Resource access method, system and equipment based on SSLVPN (Secure Socket Layer Virtual Private Network) and medium

Abstract

The invention relates to the technical field of SSLVPN (Secure Socket Layer Virtual Private Network), in particular to an SSLVPN-based resource access method, system and equipment and a medium. The method comprises the following steps: firstly, generating a first key pair in an SSLVPN key negotiation stage, additionally generating a second key item to encrypt application traffic used at high frequency, then sorting the encrypted application traffic to generate an encrypted resource traffic table, then judging whether a current requested access resource exists in the encrypted resource traffic table, and if yes, sending the current requested access resource to the server; the method comprises the following steps of: receiving a resource usage count, judging an encryption mode according to the resource usage count, the user number, a set system configuration parameter and a set user number check value, forwarding an encrypted requested access resource, and finally decrypting the encrypted requested access resource to obtain an access resource, so that the adjustment of security balance is realized while ensuring that a client accesses high-frequency usage flow; the high-frequency resources accessed by the client are encrypted by using the shared key in advance, and are directly used during subsequent access, so that the flow forwarding performance is improved, and the consumption of encrypting the resources is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of SSLVPN, and in particular to a resource access method, system, device and medium based on SSLVPN. Background Art

[0002] SSLVPN tunnel technology is one of the most commonly used technologies for zero trust today. It is widely used in scenarios where mobile terminals access internal resources of companies or groups. However, in actual use, it is often found that when a large number of mobile terminals access internal resources at the same time, there will be problems with slow resource access or even freezes, which in turn affects people's normal work or business using SSLVPN. The reason is that the forwarding performance of the SSLVPN gateway is seriously reduced when encrypting and decrypting traffic when forwarding traffic. Therefore, how to solve the problem of serious reduction in forwarding performance caused by the existing SSLVPN technology when encrypting and decrypting traffic when forwarding traffic has become the key to solving the problem.

[0003] Existing solutions:

[0004] Method 1: SSLVPN gateway device hardware upgrade. This method proposes a solution using hardware technology from a hardware perspective. The specific solution is: using a dedicated SSL acceleration hardware device to separate the SSL encryption and decryption work from the SSLVPN gateway device to improve the performance of SSLVPN. This method achieves the purpose of improving the performance of SSLVPN by using a dedicated SSL acceleration hardware device to separate the SSL encryption and decryption work from the SSLVPN gateway device. However, because of the use of dedicated hardware devices, the hardware cost of the function has increased significantly, increasing the cost of use. In addition, when the hardware fails, the SSLVPN function itself cannot be used, increasing the technical risk.

[0005] Method 2: Use load balancing of multiple SSLVPN gateways. Use load balancing technology to distribute user requests to multiple SSLVPN gateway devices to achieve load balancing and traffic sharing, and improve overall processing power and throughput. This method uses load balancing technology to dynamically distribute SSLVPN client requests to different SSLVPN gateway devices, thereby achieving the purpose of improving SSLVPN performance. However, by increasing the number of SSLVPN gateways, the complexity of customer network topology is increased, and network maintenance is more complicated. Secondly, the degree of SSLVPN performance improvement is highly dependent on the intelligence of the load balancing algorithm, which increases the uncertainty of gateway performance, and finally increases the cost of the project to a certain extent. Summary of the invention

[0006] Aiming at the problem that the forwarding performance of the existing SSLVPN technology is seriously degraded when encrypting and decrypting traffic when forwarding traffic, the present invention proposes a resource access method, system, device and medium based on SSLVPN; the method first generates a first key pair in the SSLVPN key negotiation stage, and additionally generates a second key pair to encrypt the application traffic with high frequency use; secondly, the encrypted application traffic is sorted to generate an encrypted resource flow table; then, it is determined whether the currently requested access resource exists in the encrypted resource flow table; the encryption mode is determined according to the resource usage count, the number of users, the set system configuration parameters and the set user number check value; the encrypted requested access resource is forwarded; finally, the encrypted requested access resource is decrypted to obtain the access resource; while ensuring that the client accesses the high frequency use traffic, the balance between the forwarding performance and the security of the gateway is adjusted.

[0007] The specific implementation contents of the present invention are as follows:

[0008] A resource access method based on SSLVPN, firstly, generates a first key pair in the SSLVPN key negotiation phase, and additionally generates a second key pair to encrypt high-frequency application traffic, then sorts the encrypted application traffic, and generates an encrypted resource traffic table according to the sorted encrypted application traffic, then determines whether the currently requested access resource exists in the encrypted resource traffic table, and determines the encryption mode according to the resource usage count, the number of users, the set system configuration parameters and the set user number check value, forwards the encrypted requested access resource, and finally decrypts the encrypted requested access resource to obtain the access resource.

[0009] In order to better implement the present invention, further, the resource access method based on SSLVPN specifically includes the following steps:

[0010] Step S1: while generating the first key pair during the SSLVPN key negotiation phase, additionally generate a second key pair to encrypt high-frequency application traffic; the first key pair is a normal key pair; the second key pair is a forwarding key pair, including a public key K1 and a private key K2;

[0011] Step S2: During the SSLVPN gateway operation phase, an encrypted resource flow table with empty content is generated;

[0012] Step S3: Determine whether the currently requested access resource exists in the encrypted resource flow table, and determine the encryption method according to the resource usage count, the number of users, the set system configuration parameters and the set user number check value, and forward the encrypted requested access resource;

[0013] Step S4: decrypt the encrypted requested access resource to obtain the access resource.

[0014] In order to better implement the present invention, further, the table items of the encrypted resource flow table in step S2 include resource name, resource MD5 value, resource usage count, resource encryption data, and number of users;

[0015] The resource usage count is used to indicate the total number of requests;

[0016] The resource encryption data is used to indicate the data encrypted according to the public key K1;

[0017] The number of users is used to indicate the number of users who have requested the currently requested resource.

[0018] In order to better implement the present invention, further, the step S3 specifically includes the following steps:

[0019] Step S31: According to the obtained resource access request, determine whether the currently requested resource exists in the encrypted resource flow table. If it does not exist in the encrypted resource flow table, add the currently requested resource to the encrypted resource flow table, set the resource usage count and the number of users to 1, and execute step S35. If it exists in the encrypted resource flow table, execute step S32.

[0020] Step S32: add 1 to the resource count to determine whether the current requesting user has requested the currently requested resource. If yes, execute step S33; otherwise, add 1 to the user count and execute step S33 again.

[0021] Step S33: Determine whether the resource usage count is greater than or equal to the set system configuration parameter, and whether the number of users is greater than or equal to the set user number check value, if yes, execute step S34, otherwise execute step S35;

[0022] Step S34: calling the public key K1 to encrypt the currently requested resource content data, and putting the encrypted resource content data into the resource encryption data of the corresponding encrypted resource flow table, and forwarding the resource encryption data;

[0023] Step S35: call the first public-private key pair, encrypt the currently requested resource and forward it.

[0024] In order to better implement the present invention, further, the specific operation of step S4 is: calling the private key K2 to decrypt the encrypted requested access resource to obtain the access resource.

[0025] In order to better implement the present invention, further, the first key pair is used to encrypt and decrypt resources with fewer access times; the second key pair is used to encrypt and decrypt resources with more access times among intranet resources.

[0026] Based on the above-mentioned SSLVPN-based resource access method, in order to better implement the present invention, further, a SSLVPN-based resource access system is proposed, including a key generation unit, a table generation unit, an encryption forwarding unit, and a decryption unit;

[0027] The key generation unit is used to generate a second key pair to encrypt high-frequency application traffic while generating the first key pair during the SSLVPN key negotiation phase;

[0028] The table generating unit is used to sort the encrypted application traffic and generate an encrypted resource traffic table;

[0029] The encryption forwarding unit is used to determine whether the currently requested access resource exists in the encrypted resource flow table, and to determine the encryption method according to the resource usage count, the number of users, the set system configuration parameters, and the set user number check value, and to forward the encrypted requested access resource;

[0030] The decryption unit is used to decrypt the encrypted traffic acquired according to the second key pair to obtain the access resource.

[0031] Based on the above-proposed SSLVPN-based resource access method, in order to better implement the present invention, further, an electronic device is proposed, including a memory and a processor; a computer program is stored on the memory; when the computer program is executed on the processor, the above-proposed SSLVPN-based resource access method is implemented.

[0032] Based on the above-proposed SSLVPN-based resource access method, in order to better implement the present invention, further, a computer-readable storage medium is proposed, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-proposed SSLVPN-based resource access method is implemented.

[0033] The present invention has the following beneficial effects:

[0034] (1) The present invention generates a set of keys during the original key negotiation phase between the SSLVPN client and the SSLVPN gateway, and also generates an additional set of keys generated by the SSLVPN gateway, thereby ensuring the security of the client's access to high-frequency traffic.

[0035] (2) The present invention generates a resource list when the SSLVPN gateway is running, and controls the scope and degree of memory usage and universal key usage through the resource usage count and the number of users in the list, further adjusting the balance between the forwarding performance and security of the gateway.

[0036] (3) The present invention uses a shared key to encrypt high-frequency resources accessed by the client in advance. When the client accesses the high-frequency resources subsequently, it does not need to perform encryption operations and can be used directly, thereby improving traffic forwarding performance and reducing resource consumption of the SSLVPN gateway to encrypt some resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic block diagram of the traffic encryption forwarding process provided by the present invention. DETAILED DESCRIPTION

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.

[0039] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0040] The complete English corresponding to the professional terms and English abbreviations involved in the embodiments of the present application is as follows:

[0041] SSLVPN: English full name: Security Socket Layer-SSL, refers to the VPN technology that establishes a remote secure access channel based on the Secure Sockets Layer protocol.

[0042] Embodiment 1:

[0043] This embodiment proposes a resource access method based on SSLVPN. First, while generating a first key pair during the SSLVPN key negotiation phase, an additional second key pair is generated to encrypt high-frequency application traffic. Then, the encrypted application traffic is sorted, and an encrypted resource traffic table is generated according to the sorted encrypted application traffic. Then, it is determined whether the currently requested access resource exists in the encrypted resource traffic table, and the encryption method is determined according to the resource usage count, the number of users, the set system configuration parameters, and the set user number check value. The encrypted requested access resource is forwarded, and finally the encrypted requested access resource is decrypted to obtain the access resource. The resource access method based on SSLVPN specifically includes the following steps:

[0044] Step S1: while generating the first key pair during the SSLVPN key negotiation phase, additionally generate a second key pair to encrypt high-frequency application traffic; the first key pair is a normal key pair; the second key pair is a forwarding key pair, including a public key K1 and a private key K2;

[0045] Step S2: During the SSLVPN gateway operation phase, an encrypted resource flow table with empty content is generated;

[0046] Furthermore, the table items of the encrypted resource flow table in step S2 include resource name, resource MD5 value, resource usage count, resource encryption data, and number of users;

[0047] The resource usage count is used to indicate the total number of requests;

[0048] The resource encryption data is used to indicate the data encrypted according to the public key K1;

[0049] The number of users is used to indicate the number of users who have requested the currently requested resource.

[0050] Step S3: Determine whether the currently requested access resource exists in the encrypted resource flow table, and determine the encryption method based on the resource usage count, number of users, set system configuration parameters and set user number check value, and forward the encrypted requested access resource.

[0051] Furthermore, the step S3 specifically includes the following steps:

[0052] Step S31: According to the obtained resource access request, determine whether the currently requested resource exists in the encrypted resource flow table. If it does not exist in the encrypted resource flow table, add the currently requested resource to the encrypted resource flow table, set the resource usage count and the number of users to 1, and execute step S35. If it exists in the encrypted resource flow table, execute step S32.

[0053] Step S32: add 1 to the resource count to determine whether the current requesting user has requested the currently requested resource. If yes, execute step S33; otherwise, add 1 to the user count and execute step S33 again.

[0054] Step S33: Determine whether the resource usage count is greater than or equal to the set system configuration parameter, and whether the number of users is greater than or equal to the set user number check value, if yes, execute step S34, otherwise execute step S35;

[0055] Step S34: calling the public key K1 to encrypt the currently requested resource content data, and putting the encrypted resource content data into the resource encryption data of the corresponding encrypted resource flow table, and forwarding the resource encryption data;

[0056] Step S35: call the first public-private key pair, encrypt the currently requested resource and forward it.

[0057] In order to better implement the present invention, further, the first key pair is used to encrypt and decrypt resources with fewer access times; the second key pair is used to encrypt and decrypt resources with more access times among intranet resources.

[0058] Step S4: decrypt the encrypted requested access resource to obtain the access resource.

[0059] Working principle: This embodiment first generates a first key pair during the SSLVPN key negotiation phase, and additionally generates a second key pair to encrypt high-frequency application traffic. Secondly, the encrypted application traffic is sorted to generate an encrypted resource traffic table. Then, it is determined whether the currently requested access resource exists in the encrypted resource traffic table, and the encryption method is determined based on the resource usage count, the number of users, the set system configuration parameters, and the set user number check value. The encrypted requested access resource is forwarded, and finally the encrypted requested access resource is decrypted to obtain the access resource. While ensuring that the client accesses the high-frequency traffic, the gateway forwarding performance and security balance are adjusted.

[0060] Embodiment 2:

[0061] This embodiment is based on the above embodiment 1. Figure 1 As shown, a specific embodiment is described in detail, which specifically includes the following steps.

[0062] Step S1: In the SSLVPN key negotiation phase, in addition to the normal generation of a set of public keys and private keys, an additional public key K1 and private key K2 will be generated for forwarding. Among them, the public key K1 and private key K2 will not change with the client, but can be regenerated by the user controlling the SSLVPN gateway.

[0063] Step S2: When the SSLVPN gateway is running, an empty resource list will be generated, wherein the items in the resource list include: resource name, resource MD5, resource usage count, resource encryption data, and number of users. The resource list is shown in Table 1.

[0064] The resource usage count does not distinguish between users making requests, and the count increases by 1 each time the resource is requested.

[0065] Resource encrypted data, which is data encrypted using the public key K1.

[0066] Number of users, records the number of times the resource has been requested by different users.

[0067] Table 1 Encrypted resource flow table

[0068] Serial number Resource Name Resource MD5 Resource usage count Resource Encryption Data Number of users 1 N.1 Md5.1 Count.1 Date.1 Client.1 2 N.2 Md5.2 Count.2 Date.2 Client.2 ... ... ... ... ... n N Md5.n Count.n Date.n Client.n

[0069] Step S3: Encrypted forwarding of requested resources. Wherein, count.preset is a parameter that can be configured by the system user, indicating a preset resource usage count check value. user.prese is a parameter that can be configured by the system user, indicating a preset user number check value.

[0070] Step S31: When the SSLVPN gateway receives a request to access resource X from the client, it will first determine whether the resource exists in the resource list. If not, resource X will be added to the resource class list, and the usage count count.x and user number user.x will be set to 1. At the same time, step S35 will be entered. If it exists in the resource list, step S32 will be entered.

[0071] Step S32: add 1 to the corresponding resource count, and judge again whether the user of this request has requested the resource before. If the result is "yes", go to step S33. If the result is "no", add 1 to the corresponding user count first, and then go to step S33.

[0072] Step S33: Determine whether count_x is greater than or equal to count_preset, and user_x is greater than or equal to user_preset. If the result is "No", go to step E. If the result is "Yes", go to step S34.

[0073] Step S34: Use the public key K1 to encrypt the resource content data, and put the encrypted data in the resource encryption data of the corresponding record. The device directly uses the encrypted data of the resource in the resource list to forward.

[0074] Step S35: forward the resource by encrypting and decrypting it using a normal key.

[0075] Step S4: After receiving the encrypted traffic of this part, the client can use the private key K2 to decrypt it.

[0076] Working principle: This embodiment adds an additional key item during the SSLVPN key negotiation phase to encrypt and sort the high-frequency application traffic to form an encrypted resource traffic table and save it in the memory. The SSLVPN client then requests direct forwarding again, providing a solution to improve traffic forwarding performance while retaining the security of traffic encryption, and solving the problem of severe degradation in forwarding performance caused by encryption and decryption of traffic when forwarding traffic using the existing SSLVPN technology. During the key negotiation phase, the SSLVPN client and the SSLVPN gateway will generate an additional set of keys generated by the SSLVPN gateway in addition to the original set of keys generated by the negotiation. Ensure the security of high-frequency traffic accessed by the client. A resource list is generated when the SSLVPN gateway is running. The system controls the scope and degree of memory usage and common key usage through the "resource usage count" and "different client usage count" in the list, and further adjusts the balance between the forwarding performance and security of the gateway. High-frequency resources accessed by the client are encrypted in advance using a shared key, so that subsequent client access does not require encryption operations and can be used directly

[0077] This embodiment adds an additional key item during the SSLVPN key negotiation phase to encrypt and sort the high-frequency application traffic to form an encrypted resource traffic table and save it in the memory. The client directly forwards the request again to avoid repeated encryption of the same resource when it is repeatedly requested by a client or encryption with multiple different public keys when requested by different clients.

[0078] In the key negotiation phase, the SSLVPN client and the SSLVPN gateway of this embodiment will generate an additional set of keys generated by the SSLVPN gateway in addition to the original set of keys generated by the negotiation. The additional keys generated by different SSLVPN gateways are different, but the keys generated by the same SSLVPN gateway are the same for each client. At the same time, the user can manually control the SSLVPN gateway to regenerate. The original keys are used for encryption and decryption when the client accesses resources that it accesses less frequently, and the additional keys generated by SSLVPN are used for encryption and decryption of frequently accessed resources in the intranet resources.

[0079] When the SSLVPN gateway of this embodiment is running, a resource list is generated, and the table items include: resource name, resource MD5, resource usage count, resource encryption data, and different client usage counts. The resource usage count refers to the total number of times the resource has been accessed by the client. Each time the resource is accessed, the resource count will increase by one. By sorting the resources by resource count, the purpose of controlling the size of the resource list can be achieved. The usage counts of different clients can achieve the purpose of controlling the size of the resource list in a richer way.

[0080] The resource encryption data in this embodiment is the data encrypted by the public key generated additionally by the SSLVPN gateway for the resource, which can be used directly when the resource is used to avoid the process of re-encryption, thereby reducing the resource consumption of the SSLVPN gateway for encrypting that part of the resource.

[0081] Through the above process, the frequently used traffic between the SSLVPN client and the SSLVPN gateway or the frequently accessed resources in the intranet are encrypted and stored in advance, and can be used directly when needed without further encryption operations.

[0082] This embodiment uses a method of exchanging space for time to greatly reduce the encryption operations of the SSLVPN gateway at the software level, and provides a solution to improve traffic forwarding performance while retaining the security of traffic encryption, so as to solve the technical problem that the existing SSLVPN technology causes serious degradation in forwarding performance when encrypting and decrypting traffic when forwarding traffic.

[0083] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.

[0084] Embodiment 3:

[0085] This embodiment, based on any one of the above-mentioned embodiments 1-2, proposes a resource access system based on SSLVPN, including a key generation unit, a table generation unit, an encryption forwarding unit, and a decryption unit;

[0086] The key generation unit is used to generate a second key pair to encrypt high-frequency application traffic while generating the first key pair during the SSLVPN key negotiation phase;

[0087] The table generating unit is used to sort the encrypted application traffic and generate an encrypted resource traffic table;

[0088] The encryption forwarding unit is used to determine whether the currently requested access resource exists in the encrypted resource flow table, and to determine the encryption method according to the resource usage count, the number of users, the set system configuration parameters, and the set user number check value, and to forward the encrypted requested access resource;

[0089] The decryption unit is used to decrypt the encrypted traffic acquired according to the second key pair to obtain the access resource.

[0090] This embodiment also proposes an electronic device, including a memory and a processor; a computer program is stored in the memory; when the computer program is executed on the processor, the above-mentioned SSLVPN-based resource access method is implemented.

[0091] This embodiment also proposes a computer-readable storage medium, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned resource access method based on SSLVPN is implemented.

[0092] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1-2, so they will not be repeated here.

[0093] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A resource access method based on SSLVPN, characterized in that: First, while generating the first key pair during the SSLVPN key negotiation phase, an additional second key pair is generated to encrypt resource traffic. Second, the encrypted resource traffic is sorted, and an encrypted resource traffic table is generated based on the sorted encrypted resource traffic. Then, it is determined whether the currently requested access resource exists in the encrypted resource traffic table, and an encryption method is selected based on the resource usage count, the number of users, the set system configuration parameters, and the set user number check value to encrypt the requested access resource and forward it. Finally, the encrypted requested access resource is encrypted and decrypted to obtain the access resource.

2. The resource access method based on SSLVPN according to claim 1, characterized in that: The resource access method based on SSLVPN specifically includes the following steps: Step S1: while generating the first key pair during the SSLVPN key negotiation phase, additionally generate a second key pair to encrypt high-frequency application traffic; the first key pair is a normal key pair; the second key pair is a forwarding key pair, including a public key K1 and a private key K2; Step S2: During the SSLVPN gateway operation phase, an encrypted resource flow table with empty content is generated; Step S3: Determine whether the currently requested access resource exists in the encrypted resource flow table, and determine the encryption method according to the resource usage count, the number of users, the set system configuration parameters and the set user number check value, and forward the encrypted requested access resource; Step S4: decrypt the encrypted requested access resource to obtain the access resource.

3. A resource access method based on SSLVPN according to claim 2, characterized in that: The table items of the encrypted resource flow table in step S2 include resource name, resource MD5 value, resource usage count, resource encryption data, and number of users; The resource usage count is used to indicate the total number of requests; The resource encryption data is used to indicate the data encrypted according to the public key K1; The number of users is used to indicate the number of users who have requested the currently requested resource.

4. The resource access method based on SSLVPN according to claim 3, characterized in that: The step S3 specifically comprises the following steps: Step S31: According to the obtained resource access request, determine whether the currently requested resource exists in the encrypted resource flow table. If it does not exist in the encrypted resource flow table, add the currently requested resource to the encrypted resource flow table, set the resource usage count and the number of users to 1, and execute step S35. If it exists in the encrypted resource flow table, execute step S32. Step S32: add 1 to the resource count to determine whether the current requesting user has requested the currently requested resource. If yes, execute step S33; otherwise, add 1 to the user count and execute step S33 again. Step S33: Determine whether the resource usage count is greater than or equal to the set system configuration parameter, and whether the number of users is greater than or equal to the set user number check value, if yes, execute step S34, otherwise execute step S35; Step S34: calling the public key K1 to encrypt the currently requested resource content data, and putting the encrypted resource content data into the resource encryption data of the corresponding encrypted resource flow table, and forwarding the resource encryption data; Step S35: call the first public-private key pair, encrypt the currently requested resource and forward it.

5. The resource access method based on SSLVPN according to claim 4, characterized in that: The specific operation of step S4 is: calling the private key K2 to decrypt the encrypted requested access resource to obtain the access resource.

6. The resource access method based on SSLVPN according to claim 2, characterized in that: The first key pair is used to encrypt and decrypt resources with fewer access times; the second key pair is used to encrypt and decrypt resources with more access times among the intranet resources.

7. A resource access system based on SSLVPN, characterized in that: It includes a key generation unit, a table generation unit, an encryption forwarding unit, and a decryption unit; The key generation unit is used to generate a second key pair to encrypt high-frequency application traffic while generating the first key pair during the SSLVPN key negotiation phase; The table generating unit is used to sort the encrypted application traffic and generate an encrypted resource traffic table; The encryption forwarding unit is used to determine whether the currently requested access resource exists in the encrypted resource flow table, and to determine the encryption method according to the resource usage count, the number of users, the set system configuration parameters, and the set user number check value, and to forward the encrypted requested access resource; The decryption unit is used to decrypt the encrypted traffic acquired according to the second key pair to obtain the access resource.

8. An electronic device, characterized in that: It comprises a memory and a processor; a computer program is stored in the memory; when the computer program is executed on the processor, the resource access method based on SSLVPN as described in any one of claims 1-6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 8, the SSLVPN-based resource access method as described in any one of claims 1-6 is implemented.

Images