A method, system and medium for penetrating access to multi-network area service gates

Abstract

The present invention discloses a method, system and medium for multi-network area service network gate penetration access, and relates to the field of multi-network collaborative service technology. The method deploys a border gateway TCPBoundaryBridge at the borders of major network areas to adapt to the complex government network environment. The network area application systems can still use the REST protocol to communicate with each other without worrying about the underlying network isolation mechanism. The border gateway TCPBoundaryBridge adapts to the FTP transmission protocol of the network gate, realizing the unified management of the public capability platforms and related components built in all network areas and simple, reliable and efficient network gate penetration access between systems, applications and component services across network areas.

Description

Technical Field

[0001] The present invention relates to the technical field of multi-network collaborative service, and in particular to a method, system and medium for penetrating access to a multi-network regional service network gate. Background Art

[0002] Due to the different user objects, usage scenarios and information confidentiality requirements of various government systems, various government systems and the basic component services they rely on are scattered in different network areas. There are a large number of physical isolation devices based on file ferrying between network areas. There is a lack of unified application penetration adaptation, and it is impossible to uniformly manage systems, public capabilities and components in all network areas. Reliable and efficient network gate penetration access cannot be achieved between systems, applications and component services across network areas through conventional http requests. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a method, system and medium for multi-network area service network gate penetration access, shielding the complexity brought by the underlying network architecture and the physical isolation equipment of file ferrying, and capable of reliable and efficient network gate penetration access through conventional http requests, thereby realizing service calls between physically isolated systems, applications and component services across network areas.

[0004] In a first aspect, the present invention provides a method for penetrating access to a multi-network area service network gate, which is applied between at least two network areas, including a first network area and a second network area, wherein a first gateway of the first network area is connected to a project end, and a second gateway of the second network area is connected to a component service end, and the first network area and the second network area can only transfer files through the network gate using the FTP protocol; the method comprises:

[0005] Construct tcpboundaryBridge1 in the first network area, construct tcpboundaryBridge2 in the second network area, bind the component service access path to tcpboundaryBridge2; synchronize the first sending directory in the first network area to the second receiving directory in the second network area through the network gate file ferry, and synchronize the second sending directory in the second network area to the first receiving directory in the first network area through the network gate file ferry;

[0006] tcpboundaryBridge1 includes tcpSockAgent1 and Bridge1, and tcpboundaryBridge2 includes tcpSockAgent2 and Bridge2;

[0007] tcpSockAgent1 is used to package and reorganize the http requests from the project into request commands, and parse the response command packets of Bridge1 into response result information, and then forward them to the initiator of the http request; Bridge1 is used to batch obtain the request commands of tcpSockAgent1, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packets through the FTP protocol and forward them to tcpSockAgent1;

[0008] Bridge2 is used to monitor changes in the second receiving directory of the second network area, obtain request command packets through the FTP protocol and forward them to tcpSockAgent2, and obtain response commands of tcpSockAgent2, combine them into response command packets and send them to the second sending directory of the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packets into http requests, and then convert them into execution commands and forward them to the access path bound to the component service to initiate a service call, and when receiving the results of the service request, package the response result information and reorganize it into a response command.

[0009] In a second aspect, the present invention provides a system for multi-network area service gateway penetration access, which is applied between at least two network areas, including a first network area and a second network area, wherein a first gateway of the first network area is connected to a project end, and a second gateway of the second network area is connected to a component service end, and the system comprises:

[0010] The network gate is used to transfer files between the first network area and the second network area by using the FTP protocol; the first sending directory of the first network area is synchronized to the second receiving directory of the second network area through the network gate file ferrying, and the second sending directory of the second network area is synchronized to the first receiving directory of the first network area through the network gate file ferrying;

[0011] tcpboundaryBridge1, connected to the first gateway and the network gate, includes tcpSockAgent1 and Bridge1; tcpSockAgent1 is used to package and reorganize the http request from the project into a request command, and parse the response command packet of Bridge1 into response result information, and then forward it to the http request initiator; Bridge1 is used to batch obtain the request commands of tcpSockAgent1, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packet through the FTP protocol and forward it to tcpSockAgent1;

[0012] tcpboundaryBridge2 is connected to the second gateway and the network gate, including tcpSockAgent2 and Bridge2, and the component service access path is bound to tcpboundaryBridge2; Bridge2 is used to monitor the changes of the second receiving directory of the second network area, obtain the request command packet through the FTP protocol and forward it to tcpSockAgent2, and obtain the response command of tcpSockAgent2, combine it into a response command packet and send it to the second sending directory of the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packet into an http request, and then convert it into an execution command and forward it to the access path bound to the component service to initiate a service call, and when receiving the result of the service request, package the response result information and reorganize it into a response command.

[0013] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0014] The technical solution provided in the embodiments of the present invention has at least the following technical effects:

[0015] Through tcpboundaryBridge, projects in the physically isolated first network area can call services in the second network area through regular http requests, shielding the complexity brought by the underlying network architecture and the physically isolated devices for file ferrying, and realizing transparent external release of component services, that is, reliable and efficient network gate penetration access can be performed through regular http requests, realizing service calls between physically isolated systems, applications and component services across network areas, reducing management complexity and the threshold for using service requests, and simplifying application integration development.

[0016] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0018] Figure 1 is an overall flow chart of the method in Embodiment 1 of the present invention;

[0019] Figure 2 It is a structural diagram of the system in the second embodiment of the present invention;

[0020] Figure 3Schematic diagram of the structure of the medium in the third embodiment of the present invention. DETAILED DESCRIPTION

[0021] The embodiment of the present invention provides a method, system and medium for multi-network area service network gate penetration access, shielding the complexity brought by the underlying network architecture and the physical isolation equipment of file ferrying, and realizing reliable and efficient network gate penetration access through simple http requests.

[0022] The technical solution in the embodiment of the present invention has the following general idea:

[0023] The border gateway tcpboundaryBridge is deployed at the borders of major network areas to adapt to the complex government network environment. The network area application systems can still use the rest protocol to communicate with each other (in the res protocol, the client interacts with the server through http requests), without having to worry about the underlying network isolation mechanism. The border gateway tcpboundaryBridge adapts to the private FTP transmission protocol of the network gate, shielding the complexity brought by the underlying network architecture and the physical isolation equipment of the file ferry. Reliable and efficient network gate penetration access is achieved through simple http requests, and all public capability platforms and related components built in all network areas are unified. Management and simple, reliable and efficient network gate penetration access between systems, applications and component services across network areas. Through the construction of collaborative management of multiple network area services, components scattered in various network areas can be reorganized and managed into a unified management system, which can support the release of applications / APIs in complex network environments and realize transparent external release of API services. Embodiment 1

[0024] This embodiment provides a method for penetrating access to a multi-network area service gate, such as Figure 1 As shown, it is applied between at least two network areas, including a first network area and a second network area, a first gateway of the first network area is connected to a project end, a second gateway of the second network area is connected to a component service end, and the first network area and the second network area can only transfer files through a network gate using an FTP protocol; the method includes:

[0025] Construct tcpboundaryBridge1 in the first network area, construct tcpboundaryBridge2 in the second network area, bind the component service access path to tcpboundaryBridge2; synchronize the first sending directory in the first network area to the second receiving directory in the second network area through the network gate file ferry, and synchronize the second sending directory in the second network area to the first receiving directory in the first network area through the network gate file ferry;

[0026] tcpboundaryBridge1 includes tcpSockAgent1 and Bridge1, and tcpboundaryBridge2 includes tcpSockAgent2 and Bridge2;

[0027] tcpSockAgent1 is used to package and reorganize the http requests from the project into request commands, and parse the response command packets of Bridge1 into response result information, and then forward them to the initiator of the http request; Bridge1 is used to batch obtain the request commands of tcpSockAgent1, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packets through the FTP protocol and forward them to tcpSockAgent1;

[0028] Bridge2 is used to monitor changes in the second receiving directory of the second network area, obtain request command packets through the FTP protocol and forward them to tcpSockAgent2, and obtain response commands of tcpSockAgent2, combine them into response command packets and send them to the second sending directory of the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packets into http requests, and then convert them into execution commands and forward them to the access path bound to the component service to initiate a service call, and when receiving the results of the service request, package the response result information and reorganize it into a response command.

[0029] In an example of a project requesting to call a component service, the following steps are specifically included:

[0030] S1, the project in the first network area binds the component service access path to tcpboundaryBridge2;

[0031] S2, the project sends an http request to tcpboundaryBridge1;

[0032] After receiving the http request, S3 and tcpSockAgent1 package and reassemble the http request into a Bridge1 request command;

[0033] S4. Bridge1 obtains the request commands of tcpSockAgent1 in batches by means of event monitoring and distributed timed scheduling tasks, and sends them to the first sending directory of the first network area through the FTP protocol;

[0034] S5. The network gate synchronizes the files in the first sending directory of the first network area to the second receiving directory of the second network area in a file ferrying mode;

[0035] S6. Bridge2 monitors the changes of the second receiving directory in the second network area by means of event monitoring and distributed timed scheduling tasks, obtains the request command packet through the FTP protocol and forwards it to tcpSockAgent2;

[0036] S7, tcpSockAgent2 parses the request command packet of Bridge2 into an http request;

[0037] S8, tcpSockAgent2 converts the http request into an execution command and forwards it to the access path bound to the component service to initiate a service call;

[0038] S9. After the service call is completed, tcpSockAgent2 receives the result of the service request and packages the result information into a response command of Bridge2;

[0039] S10, Bridge2 obtains the response command by means of event monitoring and distributed timed scheduling tasks, combines it into a response command packet, and sends it to the second sending directory of the second network area through the FTP protocol;

[0040] S11, the network gate synchronously transfers the files in the second sending directory of the second network area to the first receiving directory of the first network area in a file ferrying mode;

[0041] S12, Bridge1 monitors the changes of the first receiving directory in the first network area by means of event monitoring and distributed timed scheduling tasks, obtains the response command packet through the FTP protocol and forwards it to tcpSockAgent1;

[0042] S13, tcpSockAgent1 parses the response command packet of Bridge1 into response result information;

[0043] S14, tcpSockAgent1 forwards the response result information to the http request initiator, and the project completes the entire request process.

[0044] Based on the same inventive concept, the present application also provides a system corresponding to the method in Example 1, see Example 2 for details. Embodiment 2

[0045] In this embodiment, a system for penetrating access to service gates in multiple network areas is provided. Figure 2 As shown, it is applied between at least two network areas, including a first network area and a second network area, a first gateway of the first network area is connected to a project end, and a second gateway of the second network area is connected to a component service end, and the system includes:

[0046] The network gate is used to transfer files between the first network area and the second network area by using the FTP protocol; the first sending directory of the first network area is synchronized to the second receiving directory of the second network area through the network gate file ferrying, and the second sending directory of the second network area is synchronized to the first receiving directory of the first network area through the network gate file ferrying;

[0047] tcpboundaryBridge1, connected to the first gateway and the network gate, includes tcpSockAgent1 and Bridge1; tcpSockAgent1 is used to package and reorganize the http request from the project into a request command, and parse the response command packet of Bridge1 into response result information, and then forward it to the http request initiator; Bridge1 is used to batch obtain the request commands of tcpSockAgent1, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packet through the FTP protocol and forward it to tcpSockAgent1;

[0048] tcpboundaryBridge2 is connected to the second gateway and the network gate, including tcpSockAgent2 and Bridge2, and the component service access path is bound to tcpboundaryBridge2; Bridge2 is used to monitor the changes of the second receiving directory of the second network area, obtain the request command packet through the FTP protocol and forward it to tcpSockAgent2, and obtain the response command of tcpSockAgent2, combine it into a response command packet and send it to the second sending directory of the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packet into an http request, and then convert it into an execution command and forward it to the access path bound to the component service to initiate a service call, and when receiving the result of the service request, package the response result information and reorganize it into a response command.

[0049] Preferably, Bridge1 batch obtains tcpSockAgent1's request commands and changes in the first receiving directory of the first network area by means of event monitoring and distributed timed scheduling tasks; Bridge2 monitors tcpSockAgent2's response commands and changes in the second receiving directory of the second network area by means of event monitoring and distributed timed scheduling tasks.

[0050] Since the system introduced in the second embodiment of the present invention is a system used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the system based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All systems used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0051] Based on the same inventive concept, this application provides a storage medium corresponding to Example 1, see Example 3 for details. Embodiment 3

[0052] This embodiment provides a computer-readable storage medium, such as Figure 3 As shown, a computer program is stored thereon, and when the computer program is executed by a processor, any implementation method in Example 1 can be implemented.

[0053] Since the computer-readable storage medium introduced in this embodiment is a computer-readable storage medium used to implement the method in the first embodiment of the present application, based on the method introduced in the first embodiment of the present application, a person skilled in the art can understand the specific implementation of the computer-readable storage medium of the present embodiment and its various variations, so how the computer-readable storage medium implements the method in the embodiment of the present application is not described in detail here. As long as a person skilled in the art implements the computer-readable storage medium used in the method in the embodiment of the present application, it belongs to the scope of protection of the present application.

[0054] The present invention uses TCPBoundaryBridge to enable projects in a physically isolated first network area to call services in a second network area through conventional HTTP requests, shielding the complexity brought by the underlying network architecture and the physically isolated equipment for file ferrying, and realizing transparent external publishing of component services, that is, reliable and efficient network gate penetration access can be performed through conventional HTTP requests, realizing service calls between physically isolated systems, applications and component services across network areas, reducing management complexity and service request usage thresholds, and simplifying application integrated development.

[0055] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0057] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0058] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0059] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for penetrating access to service gates in multiple network areas, characterized in that: Applied between multiple network areas, including at least two first network areas and at least two second network areas, the first gateway of the first network area is connected to the project end, the second gateway of the second network area is connected to the component service end, and the first network area and the second network area can only use the FTP protocol through the network gate to transfer files; the method includes: Construct tcpboundaryBridge1 in the first network area, construct tcpboundaryBridge2 in the second network area, bind the component service access path to tcpboundaryBridge2; synchronize the first sending directory in the first network area to the second receiving directory in the second network area through the network gate file ferry, and synchronize the second sending directory in the second network area to the first receiving directory in the first network area through the network gate file ferry; tcpboundaryBridge1 includes tcpSockAgent1 and Bridge1, and tcpboundaryBridge2 includes tcpSockAgent2 and Bridge2; tcpSockAgent1 is used to package and reorganize the http requests from the project into request commands, and parse the response command packets of Bridge1 into response result information, and then forward them to the initiator of the http request; Bridge1 is used to batch obtain the request commands of tcpSockAgent1 by means of event monitoring and distributed timed scheduling tasks, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packets through the FTP protocol and forward them to tcpSockAgent1; Bridge2 is used to monitor the changes of the second receiving directory in the second network area, obtain the request command packet through the FTP protocol and forward it to tcpSockAgent2, and obtain the response command of tcpSockAgent2 through event monitoring and distributed timed scheduling tasks, combine it into a response command packet and send it to the second sending directory in the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packet into an http request, and then convert it into an execution command and forward it to the access path bound to the component service to initiate a service call, and when receiving the result of the service request, package the response result information and reorganize it into a response command; Bridge1 acquires changes in the first receiving directory in the first network area in batches by means of event monitoring and distributed timed scheduling tasks; Bridge2 monitors changes in the second receiving directory in the second network area by means of event monitoring and distributed timed scheduling tasks; When a project requests to call a component service, the following steps are included: S1, the project in the first network area binds the component service access path to tcpboundaryBridge2; S2, the project sends an http request to tcpboundaryBridge1; After receiving the http request, S3 and tcpSockAgent1 package and reassemble the http request into a Bridge1 request command; S4, Bridge1 obtains the request commands of tcpSockAgent1 in batches by means of event monitoring and distributed timed scheduling tasks, and sends them to the first sending directory of the first network area through the FTP protocol; S5. The network gate synchronizes the files in the first sending directory of the first network area to the second receiving directory of the second network area in a file ferrying mode; S6. Bridge2 monitors the changes of the second receiving directory in the second network area, obtains the request command packet through the FTP protocol, and forwards it to tcpSockAgent2; S7, tcpSockAgent2 parses the request command packet of Bridge2 into an http request; S8, tcpSockAgent2 converts the http request into an execution command and forwards it to the access path bound to the component service to initiate a service call; S9. After completing the service call, tcpSockAgent2 receives the result of the service request and packages the result information into a response command of Bridge2; S10, Bridge 2 obtains a response command, combines it into a response command packet, and sends it to a second sending directory in the second network area through the FTP protocol; S11, the network gate synchronously transfers the files in the second sending directory of the second network area to the first receiving directory of the first network area in a file ferrying mode; S12, Bridge1 monitors the changes of the first receiving directory in the first network area, obtains the response command packet through the FTP protocol and forwards it to tcpSockAgent1; S13, tcpSockAgent1 parses the response command packet of Bridge1 into response result information; S14, tcpSockAgent1 forwards the response result information to the http request initiator, and the project completes the entire request process.

2. A system for penetrating access to service gates in multiple network areas, characterized in that: Used to implement the method according to claim 1, applied between multiple network areas, including at least two first network areas and at least two second network areas, the first gateway of the first network area is connected to the project end, and the second gateway of the second network area is connected to the component service end, the system includes: The network gate is used to transfer files between the first network area and the second network area by using the FTP protocol; the first sending directory of the first network area is synchronized to the second receiving directory of the second network area through the network gate file ferrying, and the second sending directory of the second network area is synchronized to the first receiving directory of the first network area through the network gate file ferrying; tcpboundaryBridge1, connected to the first gateway and the network gate, includes tcpSockAgent1 and Bridge1; tcpSockAgent1 is used to package and reorganize the http request from the project into a request command, and parse the response command packet of Bridge1 into response result information, and then forward it to the http request initiator; Bridge1 is used to batch obtain the request commands of tcpSockAgent1, and then combine them into request command packets and send them to the first sending directory of the first network area through the FTP protocol, and monitor the changes of the first receiving directory of the first network area, and then obtain the response command packet through the FTP protocol and forward it to tcpSockAgent1; tcpboundaryBridge2 is connected to the second gateway and the network gate, including tcpSockAgent2 and Bridge2, and the component service access path is bound to tcpboundaryBridge2; Bridge2 is used to monitor the changes of the second receiving directory of the second network area, obtain the request command packet through the FTP protocol and forward it to tcpSockAgent2, and obtain the response command of tcpSockAgent2, combine it into a response command packet and send it to the second sending directory of the second network area through the FTP protocol; tcpSockAgent2 is used to parse the request command packet into an http request, and then convert it into an execution command and forward it to the access path bound to the component service to initiate the call of the service, and when receiving the result of the service request, package and reorganize the response result information into a response command; Bridge1 acquires changes of the first receiving directory in the first network area in batches by means of event monitoring and distributed timed scheduling tasks; Bridge2 monitors changes of the second receiving directory in the second network area by means of event monitoring and distributed timed scheduling tasks.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 1 is implemented.

Images