A remote security access method, device and security gateway device

Abstract

The application provides a remote security access method and device and a security gateway device, and relates to the field of security gateways. The method is applied to a security gateway device and comprises the following steps: a tunnel agent server adopts multiple processes to listen to service request messages of tunnel agent clients on multiple hosts in parallel; the tunnel agent server adopts multiple processes to create multiple sessions in parallel according to the multiple service request messages; the multiple sessions correspond to the tunnel agent clients on the multiple hosts respectively; and the tunnel agent server adopts multiple processes to call a virtual network device in parallel according to the multiple sessions to perform remote access to an intranet server. By adopting multiple processes, the tunnel agent server can listen to multiple service request messages in parallel, implement high-concurrency tunnel agent, create multiple sessions, and then call the virtual network device to forward the multiple service request messages to the intranet server, thereby realizing parallel remote access of the multiple hosts to the intranet server.

Description

Technical Field

[0001] This invention relates to the field of security gateways, and more specifically, to a remote secure access method, apparatus, and security gateway device. Background Technology

[0002] Security gateway devices establish secure remote access channels using the Security Socket Layer (SSL) protocol, enabling clients to securely access internal network servers remotely. SSL Virtual Private Network (VPN) technology is a VPN technology that has emerged in recent years and has been widely adopted with the popularization of networks and the rapid development of e-commerce and remote work. IP tunneling proxy is a network technology that refers to forwarding network requests through a proxy server, thereby achieving anonymization and encryption of network connections. This proxy method can automatically change the IP address by forwarding requests to different proxy IPs on the proxy server. Implementing tunneling proxy on security gateway devices can further improve the security of tunneling proxy.

[0003] However, since the character devices of the virtual network devices in the security gateway can only be exclusively used, users must be single-process or single-threaded and cannot read and write in a multi-process or multi-threaded concurrent manner, which leads to a bottleneck in data forwarding. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of the prior art by providing a remote secure access method, apparatus, and security gateway device. This allows for high-concurrency tunnel proxying by employing multiple processes on a tunnel proxy server to listen to multiple service request packets in parallel. Then, multiple sessions are created, and by invoking a virtual network device, the multiple service request packets are forwarded to the intranet server, enabling multiple hosts to remotely access the intranet server in parallel.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows:

[0006] In a first aspect, embodiments of this application provide a remote secure access method applied to a security gateway device, wherein the security gateway device integrates a tunnel proxy server and a virtual network device, and the method includes:

[0007] The tunnel proxy server uses multiple processes to listen in parallel to the business request packets of tunnel proxy clients on multiple hosts.

[0008] The tunnel proxy server uses the multiple processes to create multiple sessions in parallel based on the multiple business request messages it has been listening to. Each of the multiple sessions corresponds to a tunnel proxy client on one of the multiple hosts.

[0009] The tunnel proxy server uses the multiple processes and, based on the multiple sessions, calls the virtual network device in parallel to remotely access the intranet server.

[0010] In an optional implementation, before the tunnel proxy server employs multiple processes to listen in parallel to the first protocol packets of tunnel proxy clients on multiple hosts, the method further includes:

[0011] The tunnel proxy server starts a preset reverse proxy server and creates the multiple processes through the preset reverse proxy server.

[0012] In an optional implementation, before the tunnel proxy server employs multiple processes to listen in parallel to the first protocol packets of tunnel proxy clients on multiple hosts, the method further includes:

[0013] The tunnel proxy server obtains the business communication ports of the multiple hosts, and the business communication port of each host is used to represent the business application on each host.

[0014] The tunnel proxy server creates a virtual communication address pool based on the business communication ports of the multiple hosts. The virtual communication address pool includes the virtual communication addresses of the business applications on the multiple hosts. The virtual communication address of the business application on each host is used to represent the business application on each host.

[0015] The tunnel proxy server distributes the virtual communication addresses of the business applications on the multiple hosts to the multiple hosts respectively;

[0016] The tunnel proxy server routes the virtual communication addresses of the business applications on the multiple hosts to the virtual network device.

[0017] In an optional implementation, each service request message is: a service message obtained by the tunnel proxy client on the corresponding host in the following manner;

[0018] Obtain the business data of the business application, the source address of the first protocol, and the destination address of the first protocol; wherein, the source address of the first protocol includes: the virtual communication address of the business application on the corresponding host and the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server;

[0019] The business application's business data, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol, and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain the business request message. The source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes the communication address and communication port of the security gateway device.

[0020] In an optional implementation, the tunnel proxy server employs the multiple processes to create multiple sessions in parallel based on the multiple service request packets monitored, including:

[0021] The tunnel proxy server uses each process to create a first processing program and a second processing program for the corresponding host based on the service request message of the corresponding host, thereby obtaining a session including the first processing program and the second processing program.

[0022] In an optional implementation, the tunnel proxy server employs the multiple processes to remotely access the intranet server by concurrently invoking the virtual network device based on the multiple sessions, including:

[0023] The tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, to obtain the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process.

[0024] The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

[0025] In an optional implementation, the tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing procedure, including:

[0026] The tunnel proxy server uses each process to call the corresponding host's communication socket among multiple communication sockets in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket of the corresponding host.

[0027] In an optional implementation, the tunnel proxy server employs the multiple processes and, based on the multiple sessions, concurrently invokes the virtual network device to remotely access the intranet server, further including:

[0028] The virtual network device receives the service response message of the first protocol sent by the intranet server;

[0029] The virtual network device determines the target virtual communication address based on the destination communication address in the service response message;

[0030] The virtual network device queries the target communication socket corresponding to the target virtual communication address based on the target virtual communication address and the pre-recorded correspondence between virtual communication addresses and communication sockets.

[0031] The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket through the target communication socket;

[0032] The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session;

[0033] The tunnel proxy server uses the first processing program in the target session to convert the service response message of the first protocol into a service response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host then converts the service response message of the second protocol into a service response message of the first protocol and transmits it to the service application on the target host.

[0034] Secondly, embodiments of this application also provide a remote secure access device, the remote secure access device comprising: a tunnel proxy server and a virtual network device, wherein the tunnel proxy server is used to execute the method steps executed by any of the tunnel proxy servers in the first aspect, and the virtual network device is used to execute the method steps executed by any of the virtual network devices in the first aspect.

[0035] Thirdly, embodiments of this application also provide a security gateway device, including: a processor, a storage medium, and a bus. The storage medium stores program instructions executable by the processor. When the security gateway device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of any of the remote secure access methods described in the first aspect.

[0036] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any of the remote secure access methods described in the first aspect.

[0037] The beneficial effects of this application are:

[0038] This application provides a remote secure access method, apparatus, and security gateway device. Applied to a security gateway device, the security gateway device integrates a tunnel proxy server and a virtual network device. The method includes: the tunnel proxy server employing multiple processes to concurrently listen to service request packets from tunnel proxy clients on multiple hosts; the tunnel proxy server employing multiple processes to concurrently create multiple sessions based on the monitored service request packets, with each session corresponding to a tunnel proxy client on a different host; and the tunnel proxy server employing multiple processes to concurrently invoke the virtual network device based on the multiple sessions to remotely access an intranet server. This method, by employing multiple processes in the tunnel proxy server, can concurrently listen to multiple service request packets, achieving high-concurrency tunnel proxying. Then, by creating multiple sessions and invoking the virtual network device, it forwards the multiple service request packets to the intranet server, enabling concurrent remote access from multiple hosts to the intranet server. This improves the efficiency of remote access from multiple clients to the intranet server, eliminating the need for multiple hosts to sequentially access the intranet server. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart illustrating a remote secure access method provided in an embodiment of this application;

[0041] Figure 2 One of the flowcharts of a remote secure access method provided in this application embodiment;

[0042] Figure 3 A second schematic flowchart illustrating a remote secure access method provided in an embodiment of this application;

[0043] Figure 4 The third flowchart illustrates a remote secure access method provided in this application embodiment;

[0044] Figure 5The fourth flowchart illustrates a remote secure access method provided in this application embodiment;

[0045] Figure 6 A schematic diagram of the functional modules of a remote secure access device provided in an embodiment of this application;

[0046] Figure 7 This is a schematic diagram of a security gateway device provided in an embodiment of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0048] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0049] In the description of this application, it should be noted that if the terms "upper", "lower", etc. appear to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship that the product of this application is usually placed in, it is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0050] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0051] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0052] To better understand the solutions provided in the following embodiments of this application, the technical terms involved in the following embodiments of this application will be explained first.

[0053] Security gateway devices establish remote secure access channels using the Security Socket Layer (SSL) protocol, enabling clients to remotely and securely access internal network servers.

[0054] IP tunnel proxy refers to forwarding network requests through a proxy server, thereby achieving anonymization and encryption of network connections. This tunnel proxy method can automatically change the IP address by forwarding requests to different proxy IPs on the proxy server. Implementing IP tunnel proxy on a security gateway device can further improve the security of IP tunnel proxy.

[0055] Currently, existing security gateway devices integrate: a raw tunnel proxy server and a raw virtual network device. The raw virtual network device (Tunnel over IP / Tap Device, TUN / TAP) is used to provide data reception and transmission functions to user-level programs. The raw virtual network device includes character devices and network devices. Since character devices can only be exclusively used, users must be single-process or single-threaded. That is, only after one client finishes remotely accessing the intranet server through the security gateway device can the next client remotely access the intranet server through the security gateway device. This results in low efficiency and slow response when multiple clients remotely access the intranet server.

[0056] Therefore, embodiments of this application provide a method for secure remote access. Figure 1 A flowchart illustrating a remote secure access method provided in this application embodiment is shown below. Figure 1 As shown, the security gateway device integrates a tunnel proxy server and a virtual network device. A preset reverse proxy server is introduced into the tunnel proxy server. The preset reverse proxy server is a deployment mode for the proxy server. Clients send requests to the preset reverse proxy server, which appears as the target server to the client. Because the reverse proxy server (engine x, Nginx) has high concurrency, high reliability, easy configuration, and open-source characteristics, Nginx is introduced as the preset reverse proxy server into the tunnel proxy server to achieve high-concurrency tunnel proxying and improve the efficiency of multiple clients accessing the internal network server remotely.

[0057] However, Nginx implements reverse proxy based on the stream + session model. That is, the client first establishes a stream (called downstream) with Nginx, which is the first processing program in the following embodiments of this application. Under the security gateway device, this stream is TCP. Correspondingly, Nginx establishes a stream (called upstream), which is the second processing program in the following embodiments of this application, which must also be TCP. The two streams form a session and forward each other's traffic. In this application, where Nginx is used as the default reverse proxy server, the upstream connections are established with the proxied internal network servers. In the case of tunnel proxying, the security gateway device only forwards IP packets, requiring forwarding through the original virtual network device. However, since the character device of the original virtual network device can only be exclusively used and cannot be adapted to the default reverse proxy server, this application does not use the character device as a user-space and kernel-space data channel. Instead, it sets up multiple communication sockets for IP packet forwarding, which not only adapts to the default reverse proxy server but also solves the problem of exclusive use of the character device, enabling multi-threaded concurrency. The communication socket is an abstraction layer through which applications can send or receive data streams, performing operations such as opening, reading, writing, and closing them like files. Specifically, the communication socket is an abstraction of the endpoint for bidirectional communication between application processes on different hosts in the network.

[0058] The remote secure access method provided in this application is illustrated below with reference to the accompanying drawings and several examples. The remote secure access method is applied to a security gateway device, which integrates a tunnel proxy server and a virtual network device. Figure 2 This is one of the flowcharts illustrating a remote secure access method provided in an embodiment of this application, such as... Figure 2 As shown, the method includes:

[0059] S101. The tunnel proxy server uses multiple processes to listen in parallel to the business request packets of tunnel proxy clients on multiple hosts.

[0060] In this embodiment, the tunnel proxy server introduces a preset reverse proxy server Nginx. Since the preset reverse proxy server Nginx has high concurrency characteristics, it can listen to the business request packets of tunnel proxy clients on multiple hosts in parallel through multiple processes. The business request packets are business packets obtained by multiple tunnel proxy clients encapsulating and processing the business data of the business application.

[0061] S102. The tunnel proxy server uses multiple processes to create multiple sessions in parallel based on the multiple business request messages it listens for.

[0062] In this case, multiple sessions correspond to tunnel proxy clients on multiple hosts.

[0063] The default reverse proxy server Nginx in the tunnel proxy server creates a corresponding session for each business request message it listens for, so that multiple sessions establish tunnels with tunnel proxy clients on multiple hosts to transmit business request messages. Among them, the created sessions are time-domain Session sessions, which are used to forward business request messages.

[0064] S103. The tunnel proxy server uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server.

[0065] Specifically, the pre-configured reverse proxy server Nginx in the tunnel proxy server is connected to the virtual network device. By calling the virtual network device in parallel, it forwards the business data in the business request message to the internal network server, enabling tunnel proxy clients on multiple hosts to access the internal network server in parallel.

[0066] In summary, this application provides a remote secure access method applied to a security gateway device. The security gateway device integrates a tunnel proxy server and a virtual network device. The method includes: the tunnel proxy server employing multiple processes to concurrently listen to service request packets from tunnel proxy clients on multiple hosts; the tunnel proxy server employing multiple processes to concurrently create multiple sessions based on the monitored service request packets, with each session corresponding to a tunnel proxy client on a different host; and the tunnel proxy server employing multiple processes to concurrently invoke the virtual network device based on the multiple sessions to remotely access an intranet server. This method, by employing multiple processes in the tunnel proxy server, can concurrently listen to multiple service request packets, achieving high-concurrency tunnel proxying. Then, by creating multiple sessions and invoking the virtual network device, it forwards multiple service request packets to the intranet server, enabling concurrent remote access from multiple hosts to the intranet server. This improves the efficiency of remote access from multiple clients to the intranet server, eliminating the need for multiple hosts to sequentially access the intranet server.

[0067] This application also provides another possible implementation of the remote secure access method. Before the tunnel proxy server uses multiple processes to listen in parallel to the first protocol packets of the tunnel proxy clients on multiple hosts, the method further includes:

[0068] The tunnel proxy server starts the preset reverse proxy server and creates multiple processes through the preset reverse proxy server.

[0069] In this embodiment, the tunnel proxy server introduces a preset reverse proxy server Nginx, which has high concurrency characteristics. After starting the preset reverse proxy server Nginx, multiple processes can be created to listen to the first protocol packets of the tunnel proxy clients on multiple hosts in parallel, thereby achieving high-concurrency tunnel proxy.

[0070] This application also provides another possible implementation of the remote secure access method. Figure 3 This is a second flowchart illustrating a remote secure access method provided in an embodiment of this application, as shown below. Figure 3 As shown, before the tunnel proxy server uses multiple processes to listen in parallel to the first protocol packets of the tunnel proxy clients on multiple hosts, the method also includes:

[0071] S201, The tunnel proxy server obtains the business communication ports of multiple hosts.

[0072] In this embodiment, tunnel proxy clients of multiple hosts connect to the security gateway device by inputting the public network address information of the security gateway device. The tunnel proxy server can obtain the business communication ports of multiple hosts, wherein the business communication port of each host is used to represent the business application on each host.

[0073] In addition, the tunnel proxy server can also obtain the actual communication addresses of multiple hosts.

[0074] S202. The tunnel proxy server creates a virtual communication address pool based on the business communication ports of multiple hosts.

[0075] The virtual communication address pool includes virtual communication addresses of business applications on multiple hosts, with each virtual communication address representing the business application on each host.

[0076] The tunnel proxy server creates corresponding virtual communication addresses for business applications on multiple hosts based on the business communication ports of multiple hosts, thus obtaining a virtual communication address pool.

[0077] S203 and the tunnel proxy server respectively distribute the virtual communication addresses of business applications on multiple hosts to multiple hosts.

[0078] S204. The tunnel proxy server routes the virtual communication addresses of business applications on multiple hosts to virtual network devices.

[0079] Specifically, the tunnel proxy server distributes the virtual communication addresses of the business applications on multiple hosts to multiple hosts, specifically to the virtual network devices on multiple hosts, so that the tunnel proxy clients on multiple hosts can communicate with the tunnel proxy server through the corresponding virtual communication addresses.

[0080] The tunnel proxy server also routes the virtual communication addresses of business applications on multiple hosts to the virtual network device, so that the virtual network device records the virtual communication addresses of business applications on multiple hosts.

[0081] In the method provided in this application embodiment, the tunnel proxy server obtains the service communication ports of multiple hosts. Each host's service communication port represents a service application on that host. Based on these ports, the tunnel proxy server creates a virtual communication address pool, which includes virtual communication addresses of the service applications on the multiple hosts. Each virtual communication address represents a service application on that host. The tunnel proxy server distributes these virtual communication addresses to the multiple hosts and routes them to virtual network devices. The tunnel proxy server creates a virtual communication address for each service application on a host, enabling tunnel proxy clients on each host to communicate with the tunnel proxy server through these virtual communication addresses.

[0082] This application also provides another possible implementation of the remote secure access method, wherein each service request message is a service message obtained by the tunnel proxy client on the corresponding host in the following manner.

[0083] Obtain the business data of the business application, the source address of the first protocol, and the destination address of the first protocol.

[0084] The source address of the first protocol includes: the virtual communication address of the corresponding host and the business communication port of the corresponding host; the destination address of the first protocol includes: the communication address and communication port of the intranet server.

[0085] In this embodiment, the virtual network device of the corresponding host obtains the business data of the business application, encapsulates the business data according to the source address and destination address of the first protocol, and obtains the business message of the first protocol. The first protocol is the Internet Protocol (IP) protocol. The source address of the IP protocol includes: the virtual communication address V_IP of the business application on the corresponding host and the business communication port V_Port of the business application on the corresponding host. The destination address of the IP protocol includes: the communication address Dst_IP of the intranet server and the communication port Dst_Port of the intranet server. The virtual communication address V_IP of the business application on the corresponding host is a virtual communication address created by the tunnel proxy server for the business application on the host.

[0086] The business application's business data, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol, and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain a business request message. The source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes the communication address and communication port of the security gateway device.

[0087] Specifically, the corresponding virtual network device encapsulates the business data of the business application, the source address of the first protocol, and the destination address of the first protocol to obtain the first protocol message. Then, it encapsulates the first protocol business request message, the source address of the second protocol, and the destination address of the second protocol to obtain the second protocol message. The second protocol message, i.e. the business request message, is sent to the security gateway device through the tunnel proxy client. The tunnel proxy server in the security gateway device uses multiple processes to listen for the business request message sent by the tunnel proxy client.

[0088] The second protocol is the Transmission Control Protocol (TCP). The source address of the TCP protocol includes the communication address Cli_IP of the corresponding host and the communication port Cli_Port of the corresponding host. The destination address of the TCP protocol includes the communication address SSLVPN_Serv_IP of the security gateway device and the communication port SSLVPN_Serv_Port of the security gateway device.

[0089] In the method provided in this application embodiment, the tunnel proxy client on the corresponding host obtains the business data of the business application, the source address of the first protocol, and the destination address of the first protocol. The source address of the first protocol includes the virtual communication address and the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes the communication address and communication port of the intranet server. Then, the business data of the business application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol, and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain a business request message. The source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes the communication address and communication port of the security gateway device. Since the tunnel between the tunnel proxy clients on multiple hosts and the tunnel proxy server on the security gateway device is a second protocol tunnel, it can only transmit second protocol messages. However, the tunnel proxy clients on multiple hosts encapsulate the business data of the obtained business application, the source address of the first protocol, and the destination address of the first protocol to obtain first protocol messages. Therefore, it is also necessary to encapsulate the first protocol messages, the source address of the second protocol, and the destination address of the second protocol to obtain second protocol messages for transmission in the second protocol tunnel. This allows the tunnel proxy server to use multiple processes to receive business request messages by listening to the communication address and communication port of the security gateway device in the business request messages in parallel.

[0090] This application also provides another possible implementation of the remote secure access method, in which the tunnel proxy server uses multiple processes to create multiple sessions in parallel based on multiple monitored business request packets, including:

[0091] The tunnel proxy server uses each process to create a first and second handler for the corresponding host based on the business request message of the corresponding host, thus obtaining a session that includes the first and second handlers.

[0092] In this embodiment, the tunnel proxy server introduces a preset reverse proxy server Nginx. The preset reverse proxy server Nginx implements reverse proxy based on the stream + session model. That is, Nginx first establishes a stream (called downstream) with the tunnel proxy client, which is the first processing program. Under this security gateway device, this stream is TCP. That is, the first processing program processes TCP packets, and the business request packets also need to be TCP packets. Correspondingly, Nginx establishes a stream (called upstream) with the internal network server, which is the second processing program. It must also be TCP. A session is formed through the two streams, and traffic is forwarded to each other.

[0093] The default reverse proxy server Nginx, upon receiving business request packets from the corresponding host, creates a first handler and a second handler for that host, forming a session for that host to process the business request packets.

[0094] This application also provides another possible implementation of the remote secure access method. Figure 4 This is the third flowchart illustrating a remote secure access method provided in this application embodiment, as shown below. Figure 4 As shown, the tunnel proxy server uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server, including:

[0095] S301. The tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process.

[0096] S302. The tunnel proxy server uses each process to transmit the business request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

[0097] In this embodiment, the service request message received by the first processing program in the session corresponding to each process is the service request message of the second protocol, i.e., the TCP service request message. The first processing program decapsulates the service request message of the second protocol to obtain the service request message of the first protocol, i.e., the IP service request message, and transmits the service request message of the first protocol to the second processing program in the corresponding session.

[0098] It should be noted that the original second processing program is pre-set to establish a stream (called upstream) between the reverse proxy server Nginx and the internal network server, which is a TCP stream. Therefore, the packets forwarded by the original second processing program to the internal network server should also be TCP packets. That is, the original second processing program also needs to encapsulate the first protocol business request packets, i.e., IP business request packets, into second protocol business request packets, i.e., TCP business request packets, and then forward them to the internal network server.

[0099] In order to directly transmit the service request message of the first protocol to the intranet server through the virtual network device, this application modifies the original second processing program. By using IO control, the sending interface of the second processing program is modified to send IP packets, and the service request message of the first protocol is directly delivered to the virtual network device. This allows the virtual network device to forward the service request message of the first protocol to the intranet server through the protocol stack, thereby enabling the corresponding host to remotely access the intranet server.

[0100] Optionally, the tunnel proxy server uses each process to call the corresponding host's communication socket among multiple communication sockets in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket of the corresponding host.

[0101] Since the original virtual network device includes character devices and network devices, and the character device can only be exclusively used and cannot be adapted to the preset reverse proxy server, this embodiment no longer uses the character device as the user-mode and kernel-mode data channel. By setting up multiple communication sockets to forward the service request packets of the first protocol, it not only adapts to the preset reverse proxy server, but also solves the problem that the character device can only be exclusively used, improves the concurrency capability of the virtual network device, and realizes multi-threaded concurrency.

[0102] It should be noted that the receive buffers of multiple communication sockets are independent of each other and do not affect each other. This can reduce the risk of packet loss due to receive buffer overflow and avoid the situation where packet loss leads to the retransmission of a large number of messages, reducing the utilization of network bandwidth.

[0103] Meanwhile, the virtual network device uses an array table to record the correspondence between the virtual communication address V_IP of the corresponding host and the corresponding communication socket TCP socket of the corresponding host, so that the corresponding communication socket can be found through the virtual communication address.

[0104] In the method provided in this application embodiment, the tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process. The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program. By processing and transmitting the service request message through the session corresponding to each process, the remote access of the corresponding host to the intranet server is realized.

[0105] This application also provides another possible implementation of the remote secure access method. Figure 5 This is the fourth flowchart illustrating a remote secure access method provided in this application embodiment, as shown below. Figure 5 As shown, the tunnel proxy server uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server, and also includes:

[0106] S401, The virtual network device receives the first protocol service response message sent by the internal network server.

[0107] In this embodiment, the intranet server responds to the service data in the received service request message of the first protocol by replying with a service response message of the first protocol.

[0108] The first protocol's service response message is a service response message obtained by the intranet server encapsulating the response data, the source switching address of the first protocol, and the destination switching address of the first protocol. The source switching address of the first protocol includes: the communication address Dst_IP of the intranet server and the communication port Dst_Port of the intranet server. The destination switching address of the first protocol includes: the destination communication address V_IP of the business application on the corresponding host and the business communication port V_Port of the business application on the corresponding host.

[0109] S402. The virtual network device determines the target virtual communication address based on the destination communication address in the service response message.

[0110] S403. The virtual network device queries the target communication socket corresponding to the target virtual communication address based on the target virtual communication address and the pre-recorded correspondence between virtual communication addresses and communication sockets.

[0111] Since the tunnel proxy server routes the virtual communication addresses of multiple hosts to the virtual network device, the virtual network device can determine the target virtual communication address based on the destination communication address in the service response message.

[0112] Meanwhile, the virtual network device also uses an array table to pre-record the correspondence between virtual communication addresses and communication sockets. By directly addressing through the address pool offset, the corresponding target communication socket can be quickly queried through the target virtual communication address.

[0113] S404. The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket through the target communication socket.

[0114] S405. The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session.

[0115] S406. The tunnel proxy server uses the first processing program in the target session to convert the service response message of the first protocol into the service response message of the second protocol and transmit it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the service response message of the second protocol into the service response message of the first protocol and transmits it to the service application on the target host.

[0116] In this process, after receiving the service response message of the first protocol, the first processing program in the target session encapsulates the service response message of the first protocol, the source switching address of the second protocol, and the destination switching address of the second protocol to obtain the service response message of the second protocol. The source switching address of the second protocol includes the communication address SSLVPN_Serv_IP of the security gateway device and the communication port SSLVPN_Serv_Port of the security gateway device. The destination switching address of the second protocol includes the communication address Cli_IP of the corresponding host and the communication port Cli_Port of the corresponding host.

[0117] Then, the service response message of the second protocol is transmitted to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client decapsulates the service response message of the second protocol, converts it into the service response message of the first protocol, and transmits it to the business application on the target host.

[0118] In the method provided in this application embodiment, a virtual network device receives a service response message of the first protocol sent by an intranet server. The virtual network device determines a target virtual communication address based on the destination communication address in the service response message. The virtual network device then queries the target communication socket corresponding to the target virtual communication address based on the target virtual communication address and a pre-recorded correspondence between virtual communication addresses and communication sockets. The virtual network device transmits the service response message of the first protocol to a second processing program in the target session corresponding to the target communication socket through the target communication socket. The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to a first processing program in the target session. The tunnel proxy server uses the first processing program in the target session to convert the service response message of the first protocol into a service response message of the second protocol and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the service response message of the second protocol back into a service response message of the first protocol and transmits it to the business application on the target host. By processing the service response message of the first protocol sent by the intranet server, interoperability of business data is achieved.

[0119] The following will continue to explain the remote secure access device and security gateway device provided in any of the above embodiments of this application. The specific implementation process and the resulting technical effects are the same as those in the corresponding method embodiments. For the sake of brevity, the parts not mentioned in this embodiment can be referred to the corresponding content in the method embodiment.

[0120] Figure 6 This is a schematic diagram of the functional modules of a remote secure access device provided in an embodiment of this application. Figure 6 As shown, the remote secure access device 100 includes: a tunnel proxy server 110 and a virtual network device 120.

[0121] The tunnel proxy server 110 uses multiple processes to listen in parallel to the business request packets of tunnel proxy clients on multiple hosts.

[0122] The tunnel proxy server 110 uses multiple processes to create multiple sessions in parallel based on the multiple business request messages it listens for. Each session corresponds to a tunnel proxy client on a different host.

[0123] The tunnel proxy server 110 uses multiple processes to call virtual network devices in parallel based on multiple sessions to remotely access the intranet server.

[0124] Optionally, the tunnel proxy server 110 starts a preset reverse proxy server and creates multiple processes through the preset reverse proxy server.

[0125] Optionally, the tunnel proxy server 110 obtains the business communication ports of multiple hosts, and the business communication port of each host is used to represent the business application on each host;

[0126] The tunnel proxy server 110 creates a virtual communication address pool based on the business communication ports of multiple hosts. The virtual communication address pool includes: virtual communication addresses of business applications on multiple hosts. The virtual communication address of each business application on a host is used to represent the business application on each host.

[0127] The tunnel proxy server 110 distributes the virtual communication addresses of the business applications on multiple hosts to multiple hosts respectively;

[0128] The tunnel proxy server 110 routes the virtual communication addresses of business applications on multiple hosts to virtual network devices.

[0129] Optionally, each service request message is: a service message obtained by the tunnel agent client 110 on the corresponding host in the following manner: obtaining the service data of the service application, the source address of the first protocol, and the destination address of the first protocol; wherein, the source address of the first protocol includes: the virtual communication address of the service application on the corresponding host and the service communication port of the service application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; encapsulating the service data of the service application, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol, and the destination address of the second protocol into a message of the second protocol to obtain a service request message, wherein, the source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes: the communication address and communication port of the security gateway device.

[0130] Optionally, the tunnel proxy server 110 uses each process to create a first processing program and a second processing program for the corresponding host based on the service request message of the corresponding host, thereby obtaining a session including the first processing program and the second processing program.

[0131] Optionally, the tunnel proxy server 110 uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, obtains the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process.

[0132] The tunnel proxy server 110 uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

[0133] Optionally, the tunnel proxy server 110 uses each process to call the corresponding host's communication socket among multiple communication sockets in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket of the corresponding host.

[0134] Optionally, the virtual network device 120 receives a service response message of the first protocol sent by the intranet server;

[0135] The virtual network device 120 determines the target virtual communication address based on the destination communication address in the service response message;

[0136] The virtual network device 120 queries the target communication socket corresponding to the target virtual communication address based on the target virtual communication address and the pre-recorded correspondence between virtual communication addresses and communication sockets.

[0137] The virtual network device 120 transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket through the target communication socket;

[0138] The tunnel proxy server 110 uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session;

[0139] The tunnel proxy server 110 uses the first processing program in the target session to convert the service response message of the first protocol into a service response message of the second protocol and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host converts the service response message of the second protocol into a service response message of the first protocol and transmits it to the service application on the target host.

[0140] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0141] Figure 7 This is a schematic diagram of a security gateway device provided in an embodiment of this application. This security gateway device can be used for remote secure access. Figure 7 As shown, the security gateway device includes: a processor 210, a storage medium 220, and a bus 230.

[0142] Storage medium 220 stores machine-readable instructions executable by processor 210. When the security gateway device is running, processor 210 communicates with storage medium 220 via bus 230, and processor 210 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation and technical effects are similar and will not be described in detail here.

[0143] Optionally, this application also provides a storage medium 220, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the above-described method embodiments. The specific implementation and technical effects are similar, and will not be repeated here.

[0144] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0145] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0146] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0147] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0148] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A remote secure access method, characterized in that, Applied to a security gateway device, the security gateway device integrating: a tunnel proxy server and a virtual network device, the method includes: The tunnel proxy server uses multiple processes to listen in parallel to the business request packets of tunnel proxy clients on multiple hosts. The tunnel proxy server uses the multiple processes to create multiple sessions in parallel based on the multiple business request messages it has been listening to. Each of the multiple sessions corresponds to a tunnel proxy client on one of the multiple hosts. The tunnel proxy server uses the multiple processes and, based on the multiple sessions, calls the virtual network device in parallel to remotely access the intranet server. Before the tunnel proxy server employs multiple processes to listen in parallel to the first protocol packets of tunnel proxy clients on multiple hosts, the method further includes: The tunnel proxy server obtains the business communication ports of the multiple hosts, and the business communication port of each host is used to represent the business application on each host. The tunnel proxy server creates a virtual communication address pool based on the business communication ports of the multiple hosts. The virtual communication address pool includes the virtual communication addresses of the business applications on the multiple hosts. The virtual communication address of the business application on each host is used to represent the business application on each host. The tunnel proxy server distributes the virtual communication addresses of the business applications on the multiple hosts to the multiple hosts respectively; The tunnel proxy server routes the virtual communication addresses of the business applications on the multiple hosts to the virtual network device.

2. The method according to claim 1, characterized in that, Before the tunnel proxy server employs multiple processes to listen in parallel to the first protocol packets of tunnel proxy clients on multiple hosts, the method further includes: The tunnel proxy server starts a preset reverse proxy server and creates the multiple processes through the preset reverse proxy server.

3. The method according to claim 1, characterized in that, Each service request message is: a service message obtained by the tunnel proxy client on the corresponding host in the following manner; Obtain the business data of the business application, the source address of the first protocol, and the destination address of the first protocol; wherein, the source address of the first protocol includes: the virtual communication address of the business application on the corresponding host and the business communication port of the business application on the corresponding host, and the destination address of the first protocol includes: the communication address and communication port of the intranet server; The business application's business data, the source address of the first protocol, the destination address of the first protocol, the source address of the second protocol, and the destination address of the second protocol are encapsulated into a message of the second protocol to obtain the business request message. The source address of the second protocol includes the communication address and communication port of the corresponding host, and the destination address of the second protocol includes the communication address and communication port of the security gateway device.

4. The method according to claim 1, characterized in that, The tunnel proxy server uses the multiple processes to create multiple sessions in parallel based on the multiple business request messages it has monitored, including: The tunnel proxy server uses each process to create a first processing program and a second processing program for the corresponding host based on the service request message of the corresponding host, thereby obtaining a session including the first processing program and the second processing program.

5. The method according to claim 4, characterized in that, The tunnel proxy server uses the multiple processes and, based on the multiple sessions, invokes the virtual network device in parallel to remotely access the intranet server, including: The tunnel proxy server uses each process to process the service request message of the second protocol according to the first processing program in the session corresponding to each process, to obtain the service request message of the first protocol, and transmits the service request message of the first protocol to the second processing program in the session corresponding to each process. The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program.

6. The method according to claim 5, characterized in that, The tunnel proxy server uses each process to transmit the service request message of the first protocol to the intranet server for remote access by calling the virtual network device according to the second processing program, including: The tunnel proxy server uses each process to call the corresponding host's communication socket among multiple communication sockets in the virtual network device according to the second processing program, and transmits the service request message of the first protocol to the intranet server for remote access, so that the virtual network device records the correspondence between the virtual communication address of the corresponding host and the communication socket of the corresponding host.

7. The method according to claim 6, characterized in that, The tunnel proxy server uses the multiple processes and, based on the multiple sessions, calls the virtual network device in parallel to remotely access the intranet server, and further includes: The virtual network device receives the service response message of the first protocol sent by the intranet server; The virtual network device determines the target virtual communication address based on the destination communication address in the service response message; The virtual network device queries the target communication socket corresponding to the target virtual communication address based on the target virtual communication address and the pre-recorded correspondence between virtual communication addresses and communication sockets. The virtual network device transmits the service response message of the first protocol to the second processing program in the target session corresponding to the target communication socket through the target communication socket; The tunnel proxy server uses the second processing program in the target session to transmit the service response message of the first protocol to the first processing program in the target session; The tunnel proxy server uses the first processing program in the target session to convert the service response message of the first protocol into a service response message of the second protocol, and transmits it to the tunnel proxy client on the target host corresponding to the target session. The tunnel proxy client on the target host then converts the service response message of the second protocol into a service response message of the first protocol and transmits it to the service application on the target host.

8. A remote secure access device, characterized in that, The remote secure access device includes a tunnel proxy server and a virtual network device, wherein the tunnel proxy server is used to execute the method steps performed by the tunnel proxy server as described in any one of claims 1 to 7, and the virtual network device is used to execute the method steps performed by the virtual network device as described in any one of claims 1 to 7.

9. A security gateway device, characterized in that, include: The device includes a processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor, and when the security gateway device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the remote secure access method as described in any one of claims 1 to 7.

Images