Web application access proxy method and device in heterogeneous network environment

Abstract

The embodiments of this disclosure provide a web application access proxy method and apparatus in a heterogeneous network environment. The method includes: when an access request sent by a client is detected, authenticating the client based on the access request, and after successful authentication, performing access control and content filtering on the access request; dynamically converting the IP address in the access request and forwarding it to a reverse proxy service of the target server; and receiving the request result returned by the reverse proxy service and forwarding the request result to the client.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of cross-node access for web applications, specifically to a web application access proxy method, apparatus, and computer-readable storage medium storing a computer program in a heterogeneous network environment. Background Technology

[0002] Application access proxy technology is a technique that manages network communication between clients and servers through a proxy server. It allows users to access internal company applications over a secure connection (such as SSL / TLS) in a wide area network (WAN) environment without directly exposing the IP addresses of these applications, thus reducing security risks. Furthermore, access proxies offer numerous advantages, including access control, load balancing, traffic monitoring, content filtering, and access acceleration.

[0003] In a heterogeneous wide area network (WAN) environment, computers or application systems of different platforms, types, and locations interconnect to achieve data sharing and collaborative work. However, because interaction between application systems and between application systems and users in a heterogeneous environment requires crossing different nodes, potential security risks are increased. Currently, network access control is typically based on firewalls, but firewalls alone cannot achieve functions such as content filtering and IP hiding. Summary of the Invention

[0004] The embodiments described herein provide a web application access proxy method, apparatus, and computer-readable storage medium storing a computer program in a heterogeneous network environment.

[0005] According to a first aspect of this disclosure, a web application access proxy method is provided for a heterogeneous network environment, applied in a forward proxy service. The method includes: when an access request sent by a client is detected, authenticating the client based on the access request; after successful authentication, performing access control and content filtering on the access request; dynamically converting the IP address in the access request and forwarding it to a reverse proxy service of the target server; and receiving the request result returned by the reverse proxy service and forwarding the request result to the client.

[0006] In some embodiments of this disclosure, the client is authenticated based on the client's authentication information in the access request, and a data connection is established with the client after successful authentication; the client is waited to send request data, and the request data is matched with the policy rules specified in the access control list. If the match fails, the client's access is prohibited; and the request data is filtered according to user needs to obtain filtered request data. The content filtering includes URL filtering, keyword filtering, and file type filtering.

[0007] In some embodiments of this disclosure, the filtered request data is compared with pre-stored static cache data, and the validity of the static cache data is determined. If the filtered request data contains static cache data and the static cache data is valid, the corresponding static cache data is returned to the client. The static cache data includes images, script files, CSS styles, and HTML files.

[0008] In some embodiments of this disclosure, the source IP address in the access request is replaced with the public IP address of the forward proxy service; the forward proxy service is monitored to see if the access request is successfully forwarded; if the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

[0009] In some embodiments of this disclosure, the working status of the forward proxy service is determined based on the success rate and response time of the forwarding request. When an abnormality is detected in the forward proxy service, the forward proxy service is shut down. The network latency, the load of the forward proxy service, and the response status of the reverse proxy service are used to determine whether the bypass mechanism is met. If the bypass mechanism is met, the access request is sent directly to the reverse proxy service of the target server. When the forward proxy service recovers, the forward proxy service is restarted, and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

[0010] In some embodiments of this disclosure, in response to receiving an access request, the reverse proxy service converts the destination IP address in the access request into the private IP address and port of the target server; based on the private IP address and port, the reverse proxy service forwards the access request to the backend server according to preset application routing rules and returns the request result to the client's forward proxy service; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

[0011] In some embodiments of this disclosure, the reverse proxy service encrypts the request data using the public key of the target server and sends the encrypted request data to the target server; after receiving the encrypted request data, the target server decrypts the encrypted request data using its private key to obtain the client's original request data; after processing the original request data, the target server obtains the request result, encrypts the request result using its private key, and returns it to the reverse proxy service; the reverse proxy service decrypts the encrypted request result using the public key of the target server and returns it to the client's forward proxy service.

[0012] In some embodiments of this disclosure, the reverse proxy service is used to distribute requests to multiple backend servers according to a preset load balancing strategy, and redirect requests to other available servers when a backend server fails.

[0013] According to a second aspect of this disclosure, a web application access proxy apparatus for a heterogeneous network environment is provided. The apparatus includes at least one processor and at least one memory storing a computer program. When the computer program is executed by the at least one processor, the apparatus causes the following actions: upon receiving an access request from a client, to authenticate the client based on the access request; after successful authentication, to perform access control and content filtering on the access request; to dynamically convert the IP address in the access request and forward it to a reverse proxy service of the target server; and to receive the request result returned by the reverse proxy service and forward the request result to the client.

[0014] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to perform access control and content filtering on access requests by: authenticating the client based on the client's authentication information in the access request, and establishing a data connection with the client after successful authentication; waiting for the client to send request data, matching the request data with policy rules specified in the access control list, and prohibiting the client from accessing the request if the match fails; and filtering the request data according to user requirements to obtain filtered request data, wherein the content filtering includes URL filtering, keyword filtering, and file type filtering.

[0015] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to perform cache matching on access requests by: comparing filtered request data with pre-stored static cache data; and if the filtered request data contains static cache data, returning the corresponding static cache data to the client, wherein the static cache data includes images, script files, CSS styles, and HTML files.

[0016] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to also perform the following operations to dynamically convert the IP address in the access request and forward it to the reverse proxy service of the target server: replacing the source IP address in the access request with the public IP address of the forward proxy service; monitoring whether the access request forwarded by the forward proxy service is successfully forwarded; and if the forwarding fails, sending the access request directly to the reverse proxy service of the target server according to a bypass mechanism.

[0017] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to further perform the following operations to send access requests directly to the reverse proxy service of the target server: determine the working status of the forward proxy service based on the success rate and response time of forwarding requests; shut down the forward proxy service when an abnormality is detected in the forward proxy service; determine whether a bypass mechanism is met based on network latency, the load of the forward proxy service, and the response status of the reverse proxy service; if the bypass mechanism is met, send the access request directly to the reverse proxy service of the target server; and restart the forward proxy service when the forward proxy service recovers, and forward the access request to the reverse proxy service of the target server through the forward proxy service.

[0018] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to further receive a request result returned by a reverse proxy service and forward the request result to a client by: in response to receiving an access request, the reverse proxy service converts the destination IP address in the access request to the private IP address and port of the target server; based on the private IP address and port, the reverse proxy service forwards the access request to a backend server according to preset application routing rules and returns the request result to the client; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

[0019] In some embodiments of this disclosure, when executed by at least one processor, the computer program causes the device to further perform the following operations to return the request result to the client's forward proxy service: the reverse proxy service encrypts the request data using the public key of the target server and sends the encrypted request data to the target server; after receiving the encrypted request data, the target server decrypts the encrypted request data using its private key to obtain the client's original request data; after processing the original request data to obtain the request result, the server encrypts the request result using its private key and returns it to the reverse proxy service; the reverse proxy service decrypts the encrypted request result using the public key of the target server and returns it to the client's forward proxy service.

[0020] According to a third aspect of this disclosure, a computer-readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the web application access proxy method in a heterogeneous network environment according to a first aspect of this disclosure. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein:

[0022] Figure 1 A schematic diagram illustrating a forward proxy service usage pattern according to an embodiment of the present disclosure is shown.

[0023] Figure 2 A schematic diagram illustrating a reverse proxy service usage pattern according to an embodiment of the present disclosure is shown.

[0024] Figure 3 A schematic diagram illustrating the principle of web application access in a heterogeneous network environment according to an embodiment of the present disclosure is shown.

[0025] Figure 4 An exemplary flowchart of a web application access proxy method 400 in a heterogeneous network environment according to an embodiment of the present disclosure is shown.

[0026] Figure 5 This diagram illustrates the interaction flow of cross-node application access requests over a wide area network.

[0027] Figure 6 This is a schematic block diagram of a web application access proxy device in a heterogeneous network environment according to embodiments of the present disclosure.

[0028] It should be noted that the elements in the attached diagram are schematic and not drawn to scale. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.

[0030] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having meanings consistent with their meanings in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. Furthermore, terms such as “first” and “second” are used only to distinguish one component (or part of a component) from another component (or another part of a component).

[0031] As we all know, both forward proxies and reverse proxies are proxy servers that sit between the client and the server. A forward proxy requires actively configuring the proxy server's IP address or domain name; the configured proxy server IP or domain name accesses the server's content and returns the results to the client. A reverse proxy receives the client's request, forwards it to a server on the internal network, and then returns the result from the server to the client. In other words, a forward proxy acts as a proxy for the client, while a reverse proxy acts as a proxy for the server.

[0032] Figure 1 This diagram illustrates a usage pattern of a forward proxy service according to an embodiment of the present disclosure. Figure 1 As shown, when a client within a local area network accesses a network server, a forward proxy service acts as an intermediary to forward request and response data. Specifically, the client sends an access request, and its identity is authenticated through an authorization and authentication mechanism. The authenticated client then establishes a data connection with the forward proxy service. The forward proxy service obtains the target server's address and port, establishes a data connection with the server, waits for the client to send request data, forwards the request data to the server, waits for the server to return response data, and forwards the response data back to the client.

[0033] Figure 2 This diagram illustrates a reverse proxy service usage pattern according to an embodiment of the present disclosure. Figure 2 As shown, the server-side application system needs to provide the reverse proxy service with information such as application IP, port, and protocol type in order to register with the reverse proxy service and be assigned a unique identifier. The reverse proxy service receives connection requests from clients on the wide area network, forwards the requests to the actual internal application server based on the application's unique identifier, and returns the request result to the client.

[0034] To address the security, traffic management, and availability issues of cross-node application access in heterogeneous WAN environments, this disclosure proposes a web application access proxy method for heterogeneous network environments. This method combines proxy services and firewall policies to achieve secure cross-node access and traffic forwarding.

[0035] Figure 3 This diagram illustrates the principle of web application access in a heterogeneous network environment according to embodiments of the present disclosure. Figure 3 As shown, a wide area network distributed heterogeneous environment contains two or more nodes: node A, node B, node C, node D, node E, etc.

[0036] Taking a client on node A accessing an application system on node B across nodes as an example, the proxy direction of node A is a forward proxy, with the source address being the proxy service IP of node A, the destination address being the proxy service IP of node B, and the port being the application port of node B. The proxy direction of node B is a reverse proxy, with the source address being the proxy service IP of node A, the destination address being the proxy service IP of node B, and the port being the application port of node B.

[0037] Node A registers the client's IP address with its forward proxy service through user authentication, allowing requests originating from that client's IP address to be forwarded. Node A's forward proxy service first identifies the client's IP address. The data authentication service then checks if the IP address is in its local IP address list. If the IP address is found, all access requests from that client are marked with data identifiers. Upon successful authentication, the requests are forwarded. Traffic originating from Node A's proxy service IP and destined for other nodes' proxy service IPs is allowed to pass through.

[0038] Node B allows traffic whose source IP address is the proxy service IP of another node and whose destination address is the proxy service IP of Node B. Node B publishes the application to its reverse proxy service and assigns a unique identifier so that the reverse proxy service can redirect requests to the actual internal application server based on the application's unique identifier.

[0039] To further explain the embodiments of this disclosure in detail, Figure 4 An exemplary flowchart is shown for a web application access proxy method 400 in a heterogeneous network environment according to an embodiment of the present disclosure.

[0040] exist Figure 4 At box S402, when an access request sent by a client is detected, the client is authenticated based on the access request. After successful authentication, access control and content filtering are performed on the access request.

[0041] A forward proxy service is set up on the client side. Upon receiving an access request from a client, it first authenticates the client based on the authentication information in the request. If authentication is successful, a data connection is established with the client. Specifically, a client's access request typically includes a request method, URL, request headers, and a request body. The request headers contain client authentication information, such as username and password, API key, or token. The client's identity can be verified according to a preset authentication mechanism. For example, the authentication information can be compared with a stored user database (a list of local IP addresses). If verification is successful, the forward proxy checks whether the client has permission to access the requested resource. After successful authentication, a data connection is established with the client, and the forward proxy assigns a unique session ID to this connection.

[0042] Then, wait for the client to send request data, match the request data with the policy rules specified in the access control list, and deny access if the match fails.

[0043] The Access Control List (ACL) includes multiple policy rules that define which clients can access which resources and under what conditions access is allowed or denied. Each policy rule includes multiple conditions, such as source address (client IP address), destination address (target server IP address), port (target server port number), access path, and access time.

[0044] The matching process involves the following steps:

[0045] Sequential matching: Rules in an ACL are arranged in order and matched one by one from top to bottom.

[0046] Condition check: For each rule, check whether the request meets all the conditions of that rule.

[0047] Rule Matching: Once a request meets a rule, the action defined by that rule (such as allowing or denying access) is immediately executed, and subsequent rule checks are terminated. If a request meets the conditions of a rule, the proxy service forwards the request to the target server and returns a response to the client. If the request matches a deny rule, an error response (such as 403 Forbidden) is returned, informing the client that access is denied.

[0048] Suppose the ACL contains the following rules:

[0049] Rule 1:

[0050] Source address: 192.168.1.0 / 24

[0051] Target address: example.com

[0052] Port: 80

[0053] Access path: / public / *

[0054] Access hours: Weekdays 9:00-17:00

[0055] Action: Allow access

[0056] Rule 2:

[0057] Source address: 192.168.1.0 / 24

[0058] Target address: example.com

[0059] Port: 80

[0060] Access path: / private / *

[0061] Action: Deny access

[0062] In this example, a request originating from an IP address of 192.168.1.x and accessing / public / resource would be allowed. An attempt to access / private / resource would be denied. ACLs can be audited and updated regularly to ensure they reflect the latest security requirements and business changes. Access control logs are maintained to track and audit access behavior and identify potential security threats.

[0063] After the access control list is successfully matched, content filtering can be performed on client request data according to user needs, including URL filtering, keyword filtering, and file type filtering.

[0064] For example, URL filtering: parse the requested domain name / IP address / URL and match it against a domain blacklist / IP blacklist / URL blacklist. If a match is found, the request is rejected.

[0065] Keyword filtering: Set the sensitive keywords to be monitored. Analyze the data in the request (such as the HTTP request body, query parameters, etc.) to find matching keywords. Check if the request contains sensitive keywords. If so, reject the request or return a warning message.

[0066] File type filtering: Defines allowed or prohibited file types (such as images, documents, executable files, etc.). The file type is determined by analyzing the Content-Type header in the request. The Content-Type information in the request header is parsed. The file type is checked to see if it is in the allowed or prohibited list. Based on the check result, a decision is made to allow or block the request.

[0067] To reduce access to the target server and improve network access efficiency, the content-filtered request data can be compared with pre-stored static cache data to determine the validity of the static cache data. If the filtered request data contains static cache data and the static cache data is valid, it is directly returned to the client. Static cache data includes images, script files, CSS styles, HTML files, etc. The cache expiration period can be set to determine when it needs to be updated. For example, using the If-Modified-Since or If-None-Match headers for conditional requests ensures that the cache is only updated when data changes. Alternatively, an LRU (Least Recently Used) strategy can be used to manage cache space and evict infrequently used data. Therefore, if the request data contains cached static network content, the cache validity also needs to be checked (usually by setting an expiration time). If the cache is valid, the proxy server can directly return the cached data to the client, avoiding requests to the target server.

[0068] exist Figure 4 In box S404, a reverse proxy service dynamically translates the IP address in the access request and forwards it to the target server.

[0069] In some embodiments of this disclosure, the forward proxy service replaces the source IP address in the client access request with the public IP address of the forward proxy service. By replacing the source IP address in the request, the forward proxy can prevent the target server from obtaining the real IP address of internal users, thereby improving the security of application access. Specifically, an appropriate external IP address can be dynamically assigned to each user or group of requests. This external IP address is usually the public IP address of the proxy server, which can be accessed via the Internet. If the proxy server has multiple public IP addresses, it can flexibly select one based on the current traffic and request characteristics.

[0070] In one embodiment of this disclosure, the forward proxy server can be controlled based on dynamic bypass technology. The malfunction of the forward proxy is determined by monitoring whether the access requests forwarded by the forward proxy service are successfully forwarded. If forwarding fails, the access request is directly sent to the reverse proxy service of the target server according to the bypass mechanism.

[0071] Specifically, the working status of the forward proxy service is determined based on the success rate and response time of forwarding requests. When an abnormality is detected in the forward proxy service, it is shut down. The system determines whether the bypass mechanism is met based on network latency, the load of the forward proxy service, and the response status of the reverse proxy service. If the bypass mechanism is met, the access request is sent directly to the reverse proxy service of the target server. When the forward proxy service returns to normal, it is restarted and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

[0072] For example, when the response time of the forward proxy service becomes excessively long due to high load, a dynamic bypass is used to bypass the forward proxy, allowing access requests to reach the target server directly. When the forward proxy returns to normal, the forward proxy service is restarted, and requests are forwarded through the forward proxy service.

[0073] It is evident that direct access reduces request latency, ensures service continuity, and provides a better user experience during network congestion, busy proxy services, or performance degradation. For frequently updated content that does not require caching, clients can directly retrieve the latest content, improving the flexibility of resource utilization.

[0074] A reverse proxy service translates the destination IP address in an access request into the private IP address and port of the target server. In a reverse proxy, dynamic address translation (URL translation) is primarily used to dynamically translate requests from external users to the public IP address of the reverse proxy service to the private IP address of the real server within the internal network. In other words, when an external client sends a request to the public IP address of the reverse proxy service, the reverse proxy receives the request and, according to configured rules and algorithms, dynamically forwards it to the real server within the internal network. During this process, the reverse proxy service translates the destination IP address (public IP address) in the request into the private IP address of the real service, ensuring that the request correctly reaches the internal server.

[0075] Therefore, dynamic address translation (DHCP) technology can change the source or destination IP address in a request data packet. When an internal network client accesses external resources through a proxy, the proxy replaces the source IP address (i.e., the client's private IP) in the request data packet sent by the client with the proxy service's own public IP address. This is a dynamic process; IP address translation is performed every time a new request is made. From a security perspective, it can hide the internal network topology and the client's real IP address, effectively preventing direct attacks from external networks on clients within the internal network. From a resource utilization perspective, for proxy services with multiple public IP addresses, IP addresses can be dynamically allocated based on factors such as traffic and request type, thus making more flexible use of IP resources.

[0076] exist Figure 4 At box S406, the request result returned by the reverse proxy service is received and forwarded to the client.

[0077] In some embodiments of this disclosure, to enable the reverse proxy to effectively forward requests, each server node in the service cluster needs to register the IP address, port number, and protocol type (such as HTTP, HTTPS, or TCP) of the backend application with the reverse proxy service. Application routing rules are set to route requests from different paths to the corresponding backend application servers. The reverse proxy service can forward access requests to the backend servers according to the preset application routing rules and return the request results to the client's forward proxy service.

[0078] After the backend server processes the request, it sends the response back to the reverse proxy service. The reverse proxy service then returns the response content to the client's forward proxy service. From the client's perspective, it only interacts with the public IP address of the reverse proxy service from beginning to end.

[0079] In some embodiments of this disclosure, the reverse proxy service encrypts the request data using the target server's public key and sends the encrypted request data to the target server. Upon receiving the encrypted request data, the target server decrypts it using its private key to obtain the client's original request data. The target server processes the original request data to obtain the request result, encrypts the result using its private key, and returns it to the reverse proxy service. The reverse proxy service then decrypts the encrypted request result using the target server's public key and returns it to the client's forward proxy service. This ensures the security and integrity of the data when it is returned to the client.

[0080] In addition, the reverse proxy service supports a variety of load balancing strategies, such as round-robin, weighted round-robin, least connections weight, IP binding, and URL binding. It distributes requests to multiple backend servers according to the preset load balancing strategy. When a backend server fails, the request is redirected to other available servers, thereby improving the system's load balancing, availability, and security.

[0081] Reference Figure 3 and combined Figure 4 The access flow shown is as follows: Figure 5 This diagram illustrates the interaction process of cross-node application access requests over a wide area network.

[0082] like Figure 5As shown, when a client on node A needs to access the application system on node B, the forward proxy service on node A first obtains the client's information (IP address, MAC address) through user authentication. It identifies the client's IP address and the data authentication service checks if the IP address is in the local IP address list. Once the IP address is found, all access requests from that client are processed with data identification. Node A configures a firewall policy that allows forward proxying, with the source address being the IP address of node A's proxy service, the destination address being the IP address of node B's proxy service, and the port being the application port of node B. The forward proxy service on node A receives outbound traffic and identifies all outbound traffic, allowing traffic with a source IP address of node A's proxy service and a destination IP address of another node's proxy service.

[0083] Before forwarding a request, the forward proxy service can perform operations such as access control, content filtering, and cache matching on the request data. Specifically, the forward proxy service restricts user access through policy conditions specified by Access Control Lists (ACLs). An ACL consists of multiple policy rules that can filter based on various conditions such as source address, destination address, port, access path, and access time. The matching order of policy rules is the same as that of firewall policy rules, proceeding from top to bottom; once a rule is matched, the corresponding operation is immediately executed and the matching process ends.

[0084] After allowing users access, content filtering can be performed based on user needs, supporting URL filtering, keyword filtering, file type filtering, etc. For example, access to certain sensitive websites or certain keywords can be blocked, so as to achieve different access restrictions and controls for different users.

[0085] After content filtering, the forward proxy service can match the requested data with cached, commonly used static web content, such as images, script files, CSS styles, and HTML files. If the client makes the same data request and the server-side application response remains unchanged, the forward proxy service can directly return the cached data to the client. If no match is found, proxy forwarding is performed.

[0086] When forwarding a request, the forward proxy service replaces the source IP address in the access request with the public IP address of the forward proxy service, and monitors whether the access request forwarded by the forward proxy service is successfully forwarded. If the forwarding fails, the access request is sent directly to the reverse proxy service of the target server according to the bypass mechanism.

[0087] Node B configures a firewall policy that allows traffic to pass through, with the proxy direction being reverse proxy. The source address is the proxy service IP of Node A, the destination address is the proxy service IP of Node B, and the port is the application port of Node B. When Node B's reverse proxy service receives inbound traffic, it allows traffic whose source IP address is the proxy service IP of another node and whose destination address is the proxy service IP of that node. The reverse proxy service translates the destination IP address in the access request into the private IP address and port of the target server, matches it against the routing table, and, based on the application's unique identifier, forwards the request to the actual internal application server. It then returns the request result to the client's forward proxy service, which in turn forwards the request result to the client machine on Node A.

[0088] In summary, the cooperation between forward and reverse proxies between nodes A and B enables effective traffic management and security control.

[0089] Figure 6 This is a schematic block diagram of a web application access proxy device in a heterogeneous network environment according to embodiments of the present disclosure. Figure 6 As shown, the device 600 may include a processor 610 and a memory 620 storing a computer program. When the computer program is executed by the processor 610, the device 600 is made capable of performing actions such as... Figure 4 The steps of method 400 are shown. In one example, device 600 can be a computer device or a cloud computing node. When device 600 detects an access request sent by a client, it can authenticate the client based on the access request. After successful authentication, it can perform access control and content filtering on the access request. Device 600 can dynamically translate the IP address in the access request and forward it to the reverse proxy service of the target server. Device 600 can receive the request result returned by the reverse proxy service and forward the request result to the client.

[0090] In some embodiments of this disclosure, the device 600 may authenticate the client based on the client's authentication information in the access request, and establish a data connection with the client after successful authentication; wait for the client to send request data, match the request data with the policy rules specified in the access control list, and prohibit the client from accessing if the match fails; and filter the request data according to user needs to obtain filtered request data, including URL filtering, keyword filtering and file type filtering.

[0091] In some embodiments of this disclosure, the device 600 can compare the filtered request data with pre-stored static cache data and determine the validity of the static cache data; if the filtered request data contains static cache data and the static cache data is valid, the corresponding static cache data is returned to the client. The static cache data includes images, script files, CSS styles, and HTML files, etc.

[0092] In some embodiments of this disclosure, the device 600 may replace the source IP address in the access request with the public IP address of the forward proxy service; monitor whether the access request forwarded by the forward proxy service is successfully forwarded; if the forwarding fails, the access request is directly sent to the reverse proxy service of the target server according to the bypass mechanism.

[0093] In some embodiments of this disclosure, the device 600 can determine the working status of the proxy service based on the success rate and response time of forwarding requests. When an abnormality is detected in the forward proxy service, the device shuts down the forward proxy service. It can determine whether the bypass mechanism is met based on network latency, the load of the forward proxy service, and the response status of the reverse proxy service. If the bypass mechanism is met, the device directly sends the access request to the reverse proxy service of the target server. When the forward proxy service returns to normal, the device restarts the forward proxy service and forwards the access request to the reverse proxy service of the target server through the forward proxy service.

[0094] In some embodiments of this disclosure, the apparatus 600 may, in response to receiving an access request, convert the destination IP address in the access request into the private IP address and port of the target server; based on the private IP address and port, the reverse proxy service may forward the access request to the backend server according to preset application routing rules and return the request result to the client's forward proxy service; and in response to receiving the request result returned by the reverse proxy service, the forward proxy service may forward the request result to the client.

[0095] In some embodiments of this disclosure, the apparatus 600 can encrypt request data using the public key of the target server in the reverse proxy service and send the encrypted request data to the target server; after receiving the encrypted request data, the target server decrypts the encrypted request data using its private key to obtain the original request data of the client; after processing the original request data, the target server obtains the request result, encrypts the request result using its private key, and returns it to the reverse proxy service; the reverse proxy service decrypts the encrypted request result using the public key of the target server and returns it to the client's forward proxy service.

[0096] In embodiments of this disclosure, processor 610 may be, for example, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a processor based on a multi-core processor architecture, etc. Memory 620 may be any type of memory implemented using data storage technologies, including but not limited to random access memory, read-only memory, semiconductor-based memory, flash memory, disk storage, etc.

[0097] Furthermore, in embodiments of this disclosure, device 600 may also include an input device 630, such as a keyboard, mouse, etc., for use in [specific applications]. Additionally, device 600 may also include an output device 640, such as a display, for outputting data.

[0098] In other embodiments of this disclosure, a computer-readable storage medium storing a computer program is also provided, wherein the computer program, when executed by a processor, is capable of performing the following functions: Figure 4 The steps of the web application access proxy method 400 in the heterogeneous network environment are shown.

[0099] In summary, the web application access proxy method and apparatus in a heterogeneous network environment according to the embodiments of this disclosure allow users in a wide area network to remotely access an enterprise's application system from any location without installing additional software or performing complex configurations on local devices. By using methods such as encrypted data transmission, identity authentication, access control, and content filtering, it provides robust security protection for the application system, reduces the risk of data leakage and unauthorized access, and protects the enterprise's sensitive information and assets.

[0100] Easily scale as your business grows. Whether it's increasing the number of users, expanding application systems, or improving access speed, it can all be achieved through simple configuration without large-scale system modifications. This ensures that businesses can flexibly expand their user base and applications while maintaining efficiency and security. This solution achieves high security, high availability, and flexible configuration and expansion for cross-node application access in a distributed heterogeneous WAN environment.

[0101] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses and methods according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0102] Unless otherwise expressly indicated by the context, the singular form of words used herein and in the appended claims includes the plural form, and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the terms “comprising” and “including” shall be interpreted as including rather than exclusively. Likewise, the terms “including” and “or” shall be interpreted as including unless such interpretation is expressly prohibited herein. Where the term “example” is used herein, particularly when it follows a set of terms, “example” is merely exemplary and illustrative and should not be considered exclusive or extensive.

[0103] Further aspects and scope of adaptation become apparent from the description provided herein. It should be understood that various aspects of this application may be implemented individually or in combination with one or more other aspects. It should also be understood that the descriptions and specific embodiments herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0104] Several embodiments of this disclosure have been described in detail above. However, it is obvious that those skilled in the art can make various modifications and variations to the embodiments of this disclosure without departing from the spirit and scope of this disclosure. The scope of protection of this disclosure is defined by the appended claims.

Claims

1. A web application access proxy method in a heterogeneous network environment, characterized in that, The method includes: When an access request is received from a client, the client is authenticated based on the access request. After successful authentication, access control and content filtering are performed on the access request. The reverse proxy service dynamically translates the IP address in the access request and forwards it to the target server. This includes: replacing the source IP address in the access request with the public IP address of the forward proxy service; monitoring whether the access request forwarded by the forward proxy service is successful; if forwarding fails, directly sending the access request to the reverse proxy service of the target server according to a bypass mechanism; and Receive the request result returned by the reverse proxy service and forward the request result to the client.

2. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that, When an access request sent by a client is detected, the client is authenticated based on the access request. After successful authentication, access control and content filtering of the access request are performed, including: The client is authenticated based on the client's authentication information in the access request. Once authentication is successful, a data connection is established with the client. Wait for the client to send request data, match the request data against the policy rules specified in the access control list, and if the match fails, prohibit the client from accessing the system; and If a match is found, the request data is filtered based on the user's needs data to obtain filtered request data. The content filtering includes URL filtering, keyword filtering, and file type filtering.

3. The web application access proxy method in a heterogeneous network environment according to claim 2, characterized in that, When an access request sent by a client is detected, the client is authenticated based on the access request. After successful authentication, access control and content filtering are performed on the access request, including: The filtered request data is compared with the pre-stored static cache data, and the validity of the static cache data is determined. If the filtered request data contains the static cache data and the static cache data is valid, then the corresponding static cache data is returned to the client. The static cache data includes images, script files, CSS styles, and HTML files.

4. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that, The monitoring of whether the access request forwarded by the forward proxy service was successfully forwarded includes: The working status of the forward proxy service is determined based on the success rate and response time of the forwarding requests. When an abnormality is detected in the working status of the forward proxy service, the forward proxy service is shut down. Based on network latency, the load of the forward proxy service, and the response status of the reverse proxy service, it is determined whether a bypass mechanism is met. If the bypass mechanism is met, the access request is directly sent to the reverse proxy service of the target server; and When the forward proxy service returns to normal, the forward proxy service is restarted, and the access request is forwarded to the reverse proxy service of the target server through the forward proxy service.

5. The web application access proxy method in a heterogeneous network environment according to claim 1, characterized in that, The step of receiving the request result returned by the reverse proxy service and forwarding the request result to the client includes: In response to receiving the access request, the reverse proxy service translates the destination IP address in the access request into the private IP address and port of the target server; Based on the private IP address and port, the reverse proxy service forwards the access request to the backend server according to preset application routing rules, and returns the request result to the client's forward proxy service; and In response to receiving the request result returned by the reverse proxy service, the forward proxy service forwards the request result to the client.

6. The web application access proxy method in a heterogeneous network environment according to claim 5, characterized in that, The forward proxy service, which forwards the access request to the backend server according to preset application routing rules based on the private IP address and port, and returns the request result to the client, includes: The reverse proxy service uses the target server's public key to encrypt the request data and sends the encrypted request data to the target server. After receiving the encrypted request data, the target server uses its private key to decrypt the encrypted request data and obtain the client's original request data. After processing the original request data to obtain the request result, the request result is encrypted using a private key and then returned to the reverse proxy service; and The reverse proxy service uses the target server's public key to decrypt the encrypted request result and then returns it to the client's forward proxy service.

7. The web application access proxy method in a heterogeneous network environment according to claim 5, characterized in that, The reverse proxy service is used to distribute requests to multiple backend servers according to a preset load balancing strategy. When a backend server fails, the request is redirected to other available backend servers.

8. A web application access proxy device in a heterogeneous network environment, characterized in that, The device includes: At least one processor; and At least one memory storing a computer program; When the computer program is executed by the at least one processor, the device performs the steps of the web application access proxy method in a heterogeneous network environment according to any one of claims 1 to 7.

9. A computer-readable storage medium storing a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the web application access proxy method in a heterogeneous network environment according to any one of claims 1 to 7.

Images