External network access method, device, computer equipment, readable storage medium and product

Abstract

The present application relates to an external network access method, device, computer equipment, readable storage medium and product, and relates to the field of communication technology. The method includes: when receiving an external network access request sent by at least one internal network device, obtaining the priority of each external network access request transmitted to at least two gateway servers respectively; the priority is determined based on the connection attribute between the gateway server and the internal network device; sending the external network access request to the first gateway server with the highest priority to perform network address conversion; when an abnormality occurs in the first gateway server during the network address conversion process, sending the external network access request to the second gateway server with the highest priority among the gateway servers except the first gateway server to perform network address conversion; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result is obtained. The use of this method can improve the efficiency of external network access.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an external network access method, device, computer equipment, readable storage medium and product. Background Art

[0002] As the scale of enterprise networks continues to expand, enterprises will gradually deploy more and more internal devices, which will cause a sharp increase in the number of requests from internal devices to access external networks.

[0003] Based on this, enterprises usually deploy a unified gateway server so that the requests of various internal devices can be centralized to the gateway server, so that the internal network devices can access the external network through the gateway server. However, this method will undoubtedly bring certain resource pressure to the gateway server, thereby affecting the efficiency of external network access. Summary of the invention

[0004] Based on this, it is necessary to provide an external network access method, device, computer equipment, computer readable storage medium and computer program product that can improve the efficiency of external network access in response to the above technical problems.

[0005] In a first aspect, the present application provides an external network access method, comprising: upon receiving an external network access request sent by at least one internal network device, for each external network access request, obtaining the priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection properties between the gateway server and the internal network device; for a first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server for network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out a second gateway server with the highest priority except the first gateway server from the gateway servers; sending the external network access request to the second gateway server for network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0006] In one of the embodiments, an external network access request is sent to a first gateway server to perform network address translation, including: sending the external network access request to the first gateway server, querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records the external network addresses that are allowed to be accessed by the internal network device; when the external network whitelist contains the external network address indicated by the external network access request, performing network address translation through the first gateway server.

[0007] In one of the embodiments, network address translation is performed through a first gateway server, including: obtaining a routing index of an intranet device that initiates an external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the intranet device; and network address translation is performed based on the routing index.

[0008] In one of the embodiments, the method also includes: upon receiving an intranet access request sent by a target external network and forwarded by each gateway server, obtaining a fixed network address of the gateway server for each gateway server; screening out selected devices that have a mapping relationship with the gateway server from each intranet device; updating the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain a target access request; the target access request is used for the target external network to access the selected device.

[0009] In one of the embodiments, the method also includes: when receiving a response signal fed back by the selected device based on the target access request, sending the response signal to the gateway server; receiving the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0010] In one of the embodiments, the method further includes: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; and decrypting the encrypted access request to obtain an extranet access request.

[0011] In the second aspect, the present application also provides an external network access device, including: a routing priority acquisition module, which is used to obtain the priority of the external network access request for each external network access request when receiving an external network access request sent by at least one internal network device, and transmit it to at least two gateway servers respectively; the priority is determined based on the connection properties between the gateway server and the internal network device; a first network address translation module, which is used to send the external network access request to the first gateway server with the highest priority among the gateway servers for network address translation; a second gateway service determination module, which is used to filter out the second gateway server with the highest priority except the first gateway server from the gateway servers when an exception occurs in the process of network address translation of the first gateway server; a second network address translation module, which is used to send the external network access request to the second gateway server for network address translation; a module for generating external network access results, which is used to obtain the external network access result of the internal network device when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

[0012] In a third aspect, the present application also provides a computer device, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: upon receiving an external network access request sent by at least one internal network device, for each external network access request, obtaining the priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection properties between the gateway server and the internal network device; for the first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server for network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out the second gateway server with the highest priority except the first gateway server from the gateway servers; sending the external network access request to the second gateway server for network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0013] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the following steps when the computer program is executed by a processor: upon receiving an external network access request sent by at least one internal network device, for each external network access request, obtaining the priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection properties between the gateway server and the internal network device; for the first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server for network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out the second gateway server with the highest priority except the first gateway server from the gateway servers; sending the external network access request to the second gateway server for network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0014] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which implements the following steps when executed by a processor: when receiving an external network access request sent by at least one intranet device, for each external network access request, obtaining the priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection properties between the gateway server and the intranet device; for the first gateway server with the highest priority among all gateway servers, sending the external network access request to the first gateway server for network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out the second gateway server with the highest priority except the first gateway server from all gateway servers; sending the external network access request to the second gateway server for network address translation; when the second gateway server converts the intranet address of the intranet device into the public network address of the external network indicated by the external network access request, the external network access result of the intranet device is obtained.

[0015] The above-mentioned external network access method, device, computer equipment, computer-readable storage medium and computer program product, when receiving an external network access request sent by at least one internal network device, first obtains the priority of each external network access request transmitted to at least two gateway servers. And sends the external network access request to the first gateway server with the highest priority among the gateway servers to perform network address conversion. When an exception occurs in the first gateway server during the network address conversion process, the second gateway server with the highest priority other than the first gateway server is screened out from the gateway servers, and the external network access request is sent to the second gateway server for network address conversion. When the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is generated. That is, on the one hand, the present application introduces multiple gateway servers to overcome the technical defect that a unified gateway server in the traditional technology has resource pressure, and when one of the gateway servers fails, the other gateway servers can receive the external network access request on the failed gateway server in time, thereby improving the efficiency of external network access. On the other hand, the present application sets the priority of transmitting the external network access requests initiated by different internal network devices to each gateway server, so that each external network access request can be transmitted in an orderly manner, further improving the efficiency of external network access. Moreover, the priority is determined based on the connection properties between the gateway server and the internal network device, which improves the reliability of each priority, thereby improving the reliability of the entire external network access process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] FIG1 is an application environment diagram of an external network access method in one embodiment;

[0018] FIG2 is a schematic diagram of a flow chart of an external network access method in an embodiment;

[0019] FIG3 is a schematic diagram of routing priorities in one embodiment;

[0020] FIG4 is a schematic diagram of a second gateway server processing a request in one embodiment;

[0021] FIG5 is a schematic diagram of a flow chart of network address translation in one embodiment;

[0022] FIG6 is a schematic diagram of an external network whitelist in one embodiment;

[0023] FIG7 is a schematic diagram of a flow chart of network address translation in another embodiment;

[0024] FIG8 is a schematic diagram of routing isolation in one embodiment;

[0025] FIG9 is a schematic diagram of a process of accessing an intranet device from an external network in one embodiment;

[0026] FIG10 is a schematic diagram of a process of accessing an intranet device from an external network in another embodiment;

[0027] FIG11 is a schematic diagram of a process of an intranet device responding to an external network access in one embodiment;

[0028] FIG12 is a schematic diagram of a process of an intranet device responding to an external network access in another embodiment;

[0029] FIG13 is a schematic diagram of a process for obtaining an external network access request in one embodiment;

[0030] FIG14 is a diagram of a network structure in one embodiment;

[0031] FIG15 is a structural block diagram of an external network access device in one embodiment;

[0032] FIG. 16 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] The extranet access method provided in the embodiment of the present application can be applied in the application environment as shown in Figure 1. Among them, the control center 102 communicates with each intranet device 104 and each gateway server 106 respectively. The control center 102 can be understood as the general control center of each intranet device 104. For example, assuming that the intranet device is the device of each enterprise branch, the control center can be the control center of the enterprise headquarters, which can collect the extranet access requests initiated by the devices of each enterprise branch. The intranet device 104 can refer to a terminal device in an internal network such as an enterprise network. The gateway server 106 can be understood as a Network Address Translation (NAT) gateway, which is used to convert the intranet address into the public network address of the external network, thereby realizing the connection with the external network.

[0035] Specifically, when the control center 102 receives an external network access request sent by at least one intranet device 104, it first obtains the priority of each external network access request transmitted to at least two gateway servers 106, and the priority is determined based on the connection attribute between the gateway server 106 and the intranet device 104. For the first gateway server with the highest priority among the gateway servers 106, the control center 102 sends the external network access request to the first gateway server for network address translation. When an exception occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority other than the first gateway server is screened out from the gateway servers 106, and the external network access request is sent to the second gateway server for network address translation. When the second gateway server converts the intranet address of the intranet device into the public network address of the external network indicated by the external network access request, the external network access result of the intranet device is obtained.

[0036] In an exemplary embodiment, as shown in FIG. 2 , an external network access method is provided, which is described by taking the method applied to the control center 102 in FIG. 1 as an example, and includes:

[0037] Step S202: upon receiving an external network access request sent by at least one internal network device, obtaining, for each external network access request, a priority of transmitting the external network access request to at least two gateway servers respectively.

[0038] Among them, the external network access request may refer to a request instruction for an internal network device to access an external network. In actual applications, in order to obtain external resources, the internal devices of an enterprise usually need to communicate with the external network. As the number of internal network devices increases, enterprises usually deploy a unified gateway server so that the requests of various internal devices can be centralized to the gateway server, so that the internal network devices can access the external network through the gateway server, and realize the centralized management and optimization of the internal device network. However, this method will undoubtedly bring certain resource pressure to the gateway server, thereby affecting the efficiency of external network access. Therefore, at least two gateway servers are deployed in this embodiment to relieve the pressure of one gateway server.

[0039] In a preferred example, there can be two gateway servers, which can not only ensure the deployment cost, but also meet the extranet access requirements of each intranet device. Of course, in actual applications, an appropriate number of network servers can be deployed according to actual conditions. It can be understood that these multiple gateway servers are mutually active and standby, that is, in the case of a failure of the main gateway server, the standby gateway server will promptly receive the extranet access request processed by the main gateway server. If the standby gateway server also fails, the standby gateway server will be used as the new main gateway server, and the standby gateway server of the new main gateway server will continue to process to ensure that the intranet device successfully accesses the extranet. It should be noted that each gateway server can be either a main gateway server or a standby gateway server. The gateway servers are independent of each other, do not need to communicate with each other, and do not need to run the VRRP protocol (Virtual Router Redundancy Protocol). The VRRP protocol is a routing protocol used to solve the single point failure problem in the local area network. Its main purpose is to ensure that when a router in the network fails, it can quickly switch to the backup router to ensure network reliability. However, considering that VRRP needs to send VRRP messages regularly to maintain the master-slave relationship, this will increase the network burden and configuration complexity. Therefore, in this example, there is no need to run the VRRP protocol between the gateway servers for ease of configuration. As for network reliability, policy routing will be used in this embodiment to achieve more flexible traffic scheduling and load balancing, thereby improving network reliability.

[0040] Policy routing can be understood as a routing mechanism, which mainly refers to configuring the MED (Multi-Exit Discriminator) attribute value corresponding to each gateway server. The MED attribute is an attribute in BGP (Border Gateway Protocol) and is used to select the best path among multiple routing paths. In other words, the control center will form a communication link established with each gateway server using the BGP protocol. The control center can flexibly configure the MED attribute value on each communication link to achieve load balancing. For example, the MED attribute value between the control center and the first gateway server can be 80, while the MED attribute value between the control center and the second gateway server can be 100. These MED attribute values ​​determine the priority of the external network access request sent by different internal devices to be transmitted to each gateway server. The priority refers to the priority of the external network access request to be transmitted to the gateway server. The smaller the MED attribute value, the smaller the transmission consumption on the link and the higher the priority. Similarly, taking the previous example, the control center will give priority to sending the external network access request to the first gateway server because the MED attribute value corresponding to the first gateway server is smaller than the MED attribute value corresponding to the second gateway server.

[0041] Further, the priority may be determined in advance based on the connection attributes between the gateway server and the intranet device, or in other words, the MED attribute value is determined in advance based on the connection attributes between the gateway server and the intranet device. The connection attributes can be understood as the performance attributes of the external network access request generated by the intranet device when it is transmitted to the gateway server, such as bandwidth, delay, etc. These performance attributes can be known based on the historical external network access requests of each intranet device. Reference may be made to FIG3, which shows the MED attribute values ​​of different gateway servers for different intranet devices. For example, assuming that the external network access request generated by the intranet device 1 has a higher bandwidth or lower delay when transmitted to the first gateway server, and a lower bandwidth or higher delay on the second gateway server, then the control center can set the MED attribute value corresponding to the first gateway server to a smaller value, such as 80, and the MED attribute value corresponding to the second gateway server to a larger value, such as 100. That is, the external network access request initiated by the intranet device 1 will be transmitted to the first gateway server first, and in the event of a failure of the first gateway server, the second gateway server will process the external network access request again. Similarly, for the intranet device 2, the external network access request generated by it has a higher bandwidth or lower delay when transmitted to the second gateway server, while the bandwidth is lower or the delay is higher on the first gateway server. In this case, the control center can set the MED attribute value corresponding to the second gateway server to a smaller value, such as 80, and the MED attribute value corresponding to the first gateway server to a larger value, such as 100. That is, the external network access request initiated by the intranet device 2 will be transmitted to the second gateway server first. In the event of a failure of the second gateway server, the first gateway server will process the external network access request.

[0042] Exemplarily, when the control center receives an extranet access request sent by at least one intranet device, it can obtain the priority of each intranet device when transmitting the request in each gateway server, so as to transmit each extranet access request to the corresponding gateway server based on the priority.

[0043] Step S204: For the first gateway server with the highest priority among the gateway servers, the external network access request is sent to the first gateway server to perform network address translation.

[0044] Among them, the highest priority can be understood as the smallest MED attribute value, and the first gateway server refers to the gateway server with the highest priority, or the gateway server with the smallest MED attribute value between the control center. Network address translation refers to the process of converting the intranet address of the intranet device to the corresponding public network address of the external network, that is, the gateway server will store the corresponding public network address for the external network for connection with the external network. The gateway server converts the intranet address into this public network address to enable internal devices to communicate with the external network.

[0045] Exemplarily, for each intranet device, after obtaining the priority of transmitting the external network access request generated by the intranet device to each gateway server, the control center can select the first gateway server with the highest priority from each gateway server, and preferentially transmit the external network access request of the intranet device to the first gateway server. The first gateway server can then obtain the intranet address of the intranet device carried in the external network access request and the external network to be accessed, thereby converting the intranet address into the public network address corresponding to the external network, so as to enable the internal device to communicate with the external network.

[0046] Step S206: When an exception occurs in the first gateway server during the network address translation process, a second gateway server with the highest priority is selected from the gateway servers except the first gateway server.

[0047] The abnormality of the first gateway server may include but is not limited to the disconnection of the communication link between the control center and the first gateway server, the failure of the first gateway server itself, etc. The second gateway server refers to the gateway server with the highest priority among all gateway servers except the first gateway server.

[0048] Exemplarily, during the network address translation process on the first gateway server, when the first gateway server itself fails or the communication link between the control center and the first gateway server is disconnected, or other abnormal phenomena occur, the control center can filter out the second gateway server with the highest priority other than the first gateway server among all gateway servers, or in other words, filter out the backup gateway server corresponding to the first gateway server.

[0049] Step S208: Send the external network access request to the second gateway server for network address translation.

[0050] Exemplarily, after screening out the second gateway server, the control center can resend the external network access request processed by the first gateway server to the second gateway server so that the second gateway server can re-perform network address conversion. Since each gateway server is independent of each other, the external network access request will re-establish a session after reaching the second gateway server, and use the public network address in the second gateway server for network address conversion. As shown in Figure 4, Figure 4 shows a schematic diagram of request processing by the second gateway server. It can be seen that when the communication link between the control center and the first gateway server is disconnected, the control center will send the external network access request to the second gateway server, and the second gateway server will perform network address conversion. In a preferred example, when an exception occurs in the process of network address conversion of the first gateway server, the external network access request processed by the first gateway server can be automatically transferred to the second gateway server.

[0051] In step S210, when the second gateway server converts the intranet address of the intranet device into the public network address of the external network indicated by the external network access request, an external network access result of the intranet device is obtained.

[0052] The external network refers to the external network that the internal network wants to access. The public network address can be understood as a public address connected to the external network. The external network access result can be used to indicate whether the internal device successfully accesses the external network, which can include the external network access success and external network access failure, as well as the access duration, access rate and other data.

[0053] Exemplarily, after receiving the request from the first gateway server, the second gateway server will also obtain the intranet address of the intranet device and the external network to be accessed carried in the external network access request, thereby converting the intranet address into a public network address stored in the second gateway server, so as to enable the internal device to communicate with the external network. The control center can receive the external network access result fed back by the second gateway server.

[0054] In this embodiment, when the control center receives an extranet access request sent by at least one intranet device, it first obtains the priority of each extranet access request for transmission to at least two gateway servers. And sends the extranet access request to the first gateway server with the highest priority among the gateway servers for network address translation. When an exception occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority other than the first gateway server is screened out from the gateway servers, and the extranet access request is sent to the second gateway server for network address translation. When the second gateway server converts the intranet address of the intranet device into the public network address of the extranet indicated by the extranet access request, the extranet access result of the intranet device is generated. That is, on the one hand, this embodiment introduces multiple gateway servers to overcome the technical defect of resource pressure on a unified gateway server in the traditional technology, and when one of the gateway servers fails, the other gateway servers can receive the extranet access request on the failed gateway server in time, thereby improving the extranet access efficiency. On the other hand, this embodiment sets the priority of extranet access requests initiated by different intranet devices to be transmitted to each gateway server, so that each extranet access request can be transmitted in an orderly manner, further improving the efficiency of extranet access. Furthermore, the priority is determined based on the connection properties between the gateway server and the intranet device, which improves the reliability of each priority and thus the reliability of the entire extranet access process.

[0055] In an exemplary embodiment, as shown in FIG5 , sending an external network access request to a first gateway server to perform network address translation includes:

[0056] Step S502: Send an external network access request to a first gateway server, and query an external network whitelist of the internal network device that initiates the external network access request through the first gateway server.

[0057] Among them, the external network whitelist records the external network addresses that the internal network devices are allowed to access. It is understandable that for network operation and maintenance management and security considerations, not every internal network device can access the external network at will, such as some video websites, game websites, etc. Therefore, in this embodiment, the external network whitelist corresponding to each internal network device is stored in the gateway server to ensure network security.

[0058] For example, the control center can design a corresponding external network whitelist for each intranet device in advance according to business needs, record the external networks that the intranet device is allowed to access, and publish it in each gateway server. After the control center sends the external network access request of the intranet device to the first gateway server, the first gateway server can query the external network whitelist corresponding to the intranet device to determine whether communication between the intranet device and the external network can be achieved.

[0059] Step S504: When the external network whitelist contains the external network address indicated by the external network access request, network address translation is performed through the first gateway server.

[0060] The external network address refers to the address of the external network that the internal network device wants to access.

[0061] Exemplarily, when the first gateway server determines that the external network whitelist contains the external network address indicated by the external network access request, it means that the external network currently to be accessed by the internal network device is allowed, and the first network server can perform network address translation on the internal network address of the internal network device.

[0062] In one example, when an exception occurs during the network address translation of an external network access request initiated by an internal network device by the first gateway server, the second network server will re-translate the external network access request. In this process, the second network server also needs to determine whether the external network whitelist for the internal network device stored by the second network server contains the external network address indicated by the external network access request. After confirming that the external network address is included, the network address translation is performed.

[0063] For example, as shown in FIG6 , the external network whitelist 1 designed by the control center for the intranet device 1 includes external network address 1 and external network address 2, and the external network whitelist 2 designed for the intranet device 2 includes external network address 3 and external network address 4. The control center will publish the external network whitelist 1 and the external network whitelist 2 in the first gateway server and the second gateway server. When the first gateway server and the second gateway server receive the external network access request initiated by the intranet device 1 or the intranet device 2, they can query the external network whitelist 1 or the external network whitelist 2 stored by each of them to determine whether to continue the network address translation.

[0064] In this embodiment, considering network operation and maintenance management and security, the permission of each intranet device to access the extranet is restricted, and an extranet whitelist is published on each gateway server, thereby improving network maintainability and network security.

[0065] In an exemplary embodiment, as shown in FIG7 , performing network address translation through a first gateway server includes:

[0066] Step S702: Obtain, through the first gateway server, a routing index of the intranet device that initiates the external network access request; there is a one-to-one correspondence between the routing index and the intranet device.

[0067] Among them, the routing index can be understood as the index of the routing table, and the routing table is used to store the path information pointing to a specific network address. Its main function is to implement routing selection and help data packets to be transmitted from the source address to the destination. In this embodiment, different intranet devices can have corresponding routing tables in the gateway server, and each routing table has a unique identifier as a routing index, as shown in Figure 8. Such a design can achieve the purpose of routing isolation, because in actual applications there is a phenomenon of network communication interference between different intranet devices. By configuring an independent routing table for each intranet device, each intranet device can independently plan and manage its own network address space without worrying about conflicts with other intranet devices, thereby effectively avoiding network interference. Moreover, the same network address segment can be repeatedly allocated in different intranet devices.

[0068] Exemplarily, when performing network address translation on an extranet access request initiated by an intranet device, the first gateway server may first obtain the device identification of the intranet device, and then query the unique identification of the routing table of the intranet device, namely, the routing index, based on the device identification.

[0069] Step S704: Perform network address translation based on the routing index.

[0070] Exemplarily, after querying the routing index corresponding to each intranet device, the first gateway server can perform network address translation based on each routing index to obtain a message identified by the routing index. The message records the intranet address of the intranet device, the public network address after network address translation, and the external network address of the external network that the intranet device wants to access.

[0071] It should be noted that network address translation based on routing index is applied to all gateway servers.

[0072] In this embodiment, by performing routing isolation between various intranet devices, network communication interference between different intranet devices can be effectively avoided, thereby improving the accuracy of network address translation, and further improving the accuracy of intranet devices accessing the external network.

[0073] In an exemplary embodiment, as shown in FIG9 , the process of accessing the intranet device from the external network further includes:

[0074] Step S902: upon receiving the intranet access request sent by the target external network and forwarded by each gateway server, obtaining the fixed network address of each gateway server.

[0075] The target external network may refer to an external network that requests access to an internal network device. In one example, the target external network may be the external network indicated in the external network access request. The internal network access request may refer to a request instruction for the target external network to access an internal network device. The fixed network address is a randomly generated public network address that is used to replace the external network address of the target external network. The fixed network address will be pre-published to the internal network device, that is, the internal network device can pre-learn the routing information of the fixed network address.

[0076] For example, after the intranet device successfully accesses the target external network, if the target external network also needs to access the intranet device, the target external network needs to send an access request for the intranet device to the gateway server. The gateway server forwards the intranet access request to the control center. After receiving the intranet access request, the control center obtains a fixed network address pre-created by the gateway server for address conversion.

[0077] Step S904: Filter out selected devices that have a mapping relationship with the gateway server from among the intranet devices.

[0078] Among them, the mapping relationship can refer to a one-to-one mapping relationship between a network server and an intranet device. The selected device is an intranet device that has a one-to-one mapping relationship with the gateway server. It should be noted that when the external network accesses the intranet device, the control center will query the intranet device that has a one-to-one mapping relationship with the gateway server, and then send the intranet access request to the intranet device to achieve communication between the target external network and the intranet device. However, in the case where the intranet device accesses the external network, the gateway server and the intranet device can be a one-to-many mapping relationship, that is, one gateway server can handle the external network access requests initiated by multiple intranet devices.

[0079] Exemplarily, after receiving the intranet access request forwarded by the gateway server, the control center may query the intranet device that has a one-to-one mapping relationship with the gateway server to send the intranet access request to the intranet device.

[0080] Step S906, based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain a target access request.

[0081] The target access request can be understood as an access request generated after address conversion of the original intranet access request. The target access request is used for the target extranet to access the selected device.

[0082] For example, the intranet access request will carry the external network address of the target external network and the target address to be accessed. It should be noted that the target address here is the public network address of the gateway server. The control center will convert the external network address based on the fixed network address obtained, obtain a new access request, and send this new access request to the intranet device that has a one-to-one mapping relationship with the gateway server.

[0083] For example, referring to Figure 10, the target external network with external network address 114.114.114.114 sends an internal network access request to the gateway server. At this time, the source address is the external network address 114.114.114.114, and the target address should be the public network address on the gateway server, that is, 172.49.63.21. After the internal network access request passes through the gateway server, the control center will obtain the fixed network address 100.0.0.1 configured by the gateway server. Then query the internal network device 3 that has a one-to-one mapping relationship with the gateway server, or in other words, the internal network address 10.0.0.2 of the internal network device 3 that has a one-to-one mapping relationship with the public network address 172.49.63.21 on the gateway server. The control center will convert the current target address 172.49.63.2 into the intranet address 10.0.0.2, and then convert the external network address 114.114.114.114 into the fixed network address 100.0.0.1 to obtain a new access request.

[0084] In this embodiment, considering that when the external network accesses the internal network device, the external network address is actually unknown, and the internal network device has not learned the relevant routing information, if each external network publishes a whitelist route, the number will undoubtedly be huge and difficult to manage. In order to solve this problem, in this embodiment, a fixed network address is configured on the gateway server to replace the external network address. Since the internal network device will learn the routing information of the fixed network address in advance, it can normally receive the access initiated by the target external network, thereby improving the reliability of the external network accessing the internal network device.

[0085] In an exemplary embodiment, as shown in FIG11 , the process of the intranet device responding to the intranet access request further includes:

[0086] Step S1102: When receiving a response signal fed back by the selected device based on the target access request, the response signal is sent to the gateway server.

[0087] The response signal may refer to a signal sent by the selected device in response to the target access request.

[0088] Exemplarily, after receiving the target access request, the selected device can make a corresponding response signal for the target access request and send the response signal to the control center. After receiving the response signal, the control center can send the response signal to the gateway server that has a one-to-one mapping relationship with the selected device.

[0089] Step S1104, receiving the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain the external network address, and sends the response signal to the target external network belonging to the external network address.

[0090] Exemplarily, after receiving the response signal sent by the control center, the gateway server can convert the fixed network address carried by the response signal, that is, convert it into the correct external network address. It is understandable that after the gateway server sends the intranet access request to the control center, it will store the external network address of the target external network in the session table for reverse conversion when the intranet device responds. After completing the address conversion, the gateway server can send the response signal after the address conversion to the target external network. And feedback a target result to the control center, indicating that the response signal has been successfully sent to the target external network.

[0091] For example, referring to FIG12 , the intranet device 3 returns a response signal for the target access request. At this time, the source address is the intranet address 10.0.0.2 of the intranet device 3, and the destination address is the fixed network address 100.0.0.1. The control center queries the gateway server that has a one-to-one mapping relationship with the intranet device 3, and sends the response signal to the gateway server. The gateway server queries the external network address 114.114.114.114 through the session table, converts the target address from the fixed network address 100.0.0.1 to the external network address 114.114.114.114, and converts the source address from the intranet address 10.0.0.2 to the public network address 172.49.63.21.

[0092] In this embodiment, when the intranet device responds to the intranet access request of the external network, a fixed network address is converted into a correct external network address by performing an address reverse conversion, thereby improving the reliability of the intranet device responding to the intranet access request of the external network.

[0093] In an exemplary embodiment, as shown in FIG13 , the process of obtaining the external network access request further includes:

[0094] Step S1302: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol.

[0095] Among them, there is a POP point (Point-of-Presence) in the control center. The POP point refers to a network access point deployed at a specific geographical location in the network. These access points are usually established by network service providers in different regions to optimize network routing and provide better access speed. The data transmission channel can be understood as a channel for data transmission between the control center and the POP point. As shown in Figure 14, each intranet device and control center will be activated at the nearest POP point. A channel, namely a data transmission channel, can be established between the intranet device / control center and the POP point through the Internet Protocol Security (IPSec). The encrypted access request can be obtained by encrypting the original external network access request sent by the intranet device.

[0096] For example, after the intranet device generates an extranet access request, the extranet access request will be sent by the intranet device to the corresponding POP point. Each POP point can be connected through a VXLAN (Virtual eXtensible Local Area Network) tunnel. A VXLAN tunnel refers to a logical tunnel established between the source network device and the destination network device to achieve interconnection between multiple data centers across regions. The POP point corresponding to the intranet device will send the extranet access request to the POP point corresponding to the control center. The POP point corresponding to the control center will then encrypt the extranet access request and send it to the control center through the data transmission channel. ‌‌

[0097] Step S1304: decrypt the encrypted access request to obtain an external network access request.

[0098] Exemplarily, after the control center receives the encrypted access request transmitted by the POP point through the data transmission channel, the control center can encrypt the encrypted access request to obtain the original extranet access request initiated by the intranet device.

[0099] In this embodiment, data transmission is performed through a data transmission channel established based on a network security protocol, thereby improving the security of external network access request transmission and thus improving the security of the external network access process.

[0100] In a specific embodiment, the specific process of the external network access method includes:

[0101] Through the data transmission channel established based on IPSe, the headquarters control center receives an external network access request for the target external network sent by at least one branch intranet device forwarded by the corresponding POP point. For each external network access request, the headquarters control center obtains the routing priority of the external network access request to be transmitted to the two NAT gateways respectively, and sends the external network access request to the first NAT gateway with the highest priority. The first NAT gateway queries the external network whitelist of the branch intranet device that initiates the external network access request. The external network whitelist records the external network addresses that are allowed to be accessed by the branch intranet device. When the external network whitelist contains the external network address indicated by the external network access request, the first NAT gateway obtains the routing table index of the branch intranet device, and performs network address conversion based on the routing table index. When an exception occurs in the first NAT gateway during the network address conversion process, another NAT gateway (hereinafter referred to as the second NAT gateway) will re-convert the network address.

[0102] When the headquarters control center receives the intranet access request sent by the target external network forwarded by each NAT gateway, the headquarters control center will obtain the fixed network address of the NAT gateway for each NAT gateway. And select the selected devices that have a one-to-one mapping relationship with the NAT gateway from the intranet devices of each branch. Based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain the target access request, which is used for the target external network to access the selected device. When the headquarters control center receives the response signal fed back by the selected device based on the target access request, the response signal is sent to the NAT gateway that has a one-to-one mapping relationship with the selected device. The NAT gateway will convert the fixed network address carried by the response signal to obtain the external network address, and send the response signal after the address conversion to the target external network.

[0103] In this embodiment, when the headquarters control center receives the extranet access request sent by at least one branch intranet device, for each extranet access request, obtains the priority of transmitting it to two NAT gateways respectively. And sends the extranet access request to the first NAT gateway with the highest priority to perform network address translation. When the first NAT gateway is abnormal during the network address translation, the extranet access request is sent to the second NAT gateway to perform network address translation. When the second NAT gateway converts the intranet address of the branch intranet device into the public network address of the extranet indicated by the extranet access request, the extranet access result of the branch intranet device is generated. That is, on the one hand, the present embodiment introduces multiple NAT gateways to overcome the technical defect that a unified gateway server in the traditional technology has resource pressure, and when one of the NAT gateways fails, other NAT gateways can receive the extranet access request on the failed NAT gateway in time, and improve the extranet access efficiency. On the other hand, the present embodiment sets the priority of the extranet access request initiated by different branch intranet devices to be transmitted to each NAT gateway, so that each extranet access request can be transmitted in an orderly manner, further improving the efficiency of extranet access. Moreover, the priority is determined based on the connection properties between the NAT gateway and the branch intranet devices, which improves the reliability of each priority and thus the reliability of the entire extranet access process.

[0104] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0105] Based on the same inventive concept, the embodiment of the present application also provides an external network access device for implementing the external network access method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more external network access device embodiments provided below can refer to the limitations on the external network access method above, and will not be repeated here.

[0106] In an exemplary embodiment, as shown in FIG. 15 , an external network access device is provided, including: a routing priority acquisition module 1502, for acquiring the priority of each external network access request for transmitting the external network access request to at least two gateway servers respectively when receiving an external network access request sent by at least one internal network device; the priority is determined based on the connection attribute between the gateway server and the internal network device; a first network address translation module 1504, for sending the external network access request to the first gateway server with the highest priority among the gateway servers to perform network address translation; a second gateway service determination module 1506, for filtering out the second gateway server with the highest priority except the first gateway server from the gateway servers when an exception occurs in the process of network address translation of the first gateway server; a second network address translation module 1508, for sending the external network access request to the second gateway server to perform network address translation; and a module 1510 for generating external network access results, for obtaining the external network access result of the internal network device when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

[0107] In one of the embodiments, the first network address translation module 1504 is also used to: send an external network access request to the first gateway server, and query the external network whitelist of the internal network device that initiates the external network access request through the first gateway server; the external network whitelist records the external network addresses that are allowed to be accessed by the internal network device; when the external network whitelist contains the external network address indicated by the external network access request, perform network address translation through the first gateway server.

[0108] In one embodiment, the first network address translation module 1504 is also used to: obtain the routing index of the intranet device that initiates the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the intranet device; and perform network address translation based on the routing index.

[0109] In one of the embodiments, the device is also used to: when receiving an intranet access request sent by a target external network and forwarded by each gateway server, obtain the fixed network address of the gateway server for each gateway server; screen out selected devices that have a mapping relationship with the gateway server among each intranet device; update the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain a target access request; the target access request is used for the target external network to access the selected device.

[0110] In one of the embodiments, the device is also used to: when receiving a response signal fed back by the selected device based on the target access request, send the response signal to the gateway server; receive the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0111] In one of the embodiments, the device is also used to: receive an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; decrypt the encrypted access request to obtain an external network access request.

[0112] Each module in the above-mentioned external network access device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0113] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG16. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store external network access data. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an external network access method is implemented.

[0114] Those skilled in the art will understand that the structure shown in FIG. 16 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0115] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: upon receiving an external network access request sent by at least one internal network device, obtaining, for each external network access request, a priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection attribute between the gateway server and the internal network device; for a first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server to perform network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out a second gateway server with the highest priority except the first gateway server from the gateway servers; sending the external network access request to the second gateway server to perform network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, obtaining the external network access result of the internal network device.

[0116] In one embodiment, when the processor executes the computer program, it also implements the following steps: sending an external network access request to the first gateway server, querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records the external network addresses that are allowed to be accessed by the internal network device; when the external network whitelist contains the external network address indicated by the external network access request, performing network address conversion through the first gateway server.

[0117] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining the routing index of the intranet device that initiates the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the intranet device; and performing network address translation based on the routing index.

[0118] In one embodiment, the processor also implements the following steps when executing the computer program: when receiving the intranet access request sent by the target external network forwarded by each gateway server, obtaining the fixed network address of the gateway server for each gateway server; screening out the selected devices that have a mapping relationship with the gateway server among each intranet device; updating the intranet access request based on the fixed network address and the target intranet address of the selected device to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0119] In one embodiment, the processor also implements the following steps when executing the computer program: when receiving a response signal fed back by the selected device based on the target access request, sending the response signal to the gateway server; receiving the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0120] In one embodiment, when the processor executes the computer program, it also implements the following steps: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; decrypting the encrypted access request to obtain an external network access request.

[0121] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and the following steps are implemented when the computer program is executed by a processor: when an external network access request sent by at least one internal network device is received, for each external network access request, the priority of the external network access request to be transmitted to at least two gateway servers respectively is obtained; the priority is determined based on the connection attribute between the gateway server and the internal network device; for the first gateway server with the highest priority among the gateway servers, the external network access request is sent to the first gateway server to perform network address translation; when an exception occurs in the first gateway server during the network address translation process, the second gateway server with the highest priority except the first gateway server is screened out from the gateway servers; the external network access request is sent to the second gateway server to perform network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, the external network access result of the internal network device is obtained.

[0122] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending an external network access request to the first gateway server, querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records the external network addresses that are allowed to be accessed by the internal network device; when the external network whitelist contains the external network address indicated by the external network access request, performing network address conversion through the first gateway server.

[0123] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the routing index of the intranet device that initiates the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the intranet device; and performing network address translation based on the routing index.

[0124] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when receiving the intranet access request sent by the target external network forwarded by each gateway server, the fixed network address of the gateway server is obtained for each gateway server; among each intranet device, the selected device that has a mapping relationship with the gateway server is screened out; based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when a response signal based on the target access request feedback from the selected device is received, the response signal is sent to the gateway server; the target result returned by the gateway server in response to the response signal is received; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; decrypting the encrypted access request to obtain an external network access request.

[0127] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: when receiving an external network access request sent by at least one internal network device, for each external network access request, obtaining the priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on the connection attribute between the gateway server and the internal network device; for a first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server for network address translation; when an exception occurs in the first gateway server during the network address translation process, filtering out a second gateway server with the highest priority except the first gateway server from the gateway servers; sending the external network access request to the second gateway server for network address translation; when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request, obtaining the external network access result of the internal network device.

[0128] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending an external network access request to the first gateway server, querying the external network whitelist of the internal network device that initiated the external network access request through the first gateway server; the external network whitelist records the external network addresses that are allowed to be accessed by the internal network device; when the external network whitelist contains the external network address indicated by the external network access request, performing network address conversion through the first gateway server.

[0129] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the routing index of the intranet device that initiates the external network access request through the first gateway server; there is a one-to-one correspondence between the routing index and the intranet device; and performing network address translation based on the routing index.

[0130] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when receiving the intranet access request sent by the target external network forwarded by each gateway server, the fixed network address of the gateway server is obtained for each gateway server; among each intranet device, the selected device that has a mapping relationship with the gateway server is screened out; based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain the target access request; the target access request is used for the target external network to access the selected device.

[0131] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when a response signal based on the target access request feedback from the selected device is received, the response signal is sent to the gateway server; the target result returned by the gateway server in response to the response signal is received; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

[0132] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; decrypting the encrypted access request to obtain an external network access request.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0134] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0135] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for accessing an external network, characterized in that: The method comprises: Upon receiving an external network access request sent by at least one internal network device, for each of the external network access requests, obtaining a priority of the external network access request to be transmitted to at least two gateway servers respectively; the priority is determined based on a connection attribute between the gateway server and the internal network device; For the first gateway server with the highest priority among the gateway servers, sending the external network access request to the first gateway server to perform network address translation; When an exception occurs in the network address translation process of the first gateway server, a second gateway server with the highest priority is selected from the gateway servers except the first gateway server; Sending the external network access request to the second gateway server for network address translation; When the second gateway server converts the intranet address of the intranet device into the public network address of the extranet indicated by the extranet access request, the extranet access result of the intranet device is obtained.

2. The method according to claim 1, characterized in that The sending the external network access request to the first gateway server to perform network address translation includes: Sending the external network access request to the first gateway server, querying the external network whitelist of the intranet device that initiated the external network access request through the first gateway server; the external network whitelist records the external network addresses that the intranet device is allowed to access; When the external network whitelist includes the external network address indicated by the external network access request, network address translation is performed through the first gateway server.

3. The method according to claim 2, characterized in that The performing of network address translation by the first gateway server includes: Obtaining, through the first gateway server, a routing index of the intranet device that initiates the external network access request; the routing index and the intranet device have a one-to-one correspondence; Based on the routing index, network address translation is performed.

4. The method according to claim 1, characterized in that: The method further comprises: Upon receiving the intranet access request sent by the target external network and forwarded by each of the gateway servers, obtaining the fixed network address of the gateway server for each of the gateway servers; Filtering out selected devices that have a mapping relationship with the gateway server from among the intranet devices; Based on the fixed network address and the target intranet address of the selected device, the intranet access request is updated to obtain a target access request; the target access request is used for the target extranet to access the selected device.

5. The method according to claim 4, characterized in that The method further comprises: When receiving a response signal fed back by the selected device based on the target access request, sending the response signal to the gateway server; Receive the target result returned by the gateway server in response to the response signal; the target result is generated after the gateway server converts the fixed network address carried by the response signal to obtain an external network address, and sends the response signal to the target external network belonging to the external network address.

6. The method according to claim 1, characterized in that The method further comprises: Receiving an encrypted access request sent by at least one intranet device through a data transmission channel established based on a network security protocol; The encrypted access request is decrypted to obtain an external network access request.

7. An external network access device, characterized in that: The device comprises: A routing priority acquisition module, configured to, upon receiving an external network access request sent by at least one internal network device, acquire, for each external network access request, a priority of the external network access request for transmission to at least two gateway servers; the priority is determined based on a connection attribute between the gateway server and the internal network device; A first network address translation module, configured to send the external network access request to the first gateway server with the highest priority among the gateway servers to perform network address translation; Determine a second gateway service module, which is used to filter out the second gateway server with the highest priority from each of the gateway servers except the first gateway server when an exception occurs in the process of network address translation of the first gateway server; A second network address translation module, used for sending the external network access request to the second gateway server for network address translation; The module for generating the external network access result is used to obtain the external network access result of the internal network device when the second gateway server converts the internal network address of the internal network device into the public network address of the external network indicated by the external network access request.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images