device according to claim 1, characterized in that: If the SSH service is enabled in step 4.1, the remote user, password, reverse SSH port, and SSH public key information of the remote server are randomly generated for the current user to generate Netconf configuration information, which is sent to the target smart gateway CPE device through the Netconf protocol, and the Netconf configuration information is saved in the smart gateway related module information of the remote server for storage. If the configuration information reported by the target smart gateway CPE device in step 4.3 is successful, the target smart gateway CPE device reports the IP address and online status of the device to the remote server; the remote server receives the information reported by the target smart gateway CPE device and stores and updates the SSH related configuration information of the target smart gateway CPE device on the remote server, then times the SSH service enabling status and responds to the configuration result to the webserver. If there is no SSH operation within the valid time, the remote server automatically initiates an event to clear the current user's SSH access configuration information, clears the remote user related configuration information and SSH reverse port information generated by the current user on the target smart gateway CPE device, and clears the remote The configuration information related to the target smart gateway CPE device saved by the current user on the server is updated and calculated by the remote server when there is an SSH operation within the validity period. If the configuration information reported by the target smart gateway CPE device fails, the SSH configuration information of the target smart gateway CPE device generated on the remote server is cleared and the configuration result is responded to the web server.

7. A web-based method for remote management of wide area network intelligent gateway devices according to claim 6, characterized in that: In step 4.4, when the session or token expires, the web server will proactively disconnect the websocket connection and initiate a service request to close the current user's SSH access to the target smart gateway CPE device. The remote server service generates a related netconf configuration file and automatically initiates an event to clear the current user's SSH access configuration information. The remote user-related configuration information and SSH reverse port information generated by the current user on the target smart gateway CPE device are cleared. At the same time, the configuration information related to the target smart gateway CPE device and the current user's saved on the remote server is cleared. In step 5, if the remote operation request initiated by the current user passes the security whitelist audit of the target smart gateway CPE device, the remote operation request is encapsulated and forwarded to the remote server. The operation request and response are stored in the log accounting module. If the security audit fails, the current operation is terminated and the request is stored in the log accounting module.

8. A web-based method for remote management of wide area network intelligent gateway devices according to claim 7, characterized in that: After receiving the remote operation request, the remote server will also perform AKSK authentication, request parsing verification, and whitelist verification, and then send the request to the target smart gateway CPE device via the SSH protocol. The response of the SSH protocol is then pushed to the web server in real time, and the web server pushes it to the web socket service in real time, and responds to the web browser in real time. If it is necessary to initiate the remote operation request again in step 6, repeat step 1. If the target smart gateway CPE device has completed whitelist registration, skip step 2.

9. A web-based system for remote management of wide area network intelligent gateway devices, characterized in that: A method for implementing remote management of a web-based wide area network intelligent gateway device according to any one of claims 1 to 8, the system comprising: The task initiation module is used by the current user to initiate a remote operation request to the target smart gateway CPE device; The web socket module is responsible for maintaining the session, issuing commands, and displaying real-time operation responses after the web server establishes a connection with the target smart gateway CPE device; The web server module is responsible for system access authentication, target smart gateway CPE device security whitelist entry, remote operation security audit, high-risk interception, web socket operation command encapsulation and forwarding, and remote server operation echo reception and forwarding; The remote server module is responsible for receiving web server requests, requesting AKSK authentication, requesting operation parsing and verification, registering the target smart gateway CPE device whitelist, generating and issuing netconf configurations, and issuing SSH remote operations; Remote device module, the Remote device module is the target intelligent gateway CPE device, the Remotedevice module is responsible for receiving operation requests and responding to remote operations through the SSH protocol; The log accounting module is used to review request accounting, analyze request logs, and troubleshoot problems; The Redis server module is used to store and access data, including setting key-value pairs, getting key values, and deleting key values.

Images