Data processing method and device, equipment and storage medium

Abstract

The application provides a data processing method and device, equipment and a storage medium. The method comprises the following steps: receiving a data processing request sent by a management server, the destination address of the data processing request being an external network virtual address of an application server, the data processing request carrying identity authentication information and first instruction information, the first instruction information being used for obtaining first target data of the application server or issuing second target data to the application server; generating second instruction information corresponding to the first instruction information, and reversely proxying the identity authentication information and the second instruction information to the application server; receiving a data processing response returned by the application server based on the second instruction information after the identity authentication information is verified successfully, wherein the data processing response comprises the first target data in the case that the first instruction information is used for obtaining the first target data; and returning the data processing response to the management server. The method realizes convenient access to data of the application server.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to a data processing method, apparatus, device, and storage medium. Background Technology

[0002] For already deployed application projects, it is often necessary to access the application server located on the internal network from the external network, for example, to extract data from the application server or to send information to the application server.

[0003] There are generally two ways to access an application server located on an internal network from the external network. One way is to modify the network of the application server to connect it to the external network. However, this method is rarely used in practice due to considerations of ease of operation and security. The other way is to reserve a call interface on the application server when deploying the application project, and access is achieved through the authentication mechanism of the interface program. However, if the requirements for accessing the application server change, the interface program needs to be modified accordingly, which is a very cumbersome process. Summary of the Invention

[0004] This application provides a data processing method, apparatus, device, and storage medium that enables data interaction between a management server and an application server, avoiding network modifications to the application server and eliminating the need to reserve calling interfaces on the application server, making it more secure and convenient.

[0005] Firstly, this application provides a data processing method, including:

[0006] The system receives a data processing request sent by the management server. The destination address of the data processing request is the external virtual address of the application server. The data processing request carries authentication information and first instruction information. The first instruction information is used to obtain the first target data of the application server or to send the second target data to the application server.

[0007] Generate second instruction information corresponding to the first instruction information, and reverse proxy the authentication information and the second instruction information to the application server;

[0008] After the application server successfully verifies the authentication information, it receives a data processing response based on the second instruction information. When the first instruction information is used to obtain the first target data, the data processing response includes the first target data.

[0009] The data processing response is returned to the management server.

[0010] Optionally, the first instruction information is encrypted information, and the step of generating second instruction information based on the first instruction information includes:

[0011] The first instruction information is decrypted, and the second instruction information is generated based on the decrypted first instruction information;

[0012] When the data processing response includes the first target data, returning the data processing response to the management server includes:

[0013] The first target data is encrypted, and the encrypted first target data is returned to the management server.

[0014] Optionally, before receiving the data processing request sent by the management server, the method further includes:

[0015] Receive an access request sent by the management server, wherein the destination address of the access request is the external virtual address of the application server;

[0016] The access request is reverse proxied to the application server.

[0017] Return the login interface to the management server and receive the login information sent by the management server;

[0018] The system receives the authentication information sent by the application server after the login information verification is successful, and then sends the authentication information to the management server.

[0019] Optionally, before returning the login interface to the management server, the method further includes:

[0020] Receive the login interface returned by the application server.

[0021] Before receiving the authentication information sent by the application server after the login information verification is successful, the method further includes:

[0022] The login information is reverse proxied to the application server.

[0023] Optionally, before returning the login interface to the management server, the method further includes:

[0024] Receive the intranet address of the CAS server returned by the application server;

[0025] The application server's internal network address is sent to the CAS server based on the CAS server's internal network address;

[0026] Receive the login interface returned by the CAS server when it is determined that the management server is not logged in.

[0027] Optionally, returning the login interface to the management server includes:

[0028] Return the login interface and the intranet address of the application server to the management server;

[0029] The receipt of login information sent by the management server includes:

[0030] Receive the login information and the intranet address of the application server sent by the management server;

[0031] Before receiving the authentication information sent by the application server after the login information verification is successful, the method further includes:

[0032] The login information and the internal network address of the application server are reverse proxied to the CAS server;

[0033] Receive the ticket information returned by the CAS server after the login information has been verified and the intranet address of the application server;

[0034] The ticket information is returned to the application server based on the application server's internal network address.

[0035] Optional, also includes:

[0036] The external virtual address of the application server is dynamically generated and sent to the management server.

[0037] Secondly, this application provides a data processing apparatus, comprising:

[0038] The receiving module is used to receive a data processing request sent by the management server. The destination address of the data processing request is the external virtual address of the application server. The data processing request carries authentication information and first instruction information. The first instruction information is used to obtain the first target data of the application server or send the second target data to the application server.

[0039] The processing module is used to generate second instruction information corresponding to the first instruction information, and to reverse proxy the authentication information and the second instruction information to the application server.

[0040] The receiving module is further configured to receive a data processing response returned by the application server based on the second instruction information after the authentication information is successfully verified, wherein the data processing response includes the first target data when the first instruction information is used to obtain the first target data.

[0041] The sending module is used to return the data processing response to the management server.

[0042] Optionally, the first instruction information is encrypted information, and the processing module is used to:

[0043] The first instruction information is decrypted, and the second instruction information is generated based on the decrypted first instruction information;

[0044] The sending module is used for:

[0045] The first target data is encrypted, and the encrypted first target data is returned to the management server.

[0046] Optionally, the receiving module is used for:

[0047] Receive an access request sent by the management server, wherein the destination address of the access request is the external virtual address of the application server;

[0048] The processing module is used to reverse proxy the access request to the application server;

[0049] The sending module is used to return the login interface to the management server, and the receiving module is used to receive the login information sent by the management server.

[0050] The receiving module is used to receive the authentication information sent by the application server when the login information verification is successful, and the sending module is used to send the authentication information to the management server.

[0051] Optionally, the receiving module is used for:

[0052] Receive the login interface returned by the application server.

[0053] The processing module is used for:

[0054] The login information is reverse proxied to the application server.

[0055] Optionally, the receiving module is used for:

[0056] Receive the intranet address of the CAS server returned by the application server;

[0057] The sending module is used to send the application server's internal network address to the CAS server based on the CAS server's internal network address;

[0058] The receiving module is used to receive the login interface returned by the CAS server when it is determined that the management server is not logged in.

[0059] Optionally, the sending module is used for:

[0060] Return the login interface and the intranet address of the application server to the management server;

[0061] The receiving module is used for:

[0062] Receive the login information and the intranet address of the application server sent by the management server;

[0063] The processing module is used for:

[0064] The login information and the internal network address of the application server are reverse proxied to the CAS server;

[0065] The receiving module is used to receive the ticket information returned by the CAS server after the login information has been verified and the intranet address of the application server.

[0066] The sending module is used to return the ticket information to the application server based on the application server's intranet address.

[0067] Optionally, the processing module is used to dynamically generate the external virtual address of the application server, and the sending module is used to send the external virtual address of the application server to the management server.

[0068] Thirdly, this application provides an electronic device, including: a memory and a processor; the memory and the processor are connected;

[0069] The memory is used to store computer programs;

[0070] The processor is configured to implement the method described in the first aspect above when a computer program is executed.

[0071] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect above.

[0072] This application provides a data processing method, apparatus, device, and storage medium, wherein a management server and a proxy server are interconnected via a network. The management server issues commands to the proxy server, which then accesses the database of the application server, thereby enabling data interaction between the management server and the application server. In this process, the application server's database does not need to be mapped to the external network, and there is no need to reserve a calling interface on the application server. Data in the application server can be securely and conveniently accessed by issuing commands from the server. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 A network topology diagram of an application server and a proxy server provided in an embodiment of this application;

[0075] Figure 2 A network connectivity diagram of an application server and a proxy server provided in an embodiment of this application;

[0076] Figure 3 This application provides a schematic diagram illustrating the deployment of a management server in an embodiment.

[0077] Figure 4 A flowchart illustrating the establishment of a data interaction path provided in this application embodiment. Figure 1 ;

[0078] Figure 5 A flowchart illustrating the establishment of a data interaction path provided in this application embodiment. Figure 2 ;

[0079] Figure 6 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0080] Figure 7 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0081] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0082] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0083] For application servers located on an intranet, if access to the application server from the external network is required—for example, to extract data from the application server's database or write data to a data block—one approach is to modify the application server's network to connect it to the external network. However, due to considerations of operational convenience and security, this approach is rarely used in practice. Another approach is to reserve a call interface on the application server during application deployment, and use the interface program's authentication mechanism to achieve access. However, if the requirements for accessing the application server change, the interface program needs to be modified accordingly, which is a very cumbersome process.

[0084] Therefore, in this embodiment of the application, reverse proxy is applied to the field of data processing. The external network access terminal serves as the management server and communicates with the application server through a programmable reverse proxy server. This method does not require major changes to the deployment structure of the application project. The application server does not need to connect to the external network or reserve a calling interface. The management server can send information to the application server and extract data from the application server, thus realizing convenient data interaction.

[0085] This application embodiment leverages the reverse proxy capabilities and programmability of a proxy server to add a reverse proxy layer outside the application server. For example, such as... Figure 1 The diagram shows the network topology of the application server and the proxy server. Figure 1 The example demonstrates multiple application servers, each capable of providing different application services. Application servers can utilize individual proxy servers, or multiple application servers can share a single proxy server. The proxy server and the application servers are located on the same network segment.

[0086] Taking an application server as an example, the application server contains a database, such as... Figure 2 As shown in the example, the application server includes an application server and a database. The proxy server can access the application server, and the application server and database can communicate with each other on the intranet. Therefore, it can be determined that the proxy server can communicate with the database on the network. Based on this, in this embodiment of the application, a management server is deployed on the external network, such as... Figure 3As shown, the management server can connect to application servers on different intranets through a proxy server. Utilizing the proxy server's programming capabilities, database access code is written and provided with a standard API. Since the management server and the proxy server are interconnected via the network and the management server can access the proxy server via the HTTP protocol, the management server can issue commands to the proxy server to access the application server's database, thus enabling data interaction between the management server and the application server. In this process, the application server's database does not need to be mapped to the external network, and no calling interface needs to be reserved on the application server. Data in the application server can be accessed securely and conveniently by issuing commands from the server. Optionally, the proxy server in this embodiment is implemented using OpenResty. By programming OpenResty in Lua language, OpenResty is given web service capabilities, allowing the management server to directly access the proxy server. Using OpenResty's programming capabilities, database access code is written on the proxy server, referred to as a probe.

[0087] The following section explains how a secure data exchange path is established between the management server, the proxy server, and the application server.

[0088] Figure 4 This is a schematic diagram illustrating a process for establishing a data interaction path, provided as an embodiment of this application. Figure 4 As shown,

[0089] S401. The management server sends an access request to the proxy server. The destination address of the access request is the external virtual address of the application server.

[0090] Optionally, to ensure the security of external network access, this embodiment can dynamically configure a reverse proxy, making the external virtual address of the application server dynamic. The proxy server dynamically generates the external virtual address of the application server and sends it to the management server. For example, this embodiment uses a virtual subdomain. The proxy server has a primary domain name pointed to by a Domain Name System (DNS), such as www.proxy.com. Based on this primary domain name, the proxy server randomly generates a secondary subdomain for each application server, such as www.122codse.proxy.com, where 122codse is randomly generated. The secondary subdomain changes every time the management server accesses the application server, and the proxy server can dynamically resolve the mapping relationship between the external virtual address and the internal address.

[0091] S402, The proxy server reverse proxies the access request to the application server.

[0092] The proxy server queries the corresponding internal address of the application server based on the external virtual address of the application server, and then reverse proxies the access request to the application server based on the internal address of the application server.

[0093] S403, The proxy server receives the login interface returned by the application server.

[0094] The application server requires login verification, so it returns the login interface to the proxy server after receiving the access request.

[0095] S404, The proxy server returns the login interface to the management server.

[0096] S405, The management server sends login information to the proxy server.

[0097] The management server sends login information to the external virtual address of the application server, i.e., the proxy server. The login information may include the username and password.

[0098] S406, The proxy server reverse proxies the login information to the application server.

[0099] S407. The application server verifies the login information and sends authentication information to the proxy server if the login information is verified.

[0100] S408, the proxy server sends the authentication information to the management server.

[0101] The authentication information serves as the credential for subsequent interactions between the management server and the application server. Based on this authentication information, a secure data exchange path is established between the management server, the proxy server, and the application server. Optionally, the application server writes the token into a cookie and sends the cookie as authentication information to the proxy server.

[0102] Apart from Figure 4 Beyond the scenario shown, in real-world projects, many applications use CAS servers for login authentication. In such scenarios, a flowchart illustrating the secure data exchange pathway between the management server, proxy server, and application server is provided. Figure 5 As shown.

[0103] S501. The management server sends an access request to the proxy server. The destination address of the access request is the external virtual address of the application server.

[0104] S502, the proxy server reverse proxies the access request to the application server.

[0105] S503, The application server sends the CAS server's internal network address to the proxy server.

[0106] When the application server uses the CAS server for login verification, upon receiving an access request, the application server instructs the proxy server to request login verification from the CAS server.

[0107] S504: The proxy server sends the application server's internal network address to the CAS server based on the CAS server's internal network address.

[0108] The proxy server sends the application server's internal network address to the CAS server so that the CAS server can verify its login.

[0109] If the S505 and CAS servers determine that the management server is not logged in, they will return the login interface to the proxy server.

[0110] Since the management server has not yet performed login verification after sending the access request, the CAS server determines that the management server is not logged in, and the refrigerator proxy server returns the login interface.

[0111] S506, the proxy server returns the login interface and the internal network address of the application server to the management server.

[0112] S507, the management server sends the login information and the application server's intranet address to the proxy server for reception.

[0113] S508, the proxy server reverse proxies the login information and the internal network address of the application server to the CAS server.

[0114] After verifying the login information, the S509 and CAS servers return ticket information and the application server's intranet address to the proxy server.

[0115] S510: The proxy server returns the ticket information to the application server based on the application server's internal network address.

[0116] S511, the application server accesses the CAS server carrying the ticket information and the application server's internal network address.

[0117] S512, the CAS server returns a response to the application server after the ticket information is verified.

[0118] S513, Logical processing of login between the application server and the management server.

[0119] For example, after a user's login is verified, the application server determines the user's permissions and, based on those permissions, determines the page to be displayed.

[0120] S514. The application server sends the authentication information and the application server's internal network address to the proxy server.

[0121] S515, the proxy server sends the authentication information to the management server.

[0122] After the user's login is verified, the application server provides the management server with the authentication information for the user's subsequent interactions, and sends it to the management server through the proxy server, thereby establishing a secure data interaction channel between the management server, the proxy server, and the application server.

[0123] Based on the authentication information provided by the application server, the management server can access the application server through the proxy server to extract data from the application server or send information to the application server. The following is an explanation.

[0124] Figure 6 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The method is executed by a proxy server. Figure 6 As shown, the method includes:

[0125] S601. Receive a data processing request sent by the management server. The destination address of the data processing request is the external virtual address of the application server. The data processing request carries authentication information and first instruction information. The first instruction information is used to obtain the first target data of the application server or to send the second target data to the application server.

[0126] After the application server provides authentication information to the management server, the management server can use this authentication information to conduct secure data interaction with the application server. The management server accesses the application server's external virtual address to make data processing requests; this external virtual address can be dynamically generated by a proxy server. The data processing request can be a request to retrieve data from the application server, or a request to send information to the application server.

[0127] Optionally, to improve security, data between the management server and the application server is transmitted in encrypted form, such as using a two-way encryption method, such as the Data Encryption Standard (DES) algorithm. The encryption algorithm is not limited in this embodiment. Optionally, the public key used for encryption by the management server and the application server can be updated each time encryption is performed.

[0128] S602. Generate second instruction information corresponding to the first instruction information, and reverse proxy the authentication information and the second instruction information to the application server.

[0129] The proxy server contains code that accesses the database, enabling it to access the application server's database. Upon receiving a first instruction, it generates a corresponding second instruction to access the database. This second instruction corresponds to the first instruction and is used to retrieve the first target data from the application server or send the second target data to the application server. The proxy server also queries the application server's internal network address based on its external virtual address, and then reverse-proxies the authentication information and the second instruction to the application server.

[0130] Optionally, if the first instruction information is encrypted, the proxy server decrypts the first instruction information and generates the second instruction information based on the decrypted first instruction information.

[0131] S603. After the application server successfully verifies the authentication information, it returns a data processing response based on the second instruction information. If the first instruction information is used to obtain the first target data, the data processing response includes the first target data.

[0132] After receiving the authentication information and the second instruction information, the application server verifies the authentication information. Upon successful verification, it processes the information based on the second instruction information. If the first instruction information is used to retrieve the first target data (i.e., the second instruction information is used to retrieve the first target data), the application server's database retrieves the first target data based on the second instruction information. Alternatively, if the first instruction information is used to send the second target data to the application server (i.e., the second instruction information is used to send the second target data to the application server), the application server's database writes the second target data to the database based on the second instruction information.

[0133] Optionally, the first instruction information is used to obtain the first target data. That is, when the data processing response includes the first target data, the proxy server encrypts the first target data and returns the encrypted first target data to the management server.

[0134] S604. Return a data processing response to the management server.

[0135] The proxy server returns the data processing response from the application server to the management server, thus completing a secure data exchange between the external network and the internal network. Optionally, if the data processing response includes encrypted first target data, the management server receives the encrypted first target data, decrypts it, and obtains the first target data.

[0136] In this embodiment, the management server and the proxy server are interconnected via the network. The management server can issue commands to the proxy server to access the database of the application server, thereby enabling data interaction between the management server and the application server. During this process, the database of the application server does not need to be mapped to the external network, and there is no need to reserve a calling interface on the application server. Data in the application server can be accessed securely and conveniently by issuing commands from the server.

[0137] Figure 7 This is a schematic diagram of the structure of a data processing device provided in the 7th embodiment of this application. Figure 7 As shown, the data processing apparatus 700 includes:

[0138] The receiving module 701 is used to receive a data processing request sent by the management server. The destination address of the data processing request is the external virtual address of the application server. The data processing request carries authentication information and first instruction information. The first instruction information is used to obtain the first target data of the application server or send the second target data to the application server.

[0139] Processing module 702 is used to generate second instruction information corresponding to the first instruction information, and to reverse proxy the authentication information and the second instruction information to the application server.

[0140] The receiving module 701 is also configured to receive a data processing response returned by the application server based on the second instruction information after the authentication information is successfully verified, wherein the data processing response includes the first target data when the first instruction information is used to obtain the first target data.

[0141] The sending module 703 is used to return a data processing response to the management server.

[0142] Optionally, the first instruction information is encrypted information, and the processing module 702 is used for:

[0143] The first instruction information is decrypted, and the second instruction information is generated based on the decrypted first instruction information;

[0144] The sending module 703 is used for:

[0145] The first target data is encrypted, and the encrypted first target data is returned to the management server.

[0146] Optionally, the receiving module 701 is used for:

[0147] Receive access requests sent by the management server. The destination address of the access request is the external virtual address of the application server.

[0148] Processing module 702 is used to reverse proxy access requests to the application server;

[0149] The sending module 703 is used to return the login interface to the management server, and the receiving module 701 is used to receive the login information sent by the management server.

[0150] The receiving module 701 is used to receive authentication information sent by the application server when the login information is verified. The sending module 703 is used to send the authentication information to the management server.

[0151] Optionally, the receiving module 701 is used for:

[0152] Receive the login interface returned by the application server.

[0153] Processing module 702 is used for:

[0154] The login information is reverse proxied to the application server.

[0155] Optionally, the receiving module 701 is used for:

[0156] Receive the internal network address of the CAS server returned by the application server;

[0157] The sending module 703 is used to send the application server's internal network address to the CAS server based on the CAS server's internal network address;

[0158] The receiving module 701 is used to receive the login interface returned by the CAS server when it is determined that the management server is not logged in.

[0159] Optionally, the sending module 703 is used for:

[0160] Return the login interface and the application server's intranet address to the management server;

[0161] The receiving module 701 is used for:

[0162] Receive login information and the application server's intranet address sent by the management server;

[0163] Processing module 702 is used for:

[0164] Reverse proxy the login information and the internal network address of the application server to the CAS server;

[0165] The receiving module 701 is used to receive the ticket information and the intranet address of the application server returned by the CAS server after the login information is verified.

[0166] The sending module 703 is used to return ticket information to the application server based on the application server's intranet address.

[0167] Optionally, the processing module 702 is used to dynamically generate the external virtual address of the application server, and the sending module 703 is used to send the external virtual address of the application server to the management server.

[0168] The data processing device provided in this embodiment can be used to implement the data processing method in the aforementioned method embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0169] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device 800 includes a memory 801, a processor 802, and a transceiver 803. The memory 801 and the processor 802 communicate with each other; for example, the memory 801, processor 802, and transceiver 803 can communicate via a communication bus 804. The memory 801 stores a computer program, and the processor 802 executes the computer program to implement the data processing method described in the above method embodiments.

[0170] Optionally, the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps in the method embodiments disclosed in this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0171] This application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods as described in any of the above method embodiments.

[0172] All or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0173] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0174] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0175] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0176] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

[0177] In this application, the term "comprising" and its variations can refer to non-limiting inclusion; the term "or" and its variations can refer to "and / or". The terms "first", "second", etc., in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

Claims

1. A data processing method, characterized by, The method is applied to a proxy server and comprises the following steps: receiving a data processing request sent by a management server, the data processing request having a destination address of a virtual external address of an application server, the data processing request carrying identity authentication information and first instruction information, the first instruction information being used to obtain first target data of the application server or to issue second target data to the application server; generating second instruction information corresponding to the first instruction information, and reverse proxying the identity authentication information and the second instruction information to the application server; receiving a data processing response returned by the application server based on the second instruction information after the identity authentication information is verified successfully, the data processing response including the first target data in the case that the first instruction information is used to obtain the first target data; returning the data processing response to the management server.

2. The method of claim 1, wherein, The first instruction information is encrypted information, and the second instruction information is generated based on the first instruction information, comprising the following steps: decrypting the first instruction information, and generating the second instruction information based on the decrypted first instruction information; in the case that the first target data is included in the data processing response, the returning of the data processing response to the management server comprises the following steps: encrypting the first target data, and returning the encrypted first target data to the management server.

3. The method of claim 1, wherein, Before the receiving of the data processing request sent by the management server, the method further comprises the following steps: receiving an access request sent by the management server, the access request having a destination address of a virtual external address of the application server; reverse proxying the access request to the application server; returning a login interface to the management server, and receiving login information sent by the management server; receiving the identity authentication information sent by the application server in the case that the login information is verified successfully, and sending the identity authentication information to the management server.

4. The method of claim 3, wherein, Before the returning of the login interface to the management server, the method further comprises the following steps: receiving the login interface returned by the application server; Before the receiving of the identity authentication information sent by the application server in the case that the login information is verified successfully, the method further comprises the following steps: reverse proxying the login information to the application server.

5. The method of claim 3, wherein, Before the returning of the login interface to the management server, the method further comprises the following steps: receiving an internal network address of a CAS server returned by the application server; sending an internal network address of the application server to the CAS server based on the internal network address of the CAS server; receiving the login interface returned by the CAS server in the case that the management server is determined to be not logged in.

6. The method of claim 5, wherein, The returning of the login interface to the management server comprises the following steps: returning the login interface and the internal network address of the application server to the management server; The receiving of the login information sent by the management server comprises the following steps: receiving the login information and the internal network address of the application server sent by the management server; The method further includes, before the receiving the identity authentication information sent by the application server in the case that the login information is verified to be correct: reverse proxying the login information and the intranet address of the application server to the CAS server; receiving the ticket information and the intranet address of the application server returned by the CAS server in the case that the login information is verified to be correct; returning the ticket information to the application server based on the intranet address of the application server.

7. The method according to any one of claims 1 to 6, characterized in that, Further includes: dynamically generating the external virtual address of the application server and sending the external virtual address of the application server to the management server.

8. A data processing apparatus, characterized by, The application is applied to a proxy server, and the device includes: a receiving module, configured to receive a data processing request sent by a management server, a destination address of the data processing request being an external virtual address of an application server, the data processing request carrying identity authentication information and first instruction information, the first instruction information being used to acquire first target data of the application server or to issue second target data to the application server; a processing module, configured to generate second instruction information corresponding to the first instruction information and to reverse proxy the identity authentication information and the second instruction information to the application server; the receiving module is further configured to receive a data processing response returned by the application server based on the second instruction information after the identity authentication information is verified to be correct, the data processing response including the first target data in the case that the first instruction information is used to acquire the first target data; a sending module, configured to return the data processing response to the management server.

9. An electronic device, comprising: includes: a memory and a processor; the memory and the processor are connected; the memory is configured to store a computer program; the processor is configured to implement the method in any one of claims 1-7 when the computer program is executed.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1-7.

Images