A method and system for controlling access rights of internal and external networks

Abstract

The present application relates to a method and system for controlling access rights of internal and external networks. The method receives data requests from external network clients through a proxy server, converts them into internal network data requests and sends them to the internal network request terminal; the internal network request terminal sends the internal network data request to the internal network server. When the external network protection mode is turned on in the internal network server and the external network detection mode is set to the message detection mode, the message data of the internal network data request is parsed and it is determined whether it includes the preset external network identification information. If so, a permission check is performed on the request from the external network client to determine whether to execute it; and no permission check is performed on the request from the internal network client, and it is directly executed. It is achieved that permission checks can be performed on external network data access in the external network protection mode, and access that does not meet the permission is rejected, thereby improving the data security of the internal network.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method and system for controlling access rights of internal and external networks. Background Art

[0002] With the advent of the big data era, data has become an important asset for enterprises, and data security is also one of the major challenges faced by enterprises. Enterprise data platforms are usually deployed in an intranet environment, allowing only intranet users to access through intranet clients, while external networks cannot access them, thereby ensuring the security of intranet data. However, in some cases, there is a need for external network access, and the data access channel needs to be opened to external network clients, but this also leads to higher data risks, which can easily lead to data leakage or illegal data operations. Summary of the invention

[0003] Based on this, the purpose of this application is to provide a method for controlling access rights of internal and external networks, so as to facilitate users to manage access rights of external network data requests and improve the data security of the internal network.

[0004] A first aspect of an embodiment of the present application provides a method for controlling access rights of an intranet and an extranet, the method comprising the following steps:

[0005] The intranet server obtains the intranet data request sent by the intranet request terminal; wherein the intranet data request is generated by the intranet request terminal according to the data request sent by the intranet client, or the intranet data request is generated by the proxy server connected to the intranet request terminal according to the data request sent by the external network client;

[0006] If the current security mode is the external network protection mode, and the current external network detection mode is the message detection mode, the internal network server parses and determines whether the message data of the internal network data request includes the preset external network identification information;

[0007] If the message data of the intranet data request includes the external network identification information, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is added by the proxy server when generating the intranet data request according to the data request of the external network client; the authority verification method is to parse the message data of the intranet data request and obtain the user identification therefrom, and determine whether the corresponding account information has access rights; if it has access rights, verify that the intranet data request satisfies the preset authority; otherwise, verify that the intranet data request does not satisfy the preset authority; or, based on the conditions in the preset whitelist or blacklist, verify whether the intranet data request satisfies the conditions in the whitelist or blacklist, thereby determining whether the intranet data request satisfies the preset authority;

[0008] If the message data of the intranet data request does not include the external network identification information, the intranet data request is executed.

[0009] A second aspect of the embodiment of the present application provides a control system for internal and external network access rights, including:

[0010] The external network client is used to send a first data request to the proxy server;

[0011] The intranet client is used to send a second data request to the intranet request end;

[0012] The proxy server is used to receive a first data request sent by an external network client, generate an intranet data request according to the first data request, and send the request to the intranet request terminal;

[0013] The intranet request end is used to receive the second data request sent by the intranet client, generate an intranet data request according to the second data request and send it to the intranet server, and receive the intranet data request sent by the proxy server and send it to the intranet server;

[0014] The intranet server is used to obtain the intranet data request sent by the intranet request end; if the current security mode is the external network protection mode, and the current external network detection mode is the message detection mode, parse and determine whether the message data of the intranet data request includes the preset external network identification information; if the message data of the intranet data request includes the external network identification information, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is generated by the proxy server according to the external network data request. Added when requesting; the permission verification method is to parse the message data of the intranet data request and obtain the user identification therefrom, determine whether the corresponding account information has access rights, and if so, verify that the intranet data request satisfies the preset permissions, otherwise verify that the intranet data request does not satisfy the preset permissions, or, based on the conditions in the preset whitelist or blacklist, verify whether the intranet data request satisfies the conditions in the whitelist or blacklist, so as to determine whether the intranet data request satisfies the preset permissions; if the message data of the intranet data request does not include the external network identification information, execute the intranet data request.

[0015] The control method of the internal and external network access rights described in the embodiment of the present application receives the data request of the external network client through the proxy server, converts it into an internal network data request and sends it to the internal network request end; forwards the internal network data request of the proxy server to the internal network server through the internal network request end, and receives the data request of the internal network client through the internal network request end, converts it into an internal network data request and sends it to the internal network server end. In the internal network server, if the user turns on the external network protection mode and sets the external network detection mode to the message detection mode, the received internal network data request is parsed and it is determined whether the message data includes the preset external network identification information. If so, it is determined that the internal network data request is from the external network client, otherwise it is determined to be from the internal network client. Furthermore, the request from the external network client will be checked for permissions, and it will only be executed if the permission check passes, otherwise it will not be executed; and the request from the internal network client will not be checked for permissions, and it will be directly executed. It is realized that permission checks can be performed on external network data access in the external network protection mode, and access that does not meet the permissions is rejected, thereby improving the data security of the internal network.

[0016] For better understanding and implementation, the present application is described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of an application scenario of the method for controlling access rights of internal and external networks according to an embodiment of the present application;

[0018] Figure 2 A flowchart of a method for controlling intranet and extranet access rights according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present application clearer, the embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings. Wherein, when the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements.

[0020] It should be clear that the implementation methods described in the embodiments described below do not represent all implementation methods consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0021] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application are also intended to include plural forms, unless the context clearly indicates other meanings. In addition, in the description of this application, unless otherwise specified, "multiple" refers to two or more. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more associated listed items, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone; the character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0022] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, such information should not be limited to these terms, and these terms are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. Depending on the context, the words "if" / "if" used in the present application can be interpreted as "at the time of" or "when" or "in response to determination".

[0023] With the advent of the big data era, data has become an important asset for enterprises, and data security is also one of the important problems faced by enterprises. Enterprise data platforms are usually deployed in an intranet environment, and only allow intranet users to access through the intranet client, while the extranet cannot access, thereby ensuring the data security of the intranet. However, in some cases there is a need for extranet access, and the data access channel needs to be opened to the extranet client, but this also leads to higher data risks, which can easily cause data leakage or illegal operation of data. In this regard, the embodiment of the present application provides a method for controlling internal and external network access rights to improve the data security of the intranet.

[0024] Please refer to Figure 1 , Figure 1 This is a schematic diagram of an application scenario of the method for controlling intranet and extranet access rights in an embodiment of the present application, wherein the application scenario includes an extranet client 101, an intranet client 102, a proxy server 103, an intranet request terminal 104, and an intranet server 105.

[0025] Among them, the external network client 101 and the internal network client 102 are clients in the external network (public network) and the internal network (enterprise internal LAN) respectively. When accessing the data of the internal network server 104, they can issue an access request through the desktop client program provided by the data platform, or through a browser web page.

[0026] The proxy server 103 is a service module that realizes communication between the external network and the internal network. It communicates in the external network through an externally open network communication interface, and communicates in the internal network through an internal network communication interface.

[0027] The intranet requester 104 is a communication module dedicated to intranet communication, which establishes communication transmission between the intranet client 102, the proxy server 103 and the intranet server 105, and can be a network router of the intranet. In this embodiment, the intranet requester 104 and the intranet server 105 preferably use encrypted transmission, for example, using a hash algorithm to encrypt the transmitted data. This ensures that external network devices cannot directly access the intranet server 105, thereby ensuring the security of the intranet server 105.

[0028] The intranet server 105 is a service module that processes intranet data requests. It may be a service module that stores business data itself, or it may be a service module that does not store business data but is connected to a database that stores business data.

[0029] In this embodiment, the external network client 101, the internal network client 102, the proxy server 103, the internal network request terminal 104 and the internal network server 105 are essentially computer devices.

[0030] Please refer to Figure 2 The present application provides a method for controlling access rights of internal and external networks, the method comprising the following steps:

[0031] S101: The intranet server obtains an intranet data request sent by the intranet request terminal; wherein the intranet data request is generated by the intranet request terminal according to the data request sent by the intranet client, or the intranet data request is generated by a proxy server connected to the intranet request terminal according to the data request sent by the external network client;

[0032] S102: If the current security mode is the external network protection mode, and the current external network detection mode is the message detection mode, the internal network server parses and determines whether the message data of the internal network data request includes the preset external network identification information;

[0033] S103: If the message data of the intranet data request includes the external network identification information, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is added by the proxy server when generating the intranet data request according to the data request of the external network client;

[0034] S104: If the message data of the intranet data request does not include the external network identification information, execute the intranet data request.

[0035] The control method of the internal and external network access rights described in the embodiment of the present application receives the data request of the external network client through the proxy server, converts it into an internal network data request and sends it to the internal network request end; forwards the internal network data request of the proxy server to the internal network server through the internal network request end, and receives the data request of the internal network client through the internal network request end, converts it into an internal network data request and sends it to the internal network server end. In the internal network server, if the user turns on the external network protection mode and sets the external network detection mode to the message detection mode, the received internal network data request is parsed and it is determined whether the message data includes the preset external network identification information. If so, it is determined that the internal network data request is from the external network client, otherwise it is determined to be from the internal network client. Furthermore, the request from the external network client will be checked for permissions, and it will only be executed if the permission check passes, otherwise it will not be executed; and the request from the internal network client will not be checked for permissions, and it will be directly executed. It is realized that permission checks can be performed on external network data access in the external network protection mode, and access that does not meet the permissions is rejected, thereby improving the data security of the internal network.

[0036] In step S101, the intranet server obtains the intranet data request sent by the intranet requester.

[0037] Among them, the intranet data request is a data request for transmission in the intranet. In one embodiment, the intranet data request adopts a data format customized by the intranet. The intranet server parses the intranet data request according to the parsing method corresponding to the intranet customized data format. Data requests that do not conform to the intranet customized data format will not be executed, thereby ensuring that only intranet data requests can access the data of the intranet server.

[0038] In this embodiment, the intranet data request can be sent by the intranet client to the intranet request end, which is generated by the intranet request end in accordance with the intranet custom data format and sent to the intranet server; or it can be sent by the external network client to the proxy server, which is generated by the proxy server in accordance with the intranet custom data format and sent to the intranet request end, and the intranet request end forwards the intranet data request of the proxy server to the intranet server.

[0039] In this embodiment, the intranet request end communicates with the intranet client and the proxy server through different communication ports, thereby distinguishing the request from the intranet client and the request from the proxy server according to the communication port, and performing different processing respectively. Among them, the request of the intranet client regenerates the intranet data request, and the IP address of the intranet data request is the IP address of the intranet request end or the IP address of the intranet client (depending on whether the intranet request end changes the intranet client IP to the intranet request end IP when generating the intranet data request). The request of the proxy server is directly forwarded to the intranet server, and the IP address is still the IP address of the proxy server.

[0040] In one embodiment, after the step S101 in which the intranet server obtains the intranet data request sent by the intranet request terminal, the following steps are included:

[0041] Step S1011, determining whether the security mode is on, and if on, determining whether the current security mode is an external network protection mode or a full network protection mode;

[0042] The method further comprises the steps of:

[0043] Step S1012: If the security mode is not enabled, the intranet data request is executed.

[0044] In this embodiment, the intranet server allows users to set the security mode, and the security mode can be set to the external network protection mode or the full network protection mode. If the security mode is turned on and the external network protection mode or the full network protection mode is set, the intranet server will perform security protection on the intranet data request, and perform permission check on the intranet data request or all intranet data requests from the external network client. For details, please refer to the subsequent description. If the security mode is turned off, the intranet server will not perform security protection on the intranet data request, and all intranet data requests will be directly executed without permission check.

[0045] For step S102, if the current security mode is the external network protection mode, and the current external network detection method is the message detection method, the internal network server parses and determines whether the message data of the internal network data request includes the preset external network identification information.

[0046] In this embodiment, the intranet server turns on and sets the security mode to the external network protection mode. In the external network protection mode, the intranet server will identify whether the intranet data request comes from the external network client or the intranet client, and the identification method can be set to the message detection method. In the message detection method, if it is detected that the message data of the intranet data request includes the preset external network identification information, it is determined that the request is from the external network client, otherwise it is from the intranet client. Among them, the external network identification information is added by the proxy server when receiving the data request from the external network client and generating the intranet data request, that is, if the intranet client sends the intranet data request through the intranet request terminal, there will be no external network identification information.

[0047] In another embodiment, if the current security mode is not an external network protection mode but a full network protection mode, the intranet server treats requests from external network clients and internal network clients equally, and both require permission checks. Therefore, there is no need to identify whether the intranet data request is from an external network client or an intranet client, but directly enters the permission check step to verify whether the intranet data request meets the preset permissions. If the verification meets the preset permissions, the intranet data request is executed, otherwise it is not executed.

[0048] In one embodiment, the method further comprises the steps of:

[0049] Step S201, the intranet server responds to the message detection mode setting instruction, sets the current external network detection mode to the message detection mode, and sends a first synchronization setting instruction to the proxy server;

[0050] Step S202, the proxy server responds to the first synchronization setting instruction and sets the current external network identification mode to the message identification mode; in the message identification mode, when receiving a data request sent by the external network client, the data request is parsed to obtain the message data and the preset external network identification information is added to the message data, and an internal network data request is generated according to the message data with the external network identification information added and sent to the internal network server.

[0051] The external network identification information may be any form of information having an identification function. For example, a custom request header may be added to the message data and a preset parameter value may be assigned as the external network identification information.

[0052] In this embodiment, the external network detection mode of the internal network server is set to the message detection mode, and the internal network server will send a first synchronization setting instruction to the proxy server, so that the proxy server also synchronously sets the external network identification mode to the message identification mode. Then, when the proxy server receives the data request from the external network client and generates an internal network data request, it will add the preset external network identification information to the message data. When the internal network server parses the request from the external network client, it will parse the external network identification information, thereby determining that the request is from the external network client.

[0053] In another embodiment, the external network detection method of the intranet server can adopt an IP address detection method in addition to the message detection method. Specifically, the method further includes the steps of:

[0054] Step S301, the intranet server responds to the IP detection mode setting instruction, sets the current external network detection mode to the IP detection mode, and sends a second synchronization setting instruction to the proxy server;

[0055] Step S302, the proxy server responds to the second synchronization setting instruction and sets the current external network identification mode to the IP identification mode; under the IP identification mode, when receiving a data request sent by the external network client, the data request is parsed to obtain message data, and an internal network data request is generated according to the message data and sent to the internal network server.

[0056] In this embodiment, the external network detection mode of the intranet server is set to the IP detection mode, and the intranet server will send a second synchronization setting instruction to the proxy server, so that the proxy server sets the external network identification mode to the IP identification mode. Then, when the proxy server generates an intranet data request based on the data request of the external network client, there is no need to add the preset external network identification information to the message data. The intranet server will directly determine whether the source IP address of each intranet data request is the proxy server IP address, thereby determining whether the request comes from the external network client.

[0057] In one embodiment, after the intranet server obtains the intranet data request sent by the intranet request terminal in step S101, the following steps are further included:

[0058] Step S303, if the current security mode is the external network protection mode, and the current external network detection mode is the IP detection mode, the internal network server parses and determines whether the source IP address of the internal network data request is the preset proxy server IP address;

[0059] Step S304: if the source IP address of the intranet data request is the proxy server IP address, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute;

[0060] Step S305: If the source IP address of the data request is not the proxy server IP address, execute the intranet data request.

[0061] In this embodiment, the intranet server, in the IP detection mode, determines whether the request comes from the proxy server based on whether the source IP address obtained by parsing is the proxy server IP address when receiving the intranet data request, thereby determining whether it comes from the external network client. The subsequent permission inspection steps are the same as those in other embodiments and are not described in detail.

[0062] For step S103, if the message data of the intranet data request includes the external network identification information, verify whether the intranet data request meets the preset authority; if it is verified that the intranet data request meets the preset authority, execute the intranet data request, otherwise do not execute.

[0063] As described above, when the security mode is the external network protection mode and the external network detection method is the message detection method, if the message data of the internal network data request includes the external network identification information, it means that the internal network data request comes from the external network client, so permission check is required.

[0064] Among them, the permission verification method can be set according to the situation. In one embodiment, the permission verification method can be to parse the message data of the intranet data request and obtain the user identification therefrom, determine whether the corresponding account information has access rights, and if it has access rights, verify that the intranet data request meets the preset permissions, otherwise verify that the intranet data request does not meet the preset permissions. In another embodiment, the permission verification method can be based on the conditions in a preset whitelist or blacklist, verify whether the intranet data request meets the conditions in the whitelist or blacklist, for example, verify whether the data request path information in the intranet data request matches the data request path recorded in the whitelist or blacklist, thereby determining whether the intranet data request meets the permissions.

[0065] In this embodiment, the intranet server performs permission verification based on the whitelist and the blacklist, and the user can set the permission verification mode in the intranet server, and the permission verification mode can be set to a whitelist priority mode or a blacklist priority mode.

[0066] When the permission verification mode is set to the whitelist priority mode, the step of verifying whether the intranet data request satisfies the preset permission in step S103 includes:

[0067] Step S1031, determining whether the intranet data request meets a preset whitelist condition; if the intranet data request does not meet the whitelist condition, determining that the intranet data request does not meet the preset authority;

[0068] Step S1032, if the intranet data request meets the whitelist condition, determine whether the intranet data request meets the preset blacklist condition: if it does not meet the blacklist condition, determine whether the intranet data request meets the preset authority; if it meets the blacklist condition, determine whether the intranet data request does not meet the preset authority.

[0069] The whitelist records information about access requests with higher security, and is used to identify reliable access requests. The blacklist records information about access requests with lower security, and is used to identify access requests that need to be restricted. The specific settings can be made by the user according to the situation.

[0070] Among them, judging whether the preset whitelist conditions are met refers to judging whether the authorization conditions in the preset whitelist are met. Similarly, judging whether the preset blacklist conditions are met refers to judging whether the restricted access conditions in the preset blacklist are met.

[0071] In the whitelist priority mode of this embodiment, as long as the whitelist conditions are not met, it will definitely not be passed and executed. Even if the whitelist conditions are met, but the blacklist conditions are also met, it will not be passed and executed. Only in one case, that is, the whitelist conditions are met and the blacklist conditions are not met, can it be passed and executed. Obviously, the whitelist priority mode of this embodiment is relatively strict, and the user's access request is not easy to access successfully, but it has a higher safety factor for the security of intranet data.

[0072] When the permission verification mode is set to the blacklist priority mode, the step of verifying whether the intranet data request satisfies the preset permission in step S103 includes:

[0073] Step S1033, determining whether the intranet data request satisfies a preset blacklist condition; if the intranet data request does not satisfy the blacklist condition, determining whether the intranet data request satisfies a preset permission;

[0074] Step S1034, if the intranet data request meets the blacklist condition, determine whether the intranet data request meets the preset whitelist condition: if it meets the whitelist condition, determine whether the intranet data request meets the preset authority; if it does not meet the whitelist condition, determine whether the intranet data request does not meet the preset authority.

[0075] In this embodiment, in the blacklist priority mode, there is only one case where execution is not allowed, that is, the blacklist condition is met and the whitelist condition is not met. Otherwise, execution is allowed. Obviously, compared with the whitelist priority mode, the permission check in the blacklist priority mode is more relaxed, and the user's access request has a greater probability of being successfully accessed. Of course, this is a lower safety factor for intranet data security.

[0076] In one embodiment, the message data of the intranet data request includes data request path information and parameter information; the step of determining whether the intranet data request satisfies a preset blacklist condition / whitelist condition includes:

[0077] If the data request path information of the intranet data request matches the data path information of any permission information recorded in the preset blacklist / whitelist, and the parameter information of the intranet data request meets the parameter condition of the corresponding permission information, then it is judged that the intranet data request meets the preset blacklist condition / whitelist condition; otherwise, it is judged that the intranet data request does not meet the preset blacklist condition / whitelist condition.

[0078] The preset blacklist and whitelist respectively record several pieces of permission information, each piece of permission information includes data request path information and parameter conditions. For example, if the data request path information recorded in the whitelist is " / vision / t?st.jsp", it can be matched with the request path information such as " / vision / test.jsp" or " / vision / tast.jsp" in the access request; and generally speaking, the data request path is bound with corresponding parameters, for example, the parameters corresponding to the data request path " / vision / RMIServlet" usually include the three parameters "className, methodName, params", therefore, conditional expressions can be set for these parameters as parameter conditions.

[0079] In this embodiment, permission information is recorded in the whitelist and blacklist respectively. Each piece of permission information includes data request path information and parameter conditions, so as to match the user's access request path and judge whether the parameters meet the corresponding parameter conditions to determine whether the user's access request is within the authorized access of the whitelist or the restricted access of the blacklist.

[0080] For step S104, if the message data of the intranet data request does not include the external network identification information, the intranet data request is executed.

[0081] As described above, when the security mode is the external network protection mode and the external network detection method is the message detection method, if the message data of the internal network data request does not include the external network identification information, it means that the internal network data request comes from the internal network client, so no permission check is required.

[0082] In one embodiment, the step of executing the intranet data request by the intranet server includes:

[0083] The intranet server generates a request result in response to the intranet data request and sends it to the intranet requester;

[0084] The method further comprises the steps of:

[0085] Step S104, the intranet request end receives the request result and sends it to the intranet client or proxy server corresponding to the intranet data request;

[0086] Step S105: If the proxy server receives the request result sent by the intranet requester, the proxy server sends the request result to the extranet client.

[0087] In this embodiment, the intranet server generates a request result in response to the intranet data request and sends it to the intranet request terminal, which then sends it to the corresponding intranet client or proxy server. When the proxy server receives the request result sent by the intranet request terminal, it sends the request result to the external client, thereby completing the access process of the external client.

[0088] Please continue to refer to Figure 1 , the present application also provides a control system for internal and external network access rights, including:

[0089] The external network client 101 is used to send a first data request to the proxy server;

[0090] The intranet client 102 is used to send a second data request to the intranet request end;

[0091] The proxy server 103 is used to receive a first data request sent by an external network client, generate an intranet data request according to the first data request, and send the request to the intranet request end;

[0092] The intranet request end 104 is used to receive the second data request sent by the intranet client, generate an intranet data request according to the second data request and send it to the intranet server, and receive the intranet data request sent by the proxy server and send it to the intranet server;

[0093] The intranet server 105 is used to obtain the intranet data request sent by the intranet request end; if the current security mode is the external network protection mode, and the current external network detection method is the message detection method, parse and determine whether the message data of the intranet data request includes the preset external network identification information; if the message data of the intranet data request includes the external network identification information, verify whether the intranet data request meets the preset authority; if it is verified that the intranet data request meets the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is added by the proxy server when generating the intranet data request according to the external network data request; if the message data of the intranet data request does not include the external network identification information, execute the intranet data request.

[0094] It should be noted that the control system for internal and external network access rights of this embodiment belongs to the same technical concept as the control method for internal and external network access rights of the above embodiment. Relevant explanations and further limitations can be found in the above embodiment and will not be elaborated here.

[0095] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present application, and the present application is also intended to include such modifications and modifications.

Claims

1. A method for controlling access rights of internal and external networks, characterized in that: The method comprises the following steps: The intranet server obtains the intranet data request sent by the intranet request terminal; wherein the intranet data request is generated by the intranet request terminal according to the data request sent by the intranet client, or the intranet data request is generated by the proxy server connected to the intranet request terminal according to the data request sent by the external network client; If the current security mode is the external network protection mode, and the current external network detection mode is the message detection mode, the internal network server parses and determines whether the message data of the internal network data request includes the preset external network identification information; If the message data of the intranet data request includes the external network identification information, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is added by the proxy server when generating the intranet data request according to the data request of the external network client; the authority verification method is to parse the message data of the intranet data request and obtain the user identification therefrom, and determine whether the corresponding account information has access rights; if it has access rights, verify that the intranet data request satisfies the preset authority; otherwise, verify that the intranet data request does not satisfy the preset authority; or, based on the conditions in the preset whitelist or blacklist, verify whether the intranet data request satisfies the conditions in the whitelist or blacklist, thereby determining whether the intranet data request satisfies the preset authority; If the message data of the intranet data request does not include the external network identification information, the intranet data request is executed.

2. The method for controlling the access rights of internal and external networks according to claim 1, characterized in that: After the step of the intranet server obtaining the intranet data request sent by the intranet request terminal, the following steps are included: If the current security mode is the full network protection mode, the intranet server verifies whether the intranet data request meets the preset permissions. If the verification satisfies the preset permissions, the intranet data request is executed.

3. The method for controlling the access rights of internal and external networks according to claim 2, characterized in that: After the step of the intranet server obtaining the intranet data request sent by the intranet request terminal, the following steps are included: Determine whether the security mode is on. If it is on, determine whether the current security mode is an external network protection mode or a full network protection mode. The method further comprises the steps of: If the security mode is not enabled, the intranet data request is executed.

4. The method for controlling the access rights of internal and external networks according to any one of claims 1 to 3, characterized in that: The method further comprises the steps of: The intranet server, in response to the message detection mode setting instruction, sets the current external network detection mode to the message detection mode, and sends a first synchronization setting instruction to the proxy server; The proxy server responds to the first synchronization setting instruction and sets the current external network identification mode to the message identification mode; in the message identification mode, when receiving a data request sent by an external network client, the data request is parsed to obtain message data and the preset external network identification information is added to the message data, and an internal network data request is generated based on the message data with the external network identification information added and sent to the internal network server.

5. The method for controlling the access rights of internal and external networks according to any one of claims 1 to 3, characterized in that: After the step of the intranet server obtaining the intranet data request sent by the intranet request terminal, the step further includes: If the current security mode is the external network protection mode, and the current external network detection mode is the IP detection mode, the internal network server parses and determines whether the source IP address of the internal network data request is the preset proxy server IP address; If the source IP address of the intranet data request is the proxy server IP address, verify whether the intranet data request satisfies the preset authority; If it is verified that the intranet data request satisfies the preset authority, the intranet data request is executed, otherwise it is not executed; If the source IP address of the data request is not the proxy server IP address, the intranet data request is executed.

6. The method for controlling the access rights of internal and external networks according to claim 5, characterized in that: The method further comprises the steps of: The intranet server, in response to the IP detection mode setting instruction, sets the current external network detection mode to the IP detection mode, and sends a second synchronization setting instruction to the proxy server; The proxy server responds to the second synchronization setting instruction and sets the current external network identification mode to the IP identification mode; under the IP identification mode, when receiving a data request sent by the external network client, it parses the data request to obtain message data, generates an internal network data request based on the message data and sends it to the internal network server.

7. The method for controlling the access rights of internal and external networks according to claim 1, characterized in that: When the current permission verification mode is the whitelist priority mode, the step of verifying whether the intranet data request satisfies the preset permission includes: Determine whether the intranet data request meets the preset whitelist conditions, and if the intranet data request does not meet the whitelist conditions, determine that the intranet data request does not meet the preset permissions; If the intranet data request meets the whitelist conditions, determine whether the intranet data request meets the preset blacklist conditions: if it does not meet the blacklist conditions, determine whether the intranet data request meets the preset permissions; if it meets the blacklist conditions, determine whether the intranet data request does not meet the preset permissions.

8. The method for controlling the access rights of internal and external networks according to claim 1, characterized in that: When the current permission verification mode is the blacklist priority mode, the step of verifying whether the intranet data request satisfies the preset permission includes: Determine whether the intranet data request satisfies a preset blacklist condition, and if the intranet data request does not satisfy the blacklist condition, determine whether the intranet data request satisfies a preset permission; If the intranet data request meets the blacklist conditions, determine whether the intranet data request meets the preset whitelist conditions: if the whitelist conditions are met, determine that the intranet data request meets the preset permissions; if the whitelist conditions are not met, determine that the intranet data request does not meet the preset permissions.

9. The method for controlling the access rights of internal and external networks according to claim 7 or 8, characterized in that: The message data of the intranet data request includes data request path information and parameter information; the step of determining whether the intranet data request satisfies a preset blacklist condition / whitelist condition includes: If the data request path information of the intranet data request matches the data path information of any permission information recorded in the preset blacklist / whitelist, and the parameter information of the intranet data request satisfies the parameter condition of the corresponding permission information, then it is judged that the intranet data request satisfies the preset blacklist condition / whitelist condition, otherwise it is judged that the intranet data request does not satisfy the preset blacklist condition / whitelist condition; wherein the preset blacklist and whitelist respectively record several pieces of permission information, and each piece of permission information includes data request path information and parameter conditions.

10. The method for controlling the access rights of internal and external networks according to claim 1, characterized in that: The step of the intranet server executing the intranet data request includes: The intranet server generates a request result in response to the intranet data request and sends it to the intranet requester; The method further comprises the steps of: The intranet request end receives the request result and sends it to the intranet client or proxy server corresponding to the intranet data request; If the proxy server receives the request result sent by the intranet requester, it sends the request result to the extranet client.

11. A control system for internal and external network access rights, characterized in that: include: The external network client is used to send a first data request to the proxy server; The intranet client is used to send a second data request to the intranet request end; The proxy server is used to receive a first data request sent by an external network client, generate an intranet data request according to the first data request, and send the request to the intranet request terminal; The intranet request end is used to receive the second data request sent by the intranet client, generate an intranet data request according to the second data request and send it to the intranet server, and receive the intranet data request sent by the proxy server and send it to the intranet server; The intranet server is used to obtain the intranet data request sent by the intranet request end; if the current security mode is the external network protection mode, and the current external network detection mode is the message detection mode, parse and determine whether the message data of the intranet data request includes the preset external network identification information; if the message data of the intranet data request includes the external network identification information, verify whether the intranet data request satisfies the preset authority; if it is verified that the intranet data request satisfies the preset authority, execute the intranet data request, otherwise do not execute; wherein the external network identification information is generated by the proxy server according to the external network data request. Added when requesting; the permission verification method is to parse the message data of the intranet data request and obtain the user identification therefrom, determine whether the corresponding account information has access rights, and if so, verify that the intranet data request satisfies the preset permissions, otherwise verify that the intranet data request does not satisfy the preset permissions, or, based on the conditions in the preset whitelist or blacklist, verify whether the intranet data request satisfies the conditions in the whitelist or blacklist, so as to determine whether the intranet data request satisfies the preset permissions; if the message data of the intranet data request does not include the external network identification information, execute the intranet data request.

Images