Method and system for selecting point-to-point path to access target website

Abstract

The invention discloses a method and a system for selecting a point-to-point path to access a target website. The method comprises the following steps: deploying transit servers in different areas of the Internet; when a user initiates an access request of a target website with a specified domain name, the special browser points the target website with the specified domain name to a port of the proxy module through the PAC according to an access strategy of the special browser, and the proxy module is connected with one of the transit servers through the encryption tunnel according to the access strategy and forwards the access request to the transit server; the transit server forwards the request to a springboard server in a corresponding target side network according to the access strategy; and the springboard server forwards the access request to a target website server corresponding to the target website. According to the method, the target website is accessed in a two-stage proxy mode, the global operation system and a routing table do not need to be modified, a virtual network card does not need to be installed, the stability of other application programs in the system and the stability of the system are not affected, and the access safety and reliability are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method and system for selecting a point-to-point path to access a target website. Background Art

[0002] With the acceleration of the digital transformation of enterprises, IaaS infrastructure has become ubiquitous, and SaaS services are becoming more and more deeply integrated into the business scenarios of enterprises. The trend of cloud computing is firm and clear. Almost all new businesses tend to be accessed through browsers, which has pushed browsers to become the de facto entrance to enterprise business. In many enterprises, especially small and medium-sized enterprises, employees generally use personal browsers for daily work, but personal browsers often collect and analyze users' browser behavior habits and access records. When employees use personal browsers to access enterprise business, data will inevitably be collected, reported, shared or resold to uncertain third parties, causing data leakage. At the same time, the use of personal browsers by employees will also lack compliance supervision because it is outside the management system. When the business system of an enterprise is located on the intranet or private cloud, users often need to install some software such as VPN on the terminal device, and after authentication or authorization, the terminal management can access it, which undoubtedly increases the difficulty of access and the complexity of management. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a method for selecting a point-to-point path to access a target website, which can ensure the security of access data, simplify operation, and have no significant impact on the access end system, as well as a system for implementing the method.

[0004] The present invention is achieved through the following technical solutions:

[0005] A method for selecting a point-to-point path to access a target website comprises the following steps:

[0006] S1. Deploy transit servers in different areas of the Internet;

[0007] S2. Install a dedicated browser on the access terminal device, wherein the dedicated browser includes a proxy module for proxy service. When a user initiates a target website access request of a specified domain name through the dedicated browser, the dedicated browser directs the target website access request of the specified domain name to the port of the proxy module through the PAC according to the set access policy. The proxy module connects to a transit server in the access policy through a P2P tunnel according to the access policy, and forwards the target website access request to the transit server.

[0008] S3. The transit server forwards the target website access request of the specified domain name to the corresponding springboard server in the target side network according to the access policy;

[0009] S4. The springboard server forwards the target website access request to the target website server corresponding to the target website according to the access policy.

[0010] Furthermore, in step S2, when there are multiple relay servers or springboard servers available for selection in the access policy, the proxy module selects a suitable relay server or springboard server through a preset algorithm according to the load information of each relay server or springboard server to obtain the best path.

[0011] Furthermore, the proxy module selects a suitable transit server or springboard server through a preset algorithm to obtain the best path as follows:

[0012] S2-11. Each relay server or springboard server reports its load information to the browser console. The proxy module determines whether each relay server or springboard server has remaining capacity in terms of CPU load, memory usage and available bandwidth according to the threshold set by the browser console.

[0013] S2-12, the dedicated browser and each springboard server obtain the load information of each relay server, and calculate the delay of each relay server through TCPP, that is, the round-trip time of information between the dedicated browser and each relay server, and the round-trip time of information between each relay server and each springboard server. According to the delay, the shortest path of each can be calculated, and the delay is reported to the browser console;

[0014] S2-13, the dedicated browser connects to the browser console, synchronizes the information reported by the relay server or the springboard server, and the proxy module sorts the information in descending order according to the delay, and selects the relay server or springboard server with the minimum delay from the list of relay servers or springboard servers with remaining capacity.

[0015] Furthermore, the load information includes CPU load, memory usage, available bandwidth and delay.

[0016] Furthermore, the method for calculating the delay of each relay server is as follows: the access initiator opens a new stream on the existing connection, sends a request with a random 32-byte payload, the receiver echoes the 32-byte payload back to the initiator, and the initiator obtains the round-trip time of the underlying connection by calculating the time interval between the request and the response, that is, the delay of the relay server, specifically, calculating the round-trip time of information from the dedicated browser to the relay server, and the round-trip time of information from the relay server to the springboard server.

[0017] Furthermore, it also includes: before the target website access request is initiated, the access policy is set on the browser console of the dedicated browser, and the access policy includes the domain name of each target website, the associated domain name, the optional transit server, and the optional springboard server.

[0018] Furthermore, in step S2, when the user initiates a request to access the target website of the specified domain name through the dedicated browser, it also includes: the browser console sends the access policy to the dedicated browser, the relay server and the springboard server, and the proxy module of the dedicated browser, the relay server and the springboard server establish an encrypted tunnel for transmitting data after receiving the access policy.

[0019] Furthermore, the method for establishing an encrypted tunnel between the dedicated browser and the transit server includes the following steps:

[0020] S2-21, Node initialization: Set the listening address and port, and use the multiaddr multi-address format to unify the addresses of different protocols;

[0021] S2-22, Node discovery: Discover nodes on the Internet through Kademlia DHT distributed hash table;

[0022] S2-23, Establish a secure connection: After determining the remote node address, the node attempts to establish a connection with the other party using TLS; during the connection establishment process, the nodes will exchange keys and use the Diffie-Hellman key negotiation algorithm to ensure security;

[0023] S2-24, Multiplexing: Encrypted tunnels support multiple concurrent data streams over one connection, reducing the need to establish multiple connections;

[0024] S2-25. Service registration and discovery: Nodes can register their own services and discover services provided by other nodes.

[0025] Furthermore, the method for the dedicated browser to obtain the access policy is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the dedicated browser to obtain the policy from the console after the configuration is completed. In addition, after the dedicated browser is started, it will also try to obtain the policy from the console at regular intervals (such as 10 minutes). Only when the access policy changes, the browser console will respond to the policy request and issue a new access policy. When an access request to a target website is initiated on the dedicated browser, the dedicated browser connects to the browser console to obtain the access policy of the corresponding target website. The access policy contains the transit server information and the springboard server information.

[0026] The method for the transit server to obtain the access policy is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the transit server to obtain the policy from the browser console after the configuration is completed. In addition, after the transit server is started, it will periodically go to the browser console to try to obtain the policy at regular intervals (such as 10 minutes). Only when the access policy changes will the browser console respond to the policy request and issue a new access policy. After the transit server is started, it reports its ID, CPU, memory, bandwidth and other load information to the policy service module at regular intervals (such as 10 minutes);

[0027] The method for the springboard server to obtain the access policy process is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the springboard server to obtain the policy from the browser console after the configuration is completed. In addition, the springboard server will also periodically go to the browser console to try to obtain the policy at regular intervals (such as 10 minutes). Only when the access policy changes will the browser console respond to the policy request and issue a new access policy. After receiving the access policy, the springboard server parses and obtains the list of transit servers, establishes an encrypted tunnel with the transit servers in the list, connects to the transit servers, and records the transit servers that have successfully connected. After the springboard server is started, it regularly reports its load information including CPU, memory, and bandwidth at regular intervals (10 minutes), and reports the information of the transit server currently being connected.

[0028] A system for selecting a point-to-point path to access a target website, used to implement the above method for selecting a point-to-point path to access a target website, comprising an access terminal, a browser console, a transfer server, a springboard server and a visited terminal;

[0029] The access terminal includes an access terminal device and a dedicated browser, the dedicated browser is installed on the access terminal device, the dedicated browser includes a proxy module for proxy service, the dedicated browser is used to initiate a target website access request of a specified domain name, and direct the target website access request of the specified domain name to the port of the proxy module through the PAC according to the access policy; the proxy module is used to select the best path according to the access policy and connect to the transit server;

[0030] The browser console is used to set the access policy for the target website of the specified domain name and send the access policy to the dedicated browser, the transit server and the springboard server;

[0031] The relay servers are deployed in different areas and are used for data transfer between the dedicated browser and the springboard server;

[0032] The springboard server is used to connect to the accessed end, which is an access server pre-deployed in the Internet public cloud or an intranet system gateway installed in the enterprise intranet by the enterprise administrator as needed, and the intranet system gateway is deployed in the network on one side of the enterprise intranet;

[0033] The accessed end includes a target website server, and the target website server includes an Internet website server and an enterprise intranet website server.

[0034] The present invention sets a dedicated browser at the access end, the browser contains a proxy module, and a transit server and a springboard server are deployed in the link. The proxy module uses a proxy request to access the target website. The access initiator does not need to modify the global DNS server of the client operating system, thereby avoiding the impact on other application programs in the system. Since each access request passes through two-level proxies (transit server and springboard server), and an encrypted tunnel is used between them, the security of access is guaranteed. Moreover, the client (browser) does not rely on the virtual network card driver, does not affect the global stability of the system, and does not need to install programs such as VPN, thereby simplifying the user's operation process. At the same time, the client does not need to modify the operating system routing table, and has no impact on the network communication of the operating system. When the http / https proxy mode is used to use a short connection, when the network jitter causes disconnection and reconnection, the recovery time is shorter and the impact on the user is smaller. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic structural diagram of an embodiment of the present invention.

[0036] Figure 2 4 is a flowchart of the dedicated browser in an embodiment of the present invention.

[0037] Figure 3 The figure is a workflow diagram of the transfer server in the embodiment of the present invention.

[0038] Figure 4 4 is a flowchart of the springboard server in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] A method of selecting a point-to-point path to access a target website, such as Figure 1 As shown, the following steps are included:

[0040] S1. Deploy transit servers in different areas of the Internet. The transit server deployment area can be carried out according to the service coverage area, and try to cover the area where the access terminal device is located, so that the access terminal can select a transit server as close as possible, and also make the access terminal have alternative transit servers as much as possible to improve access speed and efficiency.

[0041] S2. A dedicated browser is installed on the access end device. The dedicated browser includes a proxy module for proxy service, which is named helper here. When a user initiates a target website access request of a specified domain name through the dedicated browser, the dedicated browser directs the target website access request of the specified domain name to the port of the proxy module through PAC according to the set access policy. The proxy module connects to a transit server in the access policy through a P2P tunnel according to the access policy, and forwards the target website access request to the transit server.

[0042] Compared with conventional browsers, the dedicated browser of the present invention can set access policies and, through the proxy module PAC mechanism, ensures that each access request to a designated target website must be initiated through a helper, and the helper can make the access according to the set access policy. Therefore, a reliable intermediate layer can be established between the target access website and the access terminal device, thereby improving the security and reliability of the access. When the target access website is the business system of an enterprise, it can be ensured that the access data will not be leaked.

[0043] Therefore, before the access request to the target website is initiated, the access policy needs to be set in advance on the browser console of the dedicated browser. The settings include the domain name of each target website, the associated domain name, whether to display in the tab, the policy associated object, one or more selectable transit servers, one or more selectable springboard servers, etc. The administrator can set the possible links corresponding to each target website through the access policy, and can specify multiple springboard servers to form load balancing and mutual backup. When the dedicated browser connects to the server, it will obtain the network access policy set by the administrator from the browser console in the form of a policy.

[0044] S3. The transit server forwards the target website access request of the specified domain name to the corresponding springboard server in the target side network according to the access policy.

[0045] S4. The springboard server forwards the target website access request to the target website server corresponding to the target website according to the access policy.

[0046] The access policy can be set by the administrator on the browser's WEB console configuration page. Only the administrator has the permission to set it, and the administrator has the corresponding account. The user of the dedicated browser only has the permission to use the browser to access the specified website, and also has the corresponding account. After the access policy is set, it is uploaded to the browser console. The browser console sends the access policy to the dedicated browser, transit server, and springboard server. If the access policy involves multiple transit servers and springboard servers, each transit server and springboard server will receive the access policy. After receiving the access policy, the dedicated browser, transit server, and springboard server establish an encrypted tunnel. Various network requests can be transmitted in these encrypted tunnels. Even http requests, data transmission is safe.

[0047] For dedicated browsers, such as Figure 2 As shown in the figure, the policy acquisition process is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the dedicated browser to obtain the policy from the console after the configuration is completed. In addition, after the dedicated browser is started, it will also try to obtain the policy from the console at regular intervals (such as 10 minutes). Only when the access policy changes will the browser console respond to the policy acquisition request and issue a new access policy. When an access request to a target website is initiated on the dedicated browser, the dedicated browser connects to the browser console to obtain the access policy of the corresponding target website. The access policy contains the information of the transit server and the springboard server.

[0048] For transit servers, such as Figure 3 As shown in the figure, the policy fetching process is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the transit server to fetch the policy from the browser console after the configuration is completed. In addition, after the transit server is started, it will also try to fetch the policy from the browser console at regular intervals (such as 10 minutes). Only when the access policy changes, the browser console will respond to the policy fetching request and issue a new access policy. After the transit server is started, it reports its ID, CPU, memory, bandwidth and other load information to the policy service module at regular intervals (such as 10 minutes) to calculate the optimal path.

[0049] For a springboard server, such as Figure 4As shown in the figure, the policy acquisition process is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the springboard server to obtain the policy from the browser console after the configuration is completed. In addition, the springboard server will also try to obtain the policy from the browser console at regular intervals (such as 10 minutes). Only when the access policy changes, the browser console will respond to the policy acquisition request and issue a new access policy. After receiving the access policy, the springboard server parses and obtains the list of transit servers, establishes an encrypted tunnel with the transit servers in the list, connects to the transit servers, and records the transit servers that are successfully connected. After the springboard server is started, it regularly reports its load information including CPU, memory, and bandwidth at regular intervals (10 minutes), and reports the information of the transit server currently being connected, so as to calculate the optimal path.

[0050] In step S2, when there are multiple relay servers or springboard servers available for selection in the access strategy, the proxy module selects a suitable relay server or springboard server through a preset algorithm based on the load information of each relay server or springboard server to obtain the best path. The load information mainly includes four data items: CPU load, memory usage, available bandwidth and delay.

[0051] The proxy module selects a suitable transit server or springboard server through a preset algorithm to obtain the best path:

[0052] S2-11, each relay server or springboard server reports its load information to the browser console, and the proxy module determines whether each relay server or springboard server has spare capacity in terms of CPU load, memory usage and available bandwidth according to the threshold set by the browser console. If the spare capacity is less than 10%, it is determined that there is no spare capacity.

[0053] S2-12, the dedicated browser and each springboard server obtain the load information of each relay server, and calculate the delay of each relay server through TCPP, that is, the round-trip time of information between the dedicated browser and each relay server, and the round-trip time of information between each relay server and each springboard server, calculate their respective shortest paths according to the delay, and report the delay to the browser console;

[0054] Specifically, the method for calculating the delay of each relay server or jump server may be: the access initiator (helper) opens a new stream on the existing connection, sends a request with a random 32-byte payload, the receiver echoes the 32-byte payload back to the initiator, and the initiator obtains the round-trip time of the underlying connection by calculating the time interval between the request and the response, that is, the delay of the relay server or jump server, specifically calculating the round-trip time of information from the dedicated browser to the relay server, and the round-trip time of information from the relay server to the jump server.

[0055] S2-13. The dedicated browser connects to the browser console to synchronize the information reported by the relay server or the springboard server. The proxy module sorts the information in descending order according to the latency and selects the relay server or springboard server with remaining capacity, that is, first selects the servers with remaining capacity, and then sorts the server list according to the latency to select the server with the smallest latency. The remaining capacity includes the load of the three parameters of bandwidth, CPU and memory.

[0056] In order to control the speed and quality of access, when the number of visits through the helper connection on the dedicated browser exceeds the set value, you can set it to stop accessing the website through the helper to control the number of connections of the dedicated browser.

[0057] The method for establishing an encrypted tunnel between a dedicated browser and a transit server includes the following steps:

[0058] S2-21, Node initialization: Set the listening address and port, and use the multiaddr multi-address format to unify the addresses of different protocols;

[0059] S2-22, Node discovery: Discover nodes on the Internet through Kademlia DHT distributed hash table;

[0060] S2-23, Establish a secure connection: After determining the remote node address, the node attempts to establish a connection with the other party using TLS; during the connection establishment process, the nodes will exchange keys and use the Diffie-Hellman key negotiation algorithm to ensure security;

[0061] S2-24, Multiplexing: Encrypted tunnels support multiple concurrent data stream transmissions on one connection to reduce the need to establish multiple connections and improve communication efficiency;

[0062] S2-25, Service Registration and Discovery: Nodes can register their own services and discover services provided by other nodes. For example, a node can add a ping service so that other nodes can communicate with it through the ping service.

[0063] A system for selecting a point-to-point path to access a target website is used to implement the above method for selecting a point-to-point path to access a target website, comprising an access terminal, a browser console, a transfer server, a springboard server and a visited terminal.

[0064] The access terminal includes an access terminal device and a dedicated browser, the dedicated browser is installed on the access terminal device, and the dedicated browser includes a proxy module for proxy service. The dedicated browser is used to initiate a target website access request of a specified domain name, and direct the target website access request of the specified domain name to the port of the proxy module through the PAC according to the access policy. The proxy module is used to select the best path according to the access policy and connect to the transit server.

[0065] The browser console is used to set the access policy of the target website of the specified domain name, and send the access policy to the dedicated browser, the relay server and the springboard server. The browser console is located in the backend server of the dedicated browser. When the dedicated browser connects to the backend server, it can obtain the access policy and the information uploaded by the relay server and the springboard server.

[0066] The relay servers are deployed in different areas and are used for data relay between the dedicated browser and the springboard server.

[0067] The springboard server is used to connect to the accessed end, including the public network and the intranet. Figure 1 As shown, it can be an Internet public server, such as the numerous public servers conventionally deployed in the Internet public cloud, or it can be an intranet system gateway installed in the enterprise intranet by the enterprise administrator as needed, and the intranet system gateway is deployed in the network on one side of the enterprise intranet.

[0068] The accessed end includes a target website server, and the target website server includes an Internet website server and an enterprise intranet website server. When the target website server is an enterprise intranet website server, the corresponding springboard server is an enterprise intranet system gateway.

[0069] The above detailed description is a specific description of a feasible embodiment of the present invention. The embodiment is not intended to limit the patent scope of the present invention. Any equivalent implementation or modification that does not deviate from the present invention should be included in the patent scope of this case.

Claims

1. A method for selecting a point-to-point path to access a target website, characterized in that: The steps include: S1. Deploy transit servers in different areas of the Internet; S2. Install a dedicated browser on the access terminal device, wherein the dedicated browser includes a proxy module for proxy service. When a user initiates a target website access request of a specified domain name through the dedicated browser, the dedicated browser directs the target website access request of the specified domain name to the port of the proxy module through the PAC according to the set access policy. The proxy module connects to a transit server in the access policy through a P2P tunnel according to the access policy, and forwards the target website access request to the transit server. S3. The transit server forwards the target website access request of the specified domain name to the corresponding springboard server in the target side network according to the access policy; S4. The springboard server forwards the target website access request to the target website server corresponding to the target website according to the access policy.

2. A method for selecting a point-to-point path to access a target website according to claim 1, characterized in that: In step S2, when there are multiple relay servers or springboard servers available for selection in the access policy, the proxy module selects a suitable relay server or springboard server according to the load information of each relay server or springboard server through a preset algorithm to obtain the best path.

3. A method for selecting a point-to-point path to access a target website according to claim 2, characterized in that: The proxy module selects a suitable transit server or springboard server through a preset algorithm to obtain the best path: S2-11. Each relay server or springboard server reports its load information to the browser console. The proxy module determines whether each relay server or springboard server has remaining capacity in terms of CPU load, memory usage and available bandwidth according to the threshold set by the browser console. S2-12, the dedicated browser and each springboard server obtain the load information of each transit server, calculate the delay of each transit server through TCP ping, and report the delay to the browser console; S2-13. The dedicated browser obtains the information uploaded by the relay server or springboard server on the browser console, and the proxy module sorts the information in descending order according to the delay, and selects the relay server or springboard server with the smallest delay from the list of relay servers or springboard servers with remaining capacity.

4. A method for selecting a point-to-point path to access a target website according to claim 2 or 3, characterized in that: The load information includes CPU load, memory usage, available bandwidth and latency.

5. A method for selecting a point-to-point path to access a target website according to claim 3, characterized in that: The method for calculating the delay of each relay server is as follows: the access initiator opens a new stream on the existing connection and sends a request with a random 32-byte payload. The receiver echoes the 32-byte payload back to the initiator. The initiator calculates the time interval between the request and the response to obtain the round-trip time of the underlying connection, that is, the delay of the relay server.

6. A method for selecting a point-to-point path to access a target website according to claim 1, characterized in that: Also includes: Before the target website access request is initiated, the access policy is set on the browser console of the dedicated browser. The access policy includes the domain name of each target website, the associated domain name, the optional transit server, and the optional springboard server.

7. A method for selecting a point-to-point path to access a target website according to claim 1, characterized in that: In step S2, when the user initiates a request to access the target website of the specified domain name through the dedicated browser, it also includes: the browser console sends the access policy to the dedicated browser, the relay server and the springboard server, and the proxy module of the dedicated browser, the relay server and the springboard server establish an encrypted tunnel for transmitting data after receiving the access policy.

8. A method for selecting a point-to-point path to access a target website according to claim 7, characterized in that: The method for establishing an encrypted tunnel between a dedicated browser and a transit server includes the following steps: S2-21, Node initialization: Set the listening address and port, and use the multiaddr multi-address format to unify the addresses of different protocols; S2-22, Node discovery: Discover nodes on the Internet through Kademlia DHT distributed hash table; S2-23, Establish a secure connection: After determining the remote node address, the node attempts to establish a connection with the other party using TLS; during the connection establishment process, the nodes will exchange keys and use the Diffie-Hellman key negotiation algorithm to ensure security; S2-24, Multiplexing: Encrypted tunnels support multiple concurrent data streams over one connection, reducing the need to establish multiple connections; S2-25. Service registration and discovery: Nodes can register their own services and discover services provided by other nodes.

9. The method for selecting a point-to-point path to access a target website according to claim 1, characterized in that: The method for a dedicated browser to obtain access policies is as follows: the browser console pre-configures the access policy for the specified target website, and immediately notifies the dedicated browser to obtain the policy from the browser console after the configuration is completed; at the same time, after the dedicated browser is started, it will try to obtain the policy from the browser console at regular intervals. When the access policy changes, the browser console will respond to the dedicated browser's request to obtain the policy and issue a new access policy; the access policy includes the information of the transit server and the springboard server; The method for the transit server to obtain the access policy is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the transit server to obtain the policy from the browser console after the configuration is completed; at the same time, after the transit service is started, it will try to obtain the policy from the browser console at regular intervals. When the access policy changes, the browser console will respond to the policy request and issue a new access policy; after the transit service is started, it will report its ID, CPU, memory, and bandwidth load information to the policy service module at regular intervals; The method for the springboard server to obtain the access policy process is as follows: the browser console pre-configures the access policy of the specified target website, and immediately notifies the springboard server to obtain the policy from the browser console after the configuration is completed; at the same time, after the springboard server is started, it will periodically go to the browser console to try to obtain the policy at regular intervals. When the access policy changes, the browser console will respond to the policy request and issue a new access policy; after receiving the access policy, the springboard server parses and obtains the list of transit servers, establishes an encrypted tunnel with the transit servers in the list, connects to the transit servers, and records the transit servers that have successfully connected; after the springboard server is started, it periodically reports its load information including CPU, memory and bandwidth at regular intervals.

10. A system for selecting a point-to-point path to access a target website, used to implement the method for selecting a point-to-point path to access a target website as claimed in any one of claims 1 to 9, characterized in that: Includes access terminal, browser console, relay server, springboard server and accessed terminal; The access terminal includes an access terminal device and a dedicated browser, the dedicated browser is installed on the access terminal device, the dedicated browser includes a proxy module for proxy service, the dedicated browser is used to initiate a target website access request of a specified domain name, and direct the target website access request of the specified domain name to the port of the proxy module through the PAC according to the access policy; the proxy module is used to select the best path according to the access policy and connect to the transit server; The browser console is used to set the access policy for the target website of the specified domain name and send the access policy to the dedicated browser, the transit server and the springboard server; The relay servers are deployed in different areas and are used for data transfer between the dedicated browser and the springboard server; The springboard server is used to connect to the accessed end, which is an access server pre-deployed in the Internet public cloud or an intranet system gateway installed in the enterprise intranet by the enterprise administrator as needed, and the intranet system gateway is deployed in the network on one side of the enterprise intranet; The accessed end includes a target website server, and the target website server includes an Internet website server and an enterprise intranet website server.

Images