Intranet access method and device, computer equipment and readable storage medium

Abstract

The invention relates to an intranet access method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: a cloud side gateway receives an intranet access request; inquiring whether terminal equipment corresponding to a client logging in the cloud desktop network address supports internal network penetration or not; if so, taking the gateway address corresponding to the client as the next hop address of the cloud desktop network address, and sending the intranet access request to the intranet network address through the next hop address; if not, selecting a target client from an intranet gateway group belonging to the same intranet as the client, taking a gateway address corresponding to the target client as a next-hop address of the cloud desktop network address, and sending the intranet access request to the intranet network address through the next-hop address; and the terminal equipment corresponding to each client in the intranet gateway group supports an address forwarding function and a source address conversion function. And the intranet penetration requirement can be realized without a special line and virtual private network equipment.

Description

Technical Field

[0001] The present application relates to the field of network technology and security technology, and in particular to an intranet access method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] With the widespread application of cloud desktop technology, users' demands for it are becoming increasingly diverse, such as accessing local printers and store cashiers through cloud desktops. Dedicated dedicated lines and virtual private network devices can be used to achieve intranet access, but this method requires additional equipment and is highly complex. Summary of the invention

[0003] Based on this, it is necessary to provide an intranet access method, device, computer equipment, computer-readable storage medium and computer program product with low complexity and capable of achieving intranet penetration in response to the above technical problems.

[0004] In a first aspect, the present application provides an intranet access method, which is applied to a cloud-side gateway, comprising:

[0005] Receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address and the destination address is the intranet network address;

[0006] Query the database for the terminal device corresponding to the client that logs in to the cloud desktop network address to determine whether it supports the address forwarding function and the source address translation function;

[0007] If supported, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address;

[0008] If not supported, select the target client from the intranet gateway group that belongs to the same intranet as the client, use the gateway address corresponding to the target client as the next-hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next-hop address; the terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address conversion function.

[0009] In a second aspect, the present application also provides an intranet access method, which is applied to a client, comprising:

[0010] Receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address logged in by the client, and the destination address is the intranet network address; after receiving the intranet access request, the cloud-side gateway queries from a database whether the terminal device corresponding to the client supports the address forwarding function and the source address translation function, and sends the request to the client if the function is supported;

[0011] The intranet access request is sent to the intranet network address.

[0012] In a third aspect, the present application also provides an intranet access method, which is applied to a controller, comprising:

[0013] Receiving a registration request sent by a client, where the registration request is generated by the client based on function indication information, where the function indication information is generated based on a detection result of the client detecting whether a terminal device corresponding to the client supports an address forwarding function and a source address translation function in response to a registration trigger operation;

[0014] Sending the registration request to the cloud-side gateway to instruct the cloud-side gateway to verify the registration request, and if the verification passes, assigning a gateway address to the client;

[0015] Receive the gateway address sent by the cloud-side gateway, and return the gateway address to the client;

[0016] receiving a login request sent by the client, where the login request is generated by the client in response to a cloud desktop login operation and is based on the gateway address;

[0017] Sending the login request to the cloud-side gateway to instruct the cloud-side gateway to verify the login request, and if the verification passes, assigning a cloud desktop network address to the client;

[0018] Receive the cloud desktop network address sent by the cloud-side gateway, return the cloud desktop network address to the client, and store the corresponding relationship between the client, the function indication information, the gateway address, and the cloud desktop network address in a database.

[0019] In a fourth aspect, the present application also provides an intranet access device, including:

[0020] A receiving module, used to receive an intranet access request, wherein the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address;

[0021] A query module, used to receive an intranet access request, wherein the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address;

[0022] The processing module is used to, if supported, use the gateway address corresponding to the client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; if not supported, select a target client from an intranet gateway group belonging to the same intranet as the client, use the gateway address corresponding to the target client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address conversion function.

[0023] In a fifth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the first aspect, the second aspect, or the third aspect when executing the computer program.

[0024] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the first aspect, the second aspect, or the third aspect when executed by a processor.

[0025] In a seventh aspect, the present application further provides a computer program product, comprising a computer program, which implements the steps of the first aspect, the second aspect or the third aspect when executed by a processor.

[0026] In the above-mentioned intranet access method, device, computer equipment, computer-readable storage medium and computer program product, the cloud-side gateway receives an intranet access request, the source address carried by the intranet access request is the cloud desktop network address, and the destination address is the intranet network address; the terminal device corresponding to the client that logs in to the cloud desktop network address is queried from the database to see whether it supports the address forwarding function and the source address conversion function; if it does, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; if it does not, the target client is selected from the intranet gateway group that belongs to the same intranet as the client, and the gateway address corresponding to the target client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support the address forwarding function and the source address conversion function. This enables the cloud desktop to access the intranet service through the client, without the need for dedicated dedicated lines and virtual private network equipment, and can also meet the intranet penetration requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0028] FIG1 is an application environment diagram of an intranet access method in one embodiment;

[0029] Figure 2 It is a schematic diagram of the process on the cloud-side gateway side in an embodiment;

[0030] Figure 3 A schematic diagram of a process flow on the client side in an embodiment;

[0031] Figure 4 FIG1 is a flow chart of an intranet access method in one embodiment;

[0032] Figure 5 is a schematic diagram of a flow chart on the controller side in one embodiment;

[0033] Figure 6 A schematic diagram of the process of an intranet access method in an embodiment Figure 2 ;

[0034] Figure 7 This is a structural block diagram of a cloud-side gateway in an embodiment;

[0035] Figure 8 A structural block diagram of a client in one embodiment;

[0036] Fig. 9 FIG. 4 is a structural block diagram of a controller in one embodiment. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0038] The intranet access method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. The application environment shown in Figure 1 includes a cloud desktop resource pool network, a cloud measurement gateway, a controller, at least one user terminal connected to the customer intranet, and a customer intranet service. A gateway client is installed on the user terminal. Customer intranet services include printer services, mail services, server services, etc. The customers here can be individuals, enterprises, institutions, etc. who have purchased the cloud desktop service corresponding to the cloud desktop resource pool network.

[0039] Among them, user terminals can be, but are not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0040] In an exemplary embodiment, Figure 2 As shown, an intranet access method is provided, and the method is applied to the cloud side gateway in FIG. 1 as an example for description, including the following steps 202 to 208. Among them:

[0041] Step 202: Receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address.

[0042] Among them, the intranet access request comes from the cloud desktop resource pool network. After the cloud-side gateway receives the intranet access request, it parses the intranet access request to obtain the source address and destination address. Among them, the source address is the intranet network address, and the destination address is the network address of the customer's intranet service. For the convenience of explanation, it is called the intranet network address in the embodiment of this application.

[0043] Step 204, query the database for the terminal device corresponding to the client that logs into the cloud desktop network address to see whether it supports the address forwarding function and the source address translation function.

[0044] The database stores each client that has logged into the corresponding cloud desktop network address, the gateway address corresponding to the client, the function indication information corresponding to the client, and the cloud desktop network address logged in by the client. The function indication information is used to indicate whether the terminal device corresponding to the corresponding client supports the address forwarding function (IP forward) and the source address translation function (SNAT). When the function indication information is the first preset value, it means that the terminal device corresponding to the client supports the address forwarding function (IP forward) and the source address translation function (SNAT); when the function indication information is the second preset value, it means that the terminal device corresponding to the client does not support the address forwarding function (IP forward) and the source address translation function (SNAT); the first preset value can be 1, and the second preset value can be 0.

[0045] Among them, after the cloud-side gateway resolves the intranet access request to obtain the cloud desktop network address, it can query the function indication information corresponding to the client that logs in to the cloud desktop network address from the database, and determine whether the terminal device corresponding to the client supports the address forwarding function and the source address translation function based on the value of the function indication information.

[0046] Step 206: If supported, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address.

[0047] Among them, if the judgment result of step 204 is support, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the next hop address, that is, sent to the client, and the client forwards the intranet access request to the intranet network address.

[0048] Step 208, if it is not supported, select the target client from the intranet gateway group that belongs to the same intranet as the client, use the gateway address corresponding to the target client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address conversion function.

[0049] If the judgment result of step 204 is not supported, a client is randomly selected from the intranet gateway group as the target client, the gateway address corresponding to the target client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the next hop address, that is, sent to the target client, and the target client forwards the intranet access request to the intranet network address. The terminal devices corresponding to each client in the intranet gateway group support the address forwarding function and the source address conversion function. Each client in the intranet gateway group belongs to the same intranet.

[0050] Among them, the cloud-side gateway is mainly implemented through Vector Packet Processing (VPP), which is mainly responsible for establishing a gateway virtual private network (Wireguard VPN) tunnel with the client, forwarding the client's access to the cloud desktop traffic and the cloud desktop's access to the client's intranet traffic.

[0051] In the above embodiment, the cloud-side gateway receives an intranet access request, the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address; the terminal device corresponding to the client that logs in to the cloud desktop network address is queried from the database to see whether it supports the address forwarding function and the source address conversion function; if it does, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; if it does not, the target client is selected from the intranet gateway group that belongs to the same intranet as the client, and the gateway address corresponding to the target client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support the address forwarding function and the source address conversion function. This enables the cloud desktop to access intranet services through the client, without the need for dedicated dedicated lines and virtual private network equipment, and can also meet the intranet penetration requirements.

[0052] In some embodiments, the intranet access method provided by the embodiments of the present application also includes: periodically detecting the connectivity between the gateway address of each client in the intranet gateway group and the logged-in cloud desktop network address; in the event of no connectivity, removing the corresponding client from the intranet gateway group.

[0053] Among them, the cloud testing gateway can periodically detect the connectivity between the gateway address of each client in the intranet gateway group and the logged-in cloud desktop network address through the Bidirectional Forwarding Detection (BFD) protocol. For example, detection is performed every 5 minutes, every 10 minutes, every 24 hours, etc., and this embodiment of the application does not limit this.

[0054] If it is detected that the gateway address of a certain client is not connected to the network address of the logged-in cloud desktop, the client is removed from the intranet gateway group.

[0055] In the above embodiment, the connectivity between the gateway address of each client in the intranet gateway group and the logged-in cloud desktop network address is periodically detected; if the connectivity is not achieved, the corresponding client is removed from the intranet gateway group. This ensures that the intranet access request can successfully reach the intranet network address, thus improving the stability of intranet penetration.

[0056] In an exemplary embodiment, Figure 3 As shown, an intranet access method is provided, and the method is applied to the client in FIG. 1 as an example for description, including the following steps 302 to 304. Among them:

[0057] Step 302: Receive an intranet access request. The source address carried in the intranet access request is the cloud desktop network address where the client logs in, and the destination address is the intranet network address. After the cloud-side gateway receives the intranet access request, it queries the database to see whether the terminal device corresponding to the client supports the address forwarding function and the source address translation function, and sends it to the client if it supports it.

[0058] Among them, the cloud desktop resource pool network sends an intranet access request to the cloud-side gateway. The cloud-side gateway parses the intranet access request to obtain the source address and destination address. The source address is the cloud desktop network address where the client logs in, and the destination address is the intranet network address. The cloud-side gateway queries the database to see whether the terminal device corresponding to the client supports the address forwarding function and the source address conversion function, and sends the intranet access request to the client if it supports it.

[0059] The client supports multiple systems, mainly establishing VPN tunnels with the cloud gateway and forwarding traffic to access intranet services. If the terminal device corresponding to the client is a Linux system, it only needs to support the iptables function to achieve intranet penetration. If it is a Windows system, it needs to cooperate with windivert to achieve the intranet penetration function.

[0060] Step 304: Send the intranet access request to the intranet network address.

[0061] Among them, the client and the intranet service belong to the same intranet. After the client receives the intranet access request, it sends the intranet access request to the intranet network address. After the intranet service device corresponding to the intranet network address receives the intranet access request, it processes the intranet access request.

[0062] In the above embodiment, the client receives an intranet access request, the source address carried in the intranet access request is the cloud desktop network address logged in by the client, and the destination address is the intranet network address; the intranet access request is sent to the client by the cloud gateway after receiving the intranet access request and querying from the database whether the terminal device corresponding to the client supports the address forwarding function and the source address conversion function, and if supported, the intranet access request is sent to the client; the intranet access request is sent to the intranet network address. This enables the cloud desktop to access the intranet service through the client, without the need for dedicated dedicated lines and virtual private network equipment, and can also meet the intranet penetration requirements.

[0063] In some embodiments, sending an intranet access request to an intranet network address includes: determining the system type to which the system installed on the terminal device belongs; when the system type is a first preset type, using the packet filtering firewall iptables to send the intranet access request to the intranet network address; when the system type is a second preset type, using the data packet capture tool windivert to send the intranet access request to the intranet network address.

[0064] The first preset type may be Linux, and the second preset type may be Windows.

[0065] Specifically, when the system type of the terminal device is Linux, the packet filtering firewall iptables is used to send the intranet access request to the intranet network address. That is, the iptables is directly used to implement the SNAT function, and the intranet access request is sent out from the intranet network card of the terminal device through NAT, so that the intranet service can be accessed.

[0066] When the system type of the terminal device is Windows, the packet capture tool windivert is used to send the intranet access request to the intranet network address. That is, snat is implemented in combination with windivert; windivert is an open source tool for capturing and modifying packets in Windows user mode, supporting win7 and above. For packets that remotely access the local intranet, the source network address translation (masquade) function of snat needs to translate the source address of the corresponding forwarded packets and convert them into the IP address of the outgoing interface. For the return packets (the destination address is the local machine), the destination address needs to be converted into the original address according to the corresponding connection information, so that the return packets can enter the tunnel according to the route and go back. Therefore, the following functions are mainly implemented for the Windows version: capture the forwarded IPv4 data packets (TCP, UDP, ICMP) and perform source address conversion; record the connection's five-tuple and the forwarded address (ICMP records one more ICMP ID) to mark the connection and maintain the global connection tracking list; capture the network return packet, match the current connection tracking table according to the five-tuple, and restore the destination address if a match is found; the connection tracking table needs to have a timed cleanup function, with TCP and UDP records cleaned up every 300 seconds and ICMP records cleaned up every 30 seconds, and there must also be a maximum number limit.

[0067] See also Figure 4As shown, an intranet access method is provided. First, the cloud desktop accesses the content service (i.e., the cloud side gateway receives the intranet access request), then the cloud side gateway matches the policy routing (i.e., the cloud side gateway determines the next hop address through the aforementioned embodiment), then, the intranet access request is sent to the available intranet gateway (i.e., the next hop address) through the wireguard vpn tunnel, then, the available intranet gateway can determine the gateway type (i.e., the client corresponding to the next hop address determines the system type to which the corresponding terminal device is installed), in the case of Linux, SNAT is implemented in conjunction with iptables; in the case of Windows, SNAT is implemented in conjunction with windivert. Finally, the content service is implemented (i.e., the intranet access request is sent to the intranet network address).

[0068] In the above embodiment, the client can determine the system type of the system installed on the terminal device; when the system type is the first preset type, the packet filtering firewall iptables is used to send the intranet access request to the intranet network address; when the system type is the second preset type, the data packet capture tool windivert is used to send the intranet access request to the intranet network address. This allows the cloud desktop to access the intranet service through the client, without the need for dedicated dedicated lines and virtual private network devices, and can also meet the intranet penetration requirements.

[0069] In some embodiments, the intranet access method provided by the embodiments of the present application also includes: responding to a registration trigger operation, detecting whether the corresponding terminal device supports address forwarding function and source address conversion function, generating function indication information based on the detection result, generating a registration request based on the function indication information, and sending the registration request to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the registration request. If the verification passes, a gateway address is assigned to the client, and the gateway address is returned to the client through the controller; responding to a cloud desktop login operation, generating a login request based on the gateway address, sending the login request to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the login request. If the verification passes, a cloud desktop network address is assigned to the client, and the cloud desktop network address is returned to the client through the controller; accessing the cloud desktop based on the cloud desktop network address.

[0070] Among them, the user can perform a registration trigger operation on the client, and the client responds to the registration trigger operation to detect whether the corresponding terminal device supports the address forwarding function and the source address conversion function. The terminal device corresponding to the client can be understood as the terminal device where the client is located, or the terminal device on which the client is installed.

[0071] The client includes a gateway virtual private network (Wireguard VPN) component and an agent program. The domain name address of the controller is built into the agnet program. In response to the registration trigger operation, the client can detect whether the corresponding terminal device supports the address forwarding function and the source address translation function through the Wireguard VPN component. The client can generate function indication information based on the detection result. For example, if the terminal device supports the address forwarding function and the source address translation function, the function indication information can be determined to be a first preset value. If the terminal device does not support the address forwarding function and the source address translation function, the function indication information can be determined to be a second preset value.

[0072] Among them, the client can generate a registration request based on the client identification and function indication information, and send the registration request to the cloud-side gateway through the controller. After receiving the registration request, the cloud-side gateway parses the registration request, obtains the client identification and function indication information, and performs an authority check on the client identification. If the check passes, it is considered that the registration request has passed the check, and a gateway address is assigned to the client, and the gateway address is returned to the client through the controller.

[0073] Among them, after the client receives the gateway address, a registration success prompt can be displayed. After seeing the registration success prompt, the user can perform a cloud desktop login operation on the client. The client responds to the cloud desktop login operation, generates a login request based on the client identifier and gateway address, and sends the login request to the cloud-side gateway through the controller. The cloud-side gateway parses the login request, obtains the client identifier and gateway address, and verifies the client identifier and gateway address. If the verification passes, it is considered that the login request has been verified, and a cloud desktop network address is assigned to the client, and the cloud desktop network address is returned to the client through the controller. After the client receives the cloud desktop network address, it accesses the cloud desktop based on the cloud desktop network address.

[0074] In the above embodiment, the client responds to the registration trigger operation, detects whether the corresponding terminal device supports the address forwarding function and the source address conversion function, generates function indication information based on the detection result, generates a registration request based on the function indication information, sends the registration request to the cloud gateway through the controller to instruct the cloud gateway to verify the registration request, and when the verification passes, allocates a gateway address to the client, and returns the gateway address to the client through the controller; responds to the cloud desktop login operation, generates a login request based on the gateway address, sends the login request to the cloud gateway through the controller to instruct the cloud gateway to verify the login request, and when the verification passes, allocates a cloud desktop network address to the client, and returns the cloud desktop network address to the client through the controller; accesses the cloud desktop based on the cloud desktop network address. Intranet access to the cloud desktop is realized.

[0075] In an exemplary embodiment, Figure 5 As shown, an intranet access method is provided, and the method is applied to the controller in FIG. 1 as an example for description, including the following steps 501 to 506. Among them:

[0076] Step 501: Receive a registration request sent by a client. The registration request is generated by the client based on function indication information. The function indication information is generated by the client in response to a registration trigger operation to detect whether a terminal device corresponding to the client supports an address forwarding function and a source address translation function based on a detection result.

[0077] Among them, the user can perform a registration trigger operation on the client, and the client responds to the registration trigger operation to detect whether the corresponding terminal device supports the address forwarding function and the source address conversion function. The client generates function indication information based on the detection result, generates a registration request based on the client identifier and the function indication information, and sends the registration request to the controller.

[0078] Step 502: Send the registration request to the cloud-side gateway to instruct the cloud-side gateway to verify the registration request, and if the verification passes, allocate a gateway address to the client.

[0079] Step 503: Receive the gateway address sent by the cloud-side gateway, and return the gateway address to the client.

[0080] After receiving the registration request, the controller sends the registration request to the cloud-side gateway, which verifies the registration request and, if the verification passes, allocates a gateway address to the client and sends the gateway address to the controller.

[0081] Step 504: Receive a login request sent by the client, where the login request is generated by the client in response to a cloud desktop login operation and is based on the gateway address.

[0082] Step 505: Send the login request to the cloud-side gateway to instruct the cloud-side gateway to verify the login request. If the verification passes, allocate a cloud desktop network address to the client.

[0083] Step 506: Receive the cloud desktop network address sent by the cloud-side gateway, return the cloud desktop network address to the client, and store the corresponding relationship between the client, function indication information, gateway address, and cloud desktop network address in the database.

[0084] After receiving the gateway address, the client can display a successful registration prompt. After seeing the successful registration prompt, the user can perform a cloud desktop login operation on the client. In response to the cloud desktop login operation, the client generates a login request based on the client identifier and the gateway address, and sends the login request to the controller. The controller sends the login request to the cloud-side gateway. The cloud-side gateway verifies the login request. If the verification passes, the cloud desktop network address is assigned to the client, and the cloud desktop network address is sent to the controller. The controller returns the cloud desktop network address to the client, and stores the corresponding relationship between the client, function indication information, gateway address, and cloud desktop network address in the database.

[0085] Among them, the controller can use a representational state transfer (representational state transfer, referred to as restful) interface communication.

[0086] Among them, the controller can write the target client, the function indication information corresponding to the target client, the gateway address corresponding to the target client, and the cloud desktop network address logged in by the target client into the intranet gateway group, and the intranet gateway group is stored in the database. The clients mentioned in the embodiments of the present application belong to the same intranet. The target client is a client whose corresponding terminal device supports the address forwarding function and the source address conversion function.

[0087] See also Figure 6 As shown, the user can perform a registration trigger operation on the client. After receiving the registration request, the controller obtains the correspondence between the client, function indication information, gateway address, and cloud desktop network address in the above manner and writes it into the database. Furthermore, the controller can make a penetration capability judgment based on the function indication information. When the corresponding terminal device has penetration capability, that is, supports address forwarding function and source address conversion function, the client can be used as the target client, and the target client, the function indication information corresponding to the target client, the gateway address corresponding to the target client, and the cloud desktop network address logged in by the target client are placed in the intranet gateway group. The cloud-side gateway configures the policy routing next hop to point to the gateway address of the client; when there is no penetration capability, the cloud-side gateway configures the policy routing next hop to randomly point to the gateway address of a client in the intranet gateway group.

[0088] In the above embodiment, the controller receives a registration request sent by the client, sends the registration request to the cloud-side gateway to instruct the cloud-side gateway to verify the registration request, and assigns a gateway address to the client if the verification passes; receives the gateway address sent by the cloud-side gateway, and returns the gateway address to the client; receives a login request sent by the client, which is generated by the client in response to the cloud desktop login operation based on the gateway address; sends the login request to the cloud-side gateway to instruct the cloud-side gateway to verify the login request, and assigns a cloud desktop network address to the client if the verification passes; receives the cloud desktop network address sent by the cloud-side gateway, returns the cloud desktop network address to the client, and stores the correspondence between the client, function indication information, gateway address, and cloud desktop network address in the database. Provides a data basis for subsequent intranet penetration.

[0089] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0090] Based on the same inventive concept, the embodiment of the present application also provides a cloud-side gateway for implementing the intranet access method involved above. The implementation solution provided by the cloud-side gateway to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more cloud-side gateway embodiments provided below can refer to the limitations on the cloud-side gateway above, and will not be repeated here.

[0091] In an exemplary embodiment, Figure 7 As shown, a cloud-side gateway or an intranet access device is provided, including:

[0092] The receiving module is used to receive an intranet access request, the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address;

[0093] The query module is used to receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address and the destination address is the intranet network address;

[0094] The processing module is used to, if supported, use the gateway address corresponding to the client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; if not supported, select the target client from the intranet gateway group belonging to the same intranet as the client, use the gateway address corresponding to the target client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address conversion function.

[0095] In some embodiments, the processing module is also used to periodically detect the connectivity between the gateway address of each client in the intranet gateway group and the logged-in cloud desktop network address; if there is no connectivity, the corresponding client is removed from the intranet gateway group.

[0096] Based on the same inventive concept, the embodiment of the present application also provides a client for implementing the intranet access method involved above. The implementation solution provided by the client to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more client embodiments provided below can refer to the limitations on the client above, and will not be repeated here.

[0097] In an exemplary embodiment, Figure 8 As shown, a client is provided, including:

[0098] The receiving module is used to receive an intranet access request. The source address carried in the intranet access request is the cloud desktop network address logged in by the client, and the destination address is the intranet network address. After the cloud-side gateway receives the intranet access request, it queries the database to see whether the terminal device corresponding to the client supports the address forwarding function and the source address translation function, and sends it to the client if it supports it.

[0099] The sending module is used to send the intranet access request to the intranet network address.

[0100] In some embodiments, the sending module is used to determine the system type to which the system installed on the terminal device belongs; when the system type is a first preset type, the intranet access request is sent to the intranet network address using the packet filtering firewall iptables; when the system type is a second preset type, the intranet access request is sent to the intranet network address using the data packet capture tool windivert.

[0101] In some embodiments, the client also includes a processing module for responding to a registration trigger operation, detecting whether the corresponding terminal device supports address forwarding function and source address conversion function, generating function indication information based on the detection result, generating a registration request based on the function indication information, and sending the registration request to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the registration request. If the verification passes, a gateway address is assigned to the client, and the gateway address is returned to the client through the controller; in response to a cloud desktop login operation, a login request is generated based on the gateway address, and the login request is sent to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the login request. If the verification passes, a cloud desktop network address is assigned to the client, and the cloud desktop network address is returned to the client through the controller; and the cloud desktop is accessed based on the cloud desktop network address.

[0102] Based on the same inventive concept, the embodiment of the present application also provides a controller for implementing the intranet access method involved above. The implementation scheme for solving the problem provided by the controller is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more controller embodiments provided below can refer to the limitations on the controller above, and will not be repeated here.

[0103] In an exemplary embodiment, Fig. 9 As shown, a controller is provided, comprising:

[0104] A receiving module, used to receive a registration request sent by a client, the registration request is generated by the client based on the function indication information, the function indication information is generated by the client in response to a registration trigger operation, detecting whether a terminal device corresponding to the client supports an address forwarding function and a source address translation function, and based on the detection result;

[0105] The sending module is used to send the registration request to the cloud-side gateway to instruct the cloud-side gateway to verify the registration request, and if the verification passes, allocate a gateway address to the client;

[0106] The receiving module is further used to receive the gateway address sent by the cloud-side gateway and return the gateway address to the client; receive a login request sent by the client, the login request is generated by the client in response to the cloud desktop login operation based on the gateway address;

[0107] The sending module is also used to send the login request to the cloud-side gateway to instruct the cloud-side gateway to verify the login request, and if the verification passes, allocate a cloud desktop network address to the client;

[0108] The receiving module is also used to receive the cloud desktop network address sent by the cloud side gateway, return the cloud desktop network address to the client, and store the corresponding relationship between the client, function indication information, gateway address, and cloud desktop network address in the database.

[0109] Each module in the above-mentioned cloud-side gateway, client, and controller can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0110] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of the cloud-side gateway, the client or the controller side in the above-mentioned embodiments are implemented.

[0111] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the cloud-side gateway, client or controller side in the above embodiments are implemented.

[0112] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of the cloud-side gateway, client or controller side in the above-mentioned embodiments.

[0113] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0114] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0115] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An intranet access method, characterized in that: Applied to a cloud-side gateway, the method includes: Receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address and the destination address is the intranet network address; Query the database for the terminal device corresponding to the client that logs in to the cloud desktop network address to determine whether it supports the address forwarding function and the source address translation function; If supported, the gateway address corresponding to the client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; If not supported, select the target client from the intranet gateway group that belongs to the same intranet as the client, use the gateway address corresponding to the target client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; the terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address conversion function.

2. The method according to claim 1, characterized in that The method further comprises: Periodically detect the connectivity between the gateway address of each client in the intranet gateway group and the logged-in cloud desktop network address; if there is no connectivity, remove the corresponding client from the intranet gateway group.

3. An intranet access method, characterized in that: Applied to a client, the method comprises: Receive an intranet access request, where the source address carried in the intranet access request is the cloud desktop network address logged in by the client, and the destination address is the intranet network address; after receiving the intranet access request, the cloud-side gateway queries from a database whether the terminal device corresponding to the client supports the address forwarding function and the source address translation function, and sends the request to the client if the function is supported; The intranet access request is sent to the intranet network address.

4. The method according to claim 3, characterized in that The sending the intranet access request to the intranet network address includes: Determine the system type to which the system installed on the terminal device belongs; In the case where the system type is the first preset type, using the packet filtering firewall iptables to send the intranet access request to the intranet network address; When the system type is the second preset type, the intranet access request is sent to the intranet network address using a data packet capturing tool windivert.

5. The method according to claim 3, characterized in that: The method further comprises: In response to the registration trigger operation, detecting whether the corresponding terminal device supports the address forwarding function and the source address translation function, generating function indication information based on the detection result, generating a registration request based on the function indication information, sending the registration request to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the registration request, and if the verification passes, assigning a gateway address to the client, and returning the gateway address to the client through the controller; In response to a cloud desktop login operation, a login request is generated based on the gateway address, and the login request is sent to the cloud-side gateway through the controller to instruct the cloud-side gateway to verify the login request. If the verification passes, a cloud desktop network address is allocated to the client, and the cloud desktop network address is returned to the client through the controller; The cloud desktop is accessed based on the cloud desktop network address.

6. An intranet access method, characterized in that: Applied to a controller, the method comprises: Receiving a registration request sent by a client, where the registration request is generated by the client based on function indication information, where the function indication information is generated based on a detection result of the client detecting whether a terminal device corresponding to the client supports an address forwarding function and a source address translation function in response to a registration trigger operation; Sending the registration request to the cloud-side gateway to instruct the cloud-side gateway to verify the registration request, and if the verification passes, assigning a gateway address to the client; Receive the gateway address sent by the cloud-side gateway, and return the gateway address to the client; receiving a login request sent by the client, where the login request is generated by the client in response to a cloud desktop login operation and is based on the gateway address; Sending the login request to the cloud-side gateway to instruct the cloud-side gateway to verify the login request, and if the verification passes, assigning a cloud desktop network address to the client; Receive the cloud desktop network address sent by the cloud-side gateway, return the cloud desktop network address to the client, and store the corresponding relationship between the client, the function indication information, the gateway address, and the cloud desktop network address in a database.

7. An intranet access device, characterized in that: include: A receiving module, used to receive an intranet access request, wherein the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address; A query module, used to receive an intranet access request, wherein the source address carried in the intranet access request is the cloud desktop network address, and the destination address is the intranet network address; A processing module, configured to, if supported, use the gateway address corresponding to the client as the next hop address of the cloud desktop network address, and send the intranet access request to the intranet network address through the next hop address; If not supported, a target client is selected from an intranet gateway group belonging to the same intranet as the client, a gateway address corresponding to the target client is used as the next hop address of the cloud desktop network address, and the intranet access request is sent to the intranet network address through the next hop address; The terminal devices corresponding to each client in the intranet gateway group all support address forwarding function and source address translation function.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images