Remote security access method and device and security gateway equipment

Abstract

The invention provides a remote security access method and device and security gateway equipment, and relates to the field of security gateways. The method is applied to security gateway equipment, and comprises the following steps that: a tunnel proxy server side adopts a plurality of processes to monitor service request messages of tunnel proxy clients on a plurality of hosts in parallel, and adopts a plurality of processes to create a plurality of sessions in parallel according to the monitored service request messages, the plurality of sessions respectively correspond to the tunnel proxy clients on the plurality of hosts, and the tunnel proxy server adopts a plurality of processes, calls the virtual network equipment in parallel according to the plurality of sessions, and remotely accesses the intranet server. A plurality of processes are adopted by a tunnel proxy server, a plurality of service request messages can be monitored in parallel, high-concurrency tunnel proxy is realized, then a plurality of sessions are created, and the plurality of service request messages are forwarded to an intranet server by calling virtual network equipment, so that parallel remote access of a plurality of hosts to the intranet server is realized.

Description

Technical Field

[0001] The present invention relates to the field of security gateways, and in particular to a remote security access method, device and security gateway equipment. Background Art

[0002] Security gateway devices use the Secure Socket Layer (SSL) protocol to establish a remote secure access channel to achieve remote secure access to the intranet server by the client. SSL Virtual Private Network (VPN) technology is a VPN technology that has emerged in recent years. With the popularization of the Internet and the rapid development of e-commerce and remote office, it has been widely used. IP tunnel proxy is a network technology that refers to forwarding network requests through a proxy server to achieve anonymization and encryption of network connections. This proxy method can automatically forward requests to different proxy IPs on the proxy server to achieve continuous IP changes. Implementing tunnel proxy on a security gateway device can further improve the security of tunnel proxy.

[0003] However, since the character devices of the virtual network devices in the security gateway device can only be exclusive, this requires the user to be a single process or a single thread, and cannot read and write in a multi-process or multi-thread concurrent manner, resulting in a bottleneck in data forwarding. Summary of the invention

[0004] The purpose of the present invention is to provide a remote secure access method, device and security gateway device to address the deficiencies in the above-mentioned prior art, so as to adopt multiple processes through the tunnel proxy server to monitor multiple service request messages in parallel, realize high-concurrency tunnel proxy, and then create multiple sessions. By calling a virtual network device, multiple service request messages are forwarded to the intranet server, thereby realizing parallel remote access of multiple hosts to the intranet server.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows: In a first aspect, an embodiment of the present application provides a remote secure access method, which is applied to a security gateway device, wherein the security gateway device is integrated with: a tunnel proxy server and a virtual network device, and the method includes: The tunnel proxy server uses multiple processes to monitor the service request messages of the tunnel proxy clients on multiple hosts in parallel; The tunnel proxy server uses the multiple processes to create multiple sessions in parallel according to the multiple service request messages monitored, and the multiple sessions correspond to the tunnel proxy clients on the multiple hosts respectively; The tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server.

[0006] In an optional implementation manner, before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method further includes: The tunnel proxy server starts a preset reverse proxy server and creates the multiple processes through the preset reverse proxy server.

[0007] In an optional implementation manner, before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method further includes: The tunnel proxy server obtains the service communication ports of the multiple hosts, where the service communication port of each host is used to represent the service application on each host; The tunnel proxy server creates a virtual communication address pool according to the service communication ports of the multiple hosts, wherein the virtual communication address pool includes: virtual communication addresses of service applications on the multiple hosts, and the virtual communication address of the service application on each host is used to characterize the service application on each host; The tunnel proxy server sends the virtual communication addresses of the service applications on the multiple hosts to the multiple hosts respectively; The tunnel proxy server routes the virtual communication addresses of the business applications on the multiple hosts to the virtual network device.

[0008] In an optional implementation manner, each service request message is: a service message obtained by a tunnel proxy client on a corresponding host in the following manner; Obtaining the business data of the business application, the source address of the first protocol and the destination address of the first protocol; wherein the source address of the first protocol includes: the virtual communication address of the business application on the corresponding host, the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; The business data of the business application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain the business request message, wherein the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device.

[0009] In an optional implementation manner, the tunnel proxy server uses the multiple processes to create multiple sessions in parallel according to the multiple service request messages monitored, including: The tunnel proxy server uses each process to create a first processing program and a second processing program of the corresponding host according to the service request message of the corresponding host, and obtains a session including the first processing program and the second processing program.

[0010] In an optional implementation manner, the tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server, including: The tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process; The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

[0011] In an optional implementation manner, the tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program, including: The tunnel proxy server uses each process to call the communication socket program of the corresponding host among the multiple communication socket programs in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket program of the corresponding host.

[0012] In an optional implementation manner, the tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server, further comprising: The virtual network device receives the service response message of the first protocol sent by the intranet server; The virtual network device determines a target virtual communication address according to the destination communication address in the service response message; The virtual network device queries the target communication socket program corresponding to the target virtual communication address according to the target virtual communication address and the pre-recorded correspondence between the virtual communication address and the communication socket program; The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket program through the target communication socket program; The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session; The tunnel proxy server uses the first processing program in the target session to convert the business response message of the first protocol into the business response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the business response message of the second protocol into the business response message of the first protocol, and passes it to the business application on the target host.

[0013] In a second aspect, an embodiment of the present application further provides a remote security access device, comprising: a tunnel proxy server and a virtual network device, wherein the tunnel proxy server is used to execute the method steps executed by any of the tunnel proxy server in the first aspect, and the virtual network device is used to execute the method steps executed by any of the virtual network devices in the first aspect.

[0014] In the third aspect, an embodiment of the present application also provides a security gateway device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the security gateway device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to perform the steps of any remote security access method described in the first aspect.

[0015] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the remote secure access method described in any one of the first aspects are executed.

[0016] The beneficial effects of this application are: The embodiment of the present application provides a remote secure access method, device and security gateway device, which are applied to the security gateway device. The security gateway device is integrated with: a tunnel proxy server and a virtual network device. The method includes: the tunnel proxy server adopts multiple processes to monitor the service request messages of the tunnel proxy clients on multiple hosts in parallel, the tunnel proxy server adopts multiple processes to create multiple sessions in parallel according to the multiple service request messages monitored, and the multiple sessions correspond to the tunnel proxy clients on multiple hosts respectively, and the tunnel proxy server adopts multiple processes to call the virtual network device in parallel according to the multiple sessions to remotely access the intranet server. The method of the present application can monitor multiple service request messages in parallel by using multiple processes on the tunnel proxy server to realize high-concurrency tunnel proxy, and then create multiple sessions, and then forward multiple service request messages to the intranet server by calling the virtual network device, so as to realize parallel remote access of multiple hosts to the intranet server, improve the efficiency of remote access of multiple clients to the intranet server, and multiple hosts do not need to remotely access the intranet server in sequence. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a remote secure access provided by an embodiment of the present application; Figure 2 One of the flow charts of a remote secure access method provided in an embodiment of the present application; Figure 3 A second flowchart of a remote secure access method provided in an embodiment of the present application; Figure 4 A third flowchart of a remote secure access method provided in an embodiment of the present application; Figure 5 A fourth flowchart of a remote secure access method provided in an embodiment of the present application; Figure 6 A schematic diagram of functional modules of a remote security access device provided in an embodiment of the present application; Figure 7 A schematic diagram of a security gateway device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0020] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0021] In the description of the present application, it should be noted that if the terms "upper", "lower", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the application is usually placed when used. It is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.

[0022] In addition, the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0024] In order to better understand the solutions provided by the following embodiments of the present application, the technical terms involved in the following embodiments of the present application are first explained here.

[0025] The security gateway device establishes a remote secure access channel by adopting the Secure Socket Layer (SSL) protocol to realize the remote secure access of the client to the intranet server.

[0026] IP tunnel proxy indicates that network requests are forwarded through a proxy server, thereby achieving anonymization and encryption of network connections. This tunnel proxy method can automatically forward requests to different proxy IPs on the proxy server to achieve continuous changes in IP addresses. Implementing IP tunnel proxy on a security gateway device can further improve the security of IP tunnel proxy.

[0027] At present, the existing security gateway devices are integrated with: the original tunnel proxy server and the original virtual network device. The original virtual network device (Tunnel over IP / Tap Device, TUN / TAP) is used to provide data receiving and transmission functions to user-layer programs. The original virtual network device includes character devices and network devices. Since character devices can only be monopolized, the user must be a single process or a single thread. That is, only after one client has completed remote access to the intranet server through the security gateway device, the next client can remotely access the intranet server through the security gateway device, resulting in low efficiency and slow response of multiple clients remotely accessing the intranet server.

[0028] Therefore, the present invention provides a remote secure access method. Figure 1 A flowchart of a remote secure access provided by an embodiment of the present application is shown in FIG. Figure 1 As shown, the security gateway device is integrated with a tunnel proxy server and a virtual network device. A preset reverse proxy server is introduced into the tunnel proxy server. The preset reverse proxy server is a deployment mode of a proxy server. The client sends a request to the preset reverse proxy server, which is the target server for the client. Since the reverse proxy server (engine x, Nginx) has high concurrency, high reliability, easy configuration and open source characteristics, the reverse proxy server Nginx is introduced into the tunnel proxy server as a preset reverse proxy server to achieve high concurrency tunnel proxy and improve the efficiency of multiple clients' remote access to the intranet server.

[0029] However, Nginx implements reverse proxy based on the stream + session model, that is, the client first establishes a stream (called downstream) with Nginx, which is the first processing procedure in the following embodiments of this application. Under the security gateway device, the stream is TCP. Correspondingly, Nginx establishes a stream (called upstream), which is the second processing procedure in the following embodiments of this application, and must also be TCP. The two flows form a session and forward traffic to each other. In the scenario where Nginx is used as the preset reverse proxy server in this application, the upstream establishes a connection with the intranet server being proxied. In the case of a tunnel proxy, the security gateway device only forwards IP packets on behalf of the client, and needs to forward IP packets through the original virtual network device. However, since the character device of the original virtual network device can only be monopolized and cannot be adapted to the preset reverse proxy server, this application does not use character devices as user-mode and kernel-mode data channels. By setting up multiple communication sockets to forward IP packets, it not only adapts to the preset reverse proxy server, but also solves the problem that character devices can only be monopolized, and realizes multi-threaded concurrency. Among them, the communication socket Socket is an abstract layer. Applications can send or receive data streams through the communication socket, and can perform operations such as opening, reading, writing and closing on them like files. Specifically, the communication socket is an abstraction of an endpoint for two-way communication between application processes on different hosts in a network.

[0030] The remote secure access method provided by the present application is described below by using multiple examples in conjunction with the accompanying drawings. The remote secure access method is applied to a security gateway device, which is integrated with: a tunnel proxy server and a virtual network device. Figure 2 One of the flow charts of a remote secure access method provided in an embodiment of the present application is as follows: Figure 2 As shown, the method includes: S101. The tunnel proxy server uses multiple processes to monitor service request messages of tunnel proxy clients on multiple hosts in parallel.

[0031] In this embodiment, the tunnel proxy server introduces the preset reverse proxy server Nginx. Since the preset reverse proxy server Nginx has the characteristics of high concurrency, it can monitor the business request messages of tunnel proxy clients on multiple hosts in parallel with multiple processes. The business request message is a business message obtained by encapsulating and processing the business data of the business application by multiple tunnel proxy clients.

[0032] S102: The tunnel proxy server uses multiple processes to create multiple sessions in parallel according to multiple monitored service request messages.

[0033] The multiple sessions correspond to tunnel proxy clients on the multiple hosts respectively.

[0034] The preset reverse proxy server Nginx in the tunnel proxy server creates a corresponding session for each service request message monitored, so that multiple sessions respectively establish tunnels with the tunnel proxy clients on multiple hosts for transmitting service request messages, wherein the created session is a time domain Session session for forwarding service request messages.

[0035] S103, the tunnel proxy server uses multiple processes to call virtual network devices in parallel according to multiple sessions to remotely access the intranet server.

[0036] Specifically, the preset reverse proxy server Nginx in the tunnel proxy server is connected to the virtual network device, and by calling the virtual network device in parallel, the business data in the business request message is forwarded to the intranet server, thereby realizing parallel remote access of the intranet server by the tunnel proxy clients on multiple hosts.

[0037] In summary, the embodiment of the present application provides a remote security access method, which is applied to a security gateway device, and the security gateway device is integrated with: a tunnel proxy server and a virtual network device, and the method includes: the tunnel proxy server adopts multiple processes to monitor the service request messages of the tunnel proxy clients on multiple hosts in parallel, the tunnel proxy server adopts multiple processes, and creates multiple sessions in parallel according to the multiple service request messages monitored, and the multiple sessions correspond to the tunnel proxy clients on multiple hosts respectively, and the tunnel proxy server adopts multiple processes, and calls the virtual network device in parallel according to the multiple sessions to remotely access the intranet server. The method of the present application, through the tunnel proxy server adopts multiple processes, can monitor multiple service request messages in parallel, realize high-concurrency tunnel proxy, and then create multiple sessions, and then forward multiple service request messages to the intranet server by calling the virtual network device, so as to realize parallel remote access of multiple hosts to the intranet server, improve the efficiency of remote access of multiple clients to the intranet server, and multiple hosts do not need to remotely access the intranet server in sequence.

[0038] The embodiment of the present application also provides another possible implementation of the remote secure access method. Before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method also includes: The tunnel proxy server starts the preset reverse proxy server and creates multiple processes through the preset reverse proxy server.

[0039] In this embodiment, the tunnel proxy server introduces a preset reverse proxy server Nginx, which has a high concurrency feature. After starting the preset reverse proxy server Nginx, multiple processes can be created to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, thereby realizing a high-concurrency tunnel proxy.

[0040] The present application embodiment also provides another possible implementation of the remote secure access method. Figure 3 A second flow chart of a remote secure access method provided in an embodiment of the present application is as follows: Figure 3 As shown, before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method also includes: S201. The tunnel proxy server obtains the service communication ports of multiple hosts.

[0041] In this embodiment, the tunnel proxy clients of multiple hosts connect to the security gateway device by inputting the public network address information of the security gateway device, and the tunnel proxy server can obtain the business communication ports of multiple hosts, where the business communication port of each host is used to represent the business application on each host.

[0042] In addition, the tunnel proxy server can also obtain the actual communication addresses of multiple hosts.

[0043] S202: The tunnel proxy server creates a virtual communication address pool according to the service communication ports of multiple hosts.

[0044] The virtual communication address pool includes: virtual communication addresses of service applications on multiple hosts, and the virtual communication address of the service application on each host is used to represent the service application on each host.

[0045] The tunnel proxy server creates corresponding virtual communication addresses for business applications on multiple hosts according to the business communication ports of multiple hosts, and obtains a virtual communication address pool.

[0046] S203: The tunnel proxy server sends the virtual communication addresses of the business application programs on the multiple hosts to the multiple hosts respectively.

[0047] S204: The tunnel proxy server routes the virtual communication addresses of the business applications on the multiple hosts to the virtual network devices.

[0048] Specifically, the tunnel proxy server sends the virtual communication addresses of the business applications on multiple hosts to multiple hosts, specifically to the virtual network devices in the multiple hosts, so that the tunnel proxy clients of the multiple hosts can communicate with the tunnel proxy server through the corresponding virtual communication addresses.

[0049] The tunnel proxy server also routes the virtual communication addresses of the service applications on the multiple hosts to the virtual network device, so that the virtual network device records the virtual communication addresses of the service applications on the multiple hosts.

[0050] In the method provided in the embodiment of the present application, the tunnel proxy server obtains the business communication ports of multiple hosts, the business communication port of each host is used to characterize the business application on each host, the tunnel proxy server creates a virtual communication address pool based on the business communication ports of the multiple hosts, the virtual communication address pool includes: virtual communication addresses of business applications on multiple hosts, the virtual communication addresses of business applications on each host are used to characterize the business applications on each host, the tunnel proxy server sends the virtual communication addresses of business applications on multiple hosts to multiple hosts respectively, and the tunnel proxy server routes the virtual communication addresses of business applications on multiple hosts to a virtual network device. The tunnel proxy server creates a virtual communication address for the business application on each host, so that the tunnel proxy client of each host can communicate with the tunnel proxy server through the virtual communication address.

[0051] The embodiment of the present application also provides another possible implementation of the remote secure access method, where each service request message is: a service message obtained by the tunnel proxy client on the corresponding host in the following manner.

[0052] Business data of the business application, a source address of the first protocol, and a destination address of the first protocol are obtained.

[0053] The source address of the first protocol includes: a virtual communication address of the corresponding host and a service communication port of the corresponding host, and the destination address of the first protocol includes: a communication address and a communication port of the intranet server.

[0054] In this embodiment, the virtual network device corresponding to the host obtains the business data of the business application, encapsulates the business data according to the source address of the first protocol and the destination address of the first protocol, and obtains the business message of the first protocol, wherein the first protocol is the Internet Protocol (IP) protocol, the source address of the IP protocol includes: the virtual communication address V_IP of the business application on the corresponding host, and the business communication port V_Port of the business application on the corresponding host, and the destination address of the IP protocol includes: the communication address Dst_IP of the intranet server, and the communication port Dst_Port of the intranet server, wherein the virtual communication address V_IP of the business application on the corresponding host is the virtual communication address created by the tunnel proxy server for the business application on the host.

[0055] The business data of the business application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain a business request message, wherein the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device.

[0056] Specifically, the corresponding virtual network device encapsulates the business data of the business application, the source address of the first protocol and the destination address of the first protocol to obtain a message of the first protocol, and then encapsulates the business request message of the first protocol, the source address of the second protocol and the destination address of the second protocol to obtain a message of the second protocol, and sends the message of the second protocol, i.e., the business request message, to the security gateway device through the tunnel proxy client, and the tunnel proxy server in the security gateway device uses multiple processes to monitor the business request message sent by the tunnel proxy client.

[0057] Among them, the second protocol is the Transmission Control Protocol (TCP) protocol, the source address of the TCP protocol includes: the communication address Cli_IP of the corresponding host, the communication port Cli_Port of the corresponding host, and the destination address of the TCP protocol includes: the communication address SSLVPN_Serv_IP of the security gateway device, and the communication port SSLVPN_Serv_Port of the security gateway device.

[0058] In the method provided in the embodiment of the present application, the tunnel proxy client on the corresponding host obtains the business data of the business application, the source address of the first protocol and the destination address of the first protocol; wherein the source address of the first protocol includes: the virtual communication address of the business application on the corresponding host, the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; then the business data of the business application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain a business request message, wherein the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device. Since the tunnel between the tunnel proxy clients on multiple hosts and the tunnel proxy server on the security gateway device is a second protocol tunnel, it can only transmit messages of the second protocol. The tunnel proxy clients on multiple hosts encapsulate the acquired business data of the business application, the source address of the first protocol and the destination address of the first protocol to obtain messages of the first protocol. Therefore, it is also necessary to encapsulate the messages of the first protocol, the source address of the second protocol and the destination address of the second protocol to obtain messages of the second protocol for transmission in the second protocol tunnel, so that the tunnel proxy server adopts multiple processes to receive business request messages by parallelly monitoring the communication address and communication port of the security gateway device in the business request message.

[0059] The embodiment of the present application also provides another possible implementation of the remote secure access method. The tunnel proxy server uses multiple processes to create multiple sessions in parallel according to multiple monitored service request messages, including: The tunnel proxy server uses each process to create a first processing program and a second processing program of the corresponding host according to the service request message of the corresponding host, and obtains a session including the first processing program and the second processing program.

[0060] In this embodiment, the tunnel proxy server introduces a preset reverse proxy server Nginx, and the preset reverse proxy server Nginx implements reverse proxy based on the flow + session model, that is, Nginx first establishes a flow (called downstream) with the tunnel proxy client, that is, the first processing program. Under the security gateway device, the flow is TCP, that is, the first processing program processes TCP packets, and the service request packets also need to be TCP packets. Correspondingly, Nginx establishes a flow (called upstream) with the intranet server, that is, the second processing program, which must also be TCP. A session is formed through two flow lines to forward traffic to each other.

[0061] The preset reverse proxy server Nginx creates a first processing program and a second processing program for the corresponding host according to the service request message of the corresponding host monitored, forms a session corresponding to the host, and is used to process the service request message of the host.

[0062] The present application embodiment also provides another possible implementation of the remote secure access method. Figure 4 A third flow chart of a remote secure access method provided in an embodiment of the present application is as follows: Figure 4 As shown, the tunnel proxy server uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server, including: S301, the tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process.

[0063] S302: The tunnel proxy server uses each process to call a virtual network device according to a second processing program to transmit a service request message of the first protocol to an intranet server for remote access.

[0064] In this embodiment, the service request message received by the first handler in the session corresponding to each process is a service request message of the second protocol, namely, a TCP service request message. The first handler decapsulates the service request message of the second protocol to obtain a service request message of the first protocol, namely, an IP service request message, and transmits the service request message of the first protocol to the second handler in the corresponding session.

[0065] It should be noted that the original second processing program is to preset the reverse proxy server Nginx to establish a flow (called upstream) with the intranet server, which is a TCP flow. Therefore, the message forwarded by the original second processing program to the intranet server should also be a TCP message. That is, the original second processing program also needs to encapsulate the service request message of the first protocol, namely the IP service request message, into a service request message of the second protocol, namely the TCP service request message, and then forward it to the intranet server.

[0066] In order to directly transmit the service request message of the first protocol to the intranet server through the virtual network device, the present application modifies the original second processing program. Through the IO control method, the sending interface of the second processing program is modified to an interface for sending IP messages, and the service request message of the first protocol is directly delivered to the virtual network device, so that the virtual network device forwards the service request message of the first protocol to the intranet server through the protocol stack, thereby realizing remote access of the corresponding host to the intranet server.

[0067] Optionally, the tunnel proxy server uses each process to call the communication socket program of the corresponding host among multiple communication socket programs in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket program of the corresponding host.

[0068] Among them, since the original virtual network device includes a character device and a network device, and the character device can only be monopolized and cannot be adapted to the preset reverse proxy server, this embodiment no longer uses the character device as a user-mode and kernel-mode data channel, and forwards the service request message of the first protocol by setting up multiple communication sockets, which not only adapts to the preset reverse proxy server, but also solves the problem that the character device can only be monopolized, thereby improving the concurrency capability of the virtual network device and realizing multi-threaded concurrency.

[0069] It should be noted that the receiving buffers of multiple communication socket programs are independent of each other and do not affect each other, which can reduce the risk of packet loss caused by overflow of the receiving buffer and avoid the situation where packet loss causes a large number of messages to be retransmitted, reducing the utilization of network bandwidth.

[0070] At the same time, the virtual network device uses an array table to record the corresponding relationship between the virtual communication address V_IP of the corresponding host and the communication socket program TCP Socket of the corresponding host, and can find the corresponding communication socket program through the virtual communication address.

[0071] In the method provided in the embodiment of the present application, the tunnel proxy server adopts each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtain the service request message of the first protocol, and transmit the service request message of the first protocol to the second processing program in the session corresponding to each process. The tunnel proxy server adopts each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program, and processes and transmits the service request message through the session corresponding to each process, so as to realize the remote access of the corresponding host to the intranet server.

[0072] The present application embodiment also provides another possible implementation of the remote secure access method. Figure 5 A fourth flowchart of a remote secure access method provided in an embodiment of the present application is as follows: Figure 5 As shown, the tunnel proxy server uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server, and also includes: S401. A virtual network device receives a service response message of a first protocol sent by an intranet server.

[0073] In this embodiment, the intranet server responds to the service data in the received service request message of the first protocol and replies with a service response message of the first protocol.

[0074] Among them, the business response message of the first protocol is a business response message obtained by encapsulating the response data, the source exchange address of the first protocol and the destination exchange address of the first protocol by the intranet server. The source exchange address of the first protocol includes: the communication address Dst_IP of the intranet server and the communication port Dst_Port of the intranet server. The destination exchange address of the first protocol includes: the destination communication address V_IP of the business application on the corresponding host and the business communication port V_Port of the business application on the corresponding host.

[0075] S402: The virtual network device determines a target virtual communication address according to the destination communication address in the service response message.

[0076] S403: The virtual network device queries the target communication socket program corresponding to the target virtual communication address according to the target virtual communication address and the pre-recorded correspondence between the virtual communication address and the communication socket program.

[0077] Since the tunnel proxy server routes the virtual communication addresses of multiple hosts to the virtual network device, the virtual network device can determine the target virtual communication address according to the destination communication address in the service response message.

[0078] At the same time, the virtual network device also uses an array table to pre-record the correspondence between the virtual communication address and the communication socket program. By directly addressing through the address pool offset, the corresponding target communication socket program can be quickly queried through the target virtual communication address.

[0079] S404: The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket program through the target communication socket program.

[0080] S405: The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session.

[0081] S406. The tunnel proxy server uses the first processing program in the target session to convert the business response message of the first protocol into a business response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the business response message of the second protocol into a business response message of the first protocol, and passes it to the business application on the target host.

[0082] Among them, after the first processing program in the target session receives the service response message of the first protocol, it encapsulates the service response message of the first protocol, the source exchange address of the second protocol and the destination exchange address of the second protocol to obtain the service response message of the second protocol, wherein the source exchange address of the second protocol includes: the communication address SSLVPN_Serv_IP of the security gateway device and the communication port SSLVPN_Serv_Port of the security gateway device, and the destination exchange address of the second protocol includes: the communication address Cli_IP of the corresponding host and the communication port Cli_Port of the corresponding host.

[0083] The service response message of the second protocol is then transmitted to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client decapsulates the service response message of the second protocol, converts it into a service response message of the first protocol, and passes it to the service application on the target host.

[0084] In the method provided by the embodiment of the present application, the virtual network device receives the service response message of the first protocol sent by the intranet server, and the virtual network device determines the target virtual communication address according to the destination communication address in the service response message; the virtual network device queries the target communication socket corresponding to the target virtual communication address according to the target virtual communication address and the correspondence between the virtual communication address and the communication socket recorded in advance, and the virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket through the target communication socket, and the tunnel proxy service end adopts the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session, and the tunnel proxy service end adopts the first processing program in the target session to convert the service response message of the first protocol into the service response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session, and the tunnel proxy client on the target host converts the service response message of the second protocol into the service response message of the first protocol, and transmits it to the service application on the target host. By processing the service response message of the first protocol sent by the intranet server, the intercommunication of service data is realized.

[0085] The following is a corresponding explanation of the remote security access device and security gateway device provided by any of the above embodiments of the present application. The specific implementation process and the technical effects produced are the same as those of the corresponding method embodiments mentioned above. For the sake of brief description, the parts not mentioned in this embodiment can refer to the corresponding contents in the method embodiments.

[0086] Figure 6 A schematic diagram of the functional modules of a remote security access device provided in an embodiment of the present application. Figure 6 As shown, the remote secure access device 100 includes: a tunnel proxy server 110 and a virtual network device 120: The tunnel proxy server 110 uses multiple processes to monitor the service request messages of the tunnel proxy clients on multiple hosts in parallel; The tunnel proxy server 110 uses multiple processes to create multiple sessions in parallel according to multiple service request messages monitored, and the multiple sessions correspond to the tunnel proxy clients on multiple hosts respectively; The tunnel proxy server 110 uses multiple processes to call virtual network devices in parallel according to multiple sessions to remotely access the intranet server.

[0087] Optionally, the tunnel proxy server 110 starts a preset reverse proxy server and creates multiple processes through the preset reverse proxy server.

[0088] Optionally, the tunnel proxy server 110 obtains the service communication ports of multiple hosts, and the service communication port of each host is used to characterize the service application on each host; The tunnel proxy server 110 creates a virtual communication address pool according to the service communication ports of the multiple hosts, wherein the virtual communication address pool includes: virtual communication addresses of service applications on the multiple hosts, wherein the virtual communication address of the service application on each host is used to characterize the service application on each host; The tunnel proxy server 110 sends the virtual communication addresses of the service application programs on the multiple hosts to the multiple hosts respectively; The tunnel proxy server 110 routes the virtual communication addresses of the service applications on the multiple hosts to the virtual network devices.

[0089] Optionally, each service request message is: a service message obtained by the tunnel proxy client 110 on the corresponding host in the following manner; obtaining the service data of the service application, the source address of the first protocol and the destination address of the first protocol; wherein the source address of the first protocol includes: the virtual communication address of the service application on the corresponding host, the service communication port of the service application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; encapsulating the service data of the service application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol and the destination address of the second protocol into a message of the second protocol to obtain a service request message, wherein the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device.

[0090] Optionally, the tunnel proxy server 110 uses each process to create a first processing program and a second processing program of the corresponding host according to the service request message of the corresponding host, and obtains a session including the first processing program and the second processing program.

[0091] Optionally, the tunnel proxy server 110 processes the service request message of the second protocol using each process according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process; The tunnel proxy server 110 uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

[0092] Optionally, the tunnel proxy server 110 uses each process to call the communication socket program of the corresponding host among the multiple communication socket programs in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket program of the corresponding host.

[0093] Optionally, the virtual network device 120 receives a service response message of the first protocol sent by the intranet server; The virtual network device 120 determines the target virtual communication address according to the destination communication address in the service response message; The virtual network device 120 queries the target communication socket program corresponding to the target virtual communication address according to the target virtual communication address and the pre-recorded correspondence between the virtual communication address and the communication socket program; The virtual network device 120 transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket program through the target communication socket program; The tunnel proxy server 110 uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session; The tunnel proxy server 110 uses the first processing procedure in the target session to convert the business response message of the first protocol into a business response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the business response message of the second protocol into a business response message of the first protocol, and passes it to the business application on the target host.

[0094] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0095] Figure 7 This is a schematic diagram of a security gateway device provided in an embodiment of the present application, which can be used for remote secure access. Figure 7 As shown, the security gateway device includes: a processor 210 , a storage medium 220 , and a bus 230 .

[0096] The storage medium 220 stores machine-readable instructions executable by the processor 210. When the security gateway device is running, the processor 210 communicates with the storage medium 220 via the bus 230, and the processor 210 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0097] Optionally, the present application further provides a storage medium 220, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method embodiment are executed. The specific implementation method and technical effect are similar and will not be repeated here.

[0098] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0099] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0100] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0101] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, referred to as: ROM), random access memory (English: Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

[0102] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A remote secure access method, characterized in that: Applied to a security gateway device, the security gateway device is integrated with: a tunnel proxy server and a virtual network device, the method includes: The tunnel proxy server uses multiple processes to monitor the service request messages of the tunnel proxy clients on multiple hosts in parallel; The tunnel proxy server uses the multiple processes to create multiple sessions in parallel according to the multiple service request messages monitored, and the multiple sessions correspond to the tunnel proxy clients on the multiple hosts respectively; The tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server.

2. The method according to claim 1, characterized in that: Before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method further includes: The tunnel proxy server starts a preset reverse proxy server and creates the multiple processes through the preset reverse proxy server.

3. The method according to claim 1, characterized in that Before the tunnel proxy server uses multiple processes to monitor the first protocol messages of the tunnel proxy clients on multiple hosts in parallel, the method further includes: The tunnel proxy server obtains the service communication ports of the multiple hosts, where the service communication port of each host is used to represent the service application on each host; The tunnel proxy server creates a virtual communication address pool according to the service communication ports of the multiple hosts, wherein the virtual communication address pool includes: virtual communication addresses of service applications on the multiple hosts, and the virtual communication address of the service application on each host is used to characterize the service application on each host; The tunnel proxy server sends the virtual communication addresses of the service applications on the multiple hosts to the multiple hosts respectively; The tunnel proxy server routes the virtual communication addresses of the business applications on the multiple hosts to the virtual network device.

4. The method according to claim 3, characterized in that: Each service request message is: a service message obtained by the tunnel proxy client on the corresponding host in the following manner; Obtaining the business data of the business application, the source address of the first protocol and the destination address of the first protocol; wherein the source address of the first protocol includes: the virtual communication address of the business application on the corresponding host, the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; The business data of the business application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain the business request message, wherein the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device.

5. The method according to claim 1, characterized in that: The tunnel proxy server uses the multiple processes to create multiple sessions in parallel according to the multiple service request messages monitored, including: The tunnel proxy server uses each process to create a first processing program and a second processing program of the corresponding host according to the service request message of the corresponding host, and obtains a session including the first processing program and the second processing program.

6. The method according to claim 5, characterized in that The tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server, including: The tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process; The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

7. The method according to claim 6, characterized in that The tunnel proxy server uses each of the processes to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program, including: The tunnel proxy server uses each process to call the communication socket program of the corresponding host among the multiple communication socket programs in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket program of the corresponding host.

8. The method according to claim 7, characterized in that The tunnel proxy server uses the multiple processes to call the virtual network devices in parallel according to the multiple sessions to remotely access the intranet server, and further includes: The virtual network device receives the service response message of the first protocol sent by the intranet server; The virtual network device determines a target virtual communication address according to the destination communication address in the service response message; The virtual network device queries the target communication socket program corresponding to the target virtual communication address according to the target virtual communication address and the pre-recorded correspondence between the virtual communication address and the communication socket program; The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket program through the target communication socket program; The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session; The tunnel proxy server uses the first processing program in the target session to convert the business response message of the first protocol into the business response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the business response message of the second protocol into the business response message of the first protocol, and passes it to the business application on the target host.

9. A remote secure access device, characterized in that: The remote security access device includes: a tunnel proxy server and a virtual network device, wherein the tunnel proxy server is used to execute the method steps performed by the tunnel proxy server as claimed in any one of claims 1 to 8, and the virtual network device is used to execute the method steps performed by the virtual network device as claimed in any one of claims 1 to 8.

10. A security gateway device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the security gateway device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the remote security access method as described in any one of claims 1 to 8.

Images