Security access method, device and system, equipment and storage medium

Abstract

The invention discloses a secure access method, device, system and equipment and a storage medium, and the method comprises the steps: a client located in a public network sends a connection request to a signaling server, and builds a first signaling transmission connection with the signaling server; the signaling server is located in a public network and establishes a second signaling transmission connection with a server located in a private network; and exchanging signaling information with the server through the signaling server, and establishing a WebRTC connection with the server. According to the invention, the secure connection can be established between the public network client and the private network server, the configuration complexity is reduced, the security is improved, and the data transmission between the public network and the private network is safer and more convenient.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a secure access method, apparatus, system, device and storage medium. Background Art

[0002] In modern network applications, security and privacy are crucial considerations. In many cases, public network clients need to establish a secure connection with private network servers to exchange data. However, public network clients and private network servers cannot use the HTTP protocol (Hyper Text Transfer Protocol) to establish a secure connection, and the HTTP protocol cannot guarantee the privacy and integrity of data. If the HTTPS protocol (Hyper Text Transfer Protocol over Secure Socket Layer) is used to establish a secure connection, the private network server needs a public domain name and a certificate issued by a recognized certificate authority (CA); if a private root certificate is used to issue an HTTPS certificate, the configuration process is cumbersome, cannot be adapted to all platforms, and there is a risk of the root certificate being stolen. Summary of the invention

[0003] The embodiments of the present application provide a secure access method, apparatus, device and storage medium, which can establish a secure connection between a public network client and a private network server, reduce configuration complexity, improve security, and make data transmission between the public network and the private network more secure and convenient. The above technical solution is as follows:

[0004] In a first aspect, an embodiment of the present application provides a secure access method, which is applied to a client, where the client is located on a public network, and the method includes:

[0005] Send a connection request to the signaling server, and establish a first signaling transmission connection with the signaling server; the signaling server is located in the public network, and a second signaling transmission connection is established with a server located in the private network;

[0006] The signaling server exchanges signaling information with the server and establishes a WebRTC connection with the server.

[0007] In a second aspect, an embodiment of the present application provides a secure access method, which is applied to a server, where the server is located in a private network, and the method includes:

[0008] Sending a connection request to a signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in a public network and has a first signaling transmission connection established with a client located in the public network;

[0009] The signaling server exchanges signaling information with the client and establishes a WebRTC connection with the client.

[0010] In a third aspect, an embodiment of the present application provides a secure access device, which is configured on a client, and the client is located on a public network. The device includes:

[0011] A first request module is used to send a connection request to a signaling server and establish a first signaling transmission connection with the signaling server; the signaling server is located in a public network and has a second signaling transmission connection established with a server located in a private network;

[0012] The first building module is used to exchange signaling information with the above-mentioned server through the above-mentioned signaling server and establish a WebRTC connection with the above-mentioned server.

[0013] In a fourth aspect, an embodiment of the present application provides a secure access device, which is configured on a server, and the server is located in a private network. The device includes:

[0014] A second request module is used to send a connection request to the signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in the public network and has established a first signaling transmission connection with the client located in the public network;

[0015] The second building module is used to exchange signaling information with the client through the signaling server and establish a WebRTC connection with the client.

[0016] In a fifth aspect, an embodiment of the present application provides a secure access system, including a client, a server, and a signaling server;

[0017] The client and the signaling server are located in a public network, and the server is located in a private network;

[0018] The client is used to execute the above method steps;

[0019] The server is used to execute the above method steps;

[0020] The signaling server is used to exchange signaling information between the client and the server.

[0021] In a sixth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above method steps.

[0022] In a seventh aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps.

[0023] In one or more embodiments of the present application, a client located on the public network sends a connection request to a signaling server located on the public network, and establishes a first signaling transmission connection with the signaling server; a server located on the private network sends a connection request to the signaling server, and establishes a second signaling transmission connection with the signaling server; the client exchanges signaling information with the server through the signaling server, and establishes a WebRTC connection with the server. Thus, the public network client can directly establish a secure connection with the private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A system architecture diagram of a secure access system provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the WebRTC protocol stack provided in an embodiment of the present application;

[0027] Figure 3 A flowchart of a secure access method provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of an interactive flow of a signaling process provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the interaction process between the client and the server provided in the embodiment of the present application;

[0030] Figure 6 A schematic diagram of an interactive process of a secure access method provided in an embodiment of the present application;

[0031] Figure 7 A schematic diagram of the structure of a secure access device provided in an embodiment of the present application;

[0032] Figure 8 A schematic diagram of the structure of a secure access device provided in an embodiment of the present application;

[0033] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0035] In the description of the present application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0036] In order to ensure the security of data of organizations such as schools and companies, organizations gradually adopt private deployment services, that is, deploy services in private LANs. The public network can access the private deployment services in the form of IP address + port + API address, but cannot access them directly. If private deployment services need to use a secure access method, the HTTPS protocol is often used. However, since applying for the HTTPS protocol requires applying for a domain name SSL certificate from a CA (certificate authority), private deployment services often do not have a public IP or an independent domain name, and therefore cannot apply for a domain name SSL certificate.

[0037] In related technologies, a private root certificate can be used to issue an HTTPS certificate. The client (browser) on the public network can access services deployed on the private network by adding the root certificate to the system certificate library. However, the root certificate has security issues. Once the root certificate is stolen, the security of the privately deployed service will be destroyed. In addition, the import of the certificate requires the user to import it independently, which is complicated, and different operating systems require different configuration methods, making it very difficult to import the certificate.

[0038] Based on this, the embodiment of the present application provides a secure access method, which can be implemented by a computer program and can be run on a secure access device or system based on the von Neumann architecture. The computer program can be integrated into an application or run as an independent tool application.

[0039] like Figure 1 As shown, a system architecture diagram of a secure access system provided by an embodiment of the present application.

[0040] For example, Figure 1 As shown, the system architecture includes a client 110 , a server 120 and a signaling server 130 .

[0041] The client 110 is deployed on the public Internet and can be a user's terminal device, such as a smart phone, a tablet computer, or a personal computer. An application program, such as a browser, that can communicate with the server 120 is installed on the client 110. The client 110 establishes a first signaling transmission connection, such as a WebSocket connection, with the signaling server 130; the signaling information can be exchanged with the server 120 through the signaling server 130, thereby establishing a WebRTC connection with the server 120 for secure real-time communication.

[0042] The server 120 is deployed on a private network and has the ability to provide services, such as Web services, database services, etc. The server 120 can receive requests from the client 110 and respond to these requests. The server 120 establishes a second signaling transmission connection with the signaling server 130, such as a WebSocket connection; the signaling server 130 can exchange signaling information with the client 110, thereby establishing a WebRTC connection with the client 110 for secure real-time communication.

[0043] The signaling server 130 is deployed on the public network and serves as a signaling transmission bridge between the client 110 and the server 120. The signaling server 130 receives signaling information from the client 110 and forwards the information to the server 120, and receives signaling information from the server 120 and forwards the information to the client 110. In this way, the signaling server 130 assists the client 110 and the server 120 to complete the signaling interaction, thereby establishing a WebRTC connection between the client 110 and the server 120.

[0044] In some embodiments, the server 120 is deployed in a private network, and the client 110 deployed in the public network cannot directly access it, nor can it establish a secure connection through the HTTP / HTTPS protocol for access. However, through the WebRTC protocol, a WebRTC connection can be established between the client 110 and the server 120. In the WebRTC connection, the server 120 is used as a peer, and a secure connection between the client 110 and the server 120 can be achieved without using the HTTPS protocol.

[0045] like Figure 2 As shown, Figure 2Schematic diagram of the protocol stack of WebRTC. WebRTC is a secure real-time communication protocol. It uses the Datagram Transport Layer Security Protocol (DTLS) for encryption in the data channel (Data Channel), and uses the Secure Real-time Transport Protocol (SRTP) for encryption in the audio channel (Audio Channel) and the video channel (Video Channel). It can ensure the security of data during transmission and prevent data from being intercepted or tampered with. WebRTC supports NAT (Network Address Translation) traversal and firewall traversal, which enables devices in different network environments (such as public and private networks) to establish direct connections, thereby achieving end-to-end communication, so that servers can be deployed in private networks and can be accessed by users through the public network. Therefore, by establishing a connection between the client 110 and the server 120 through the WebRTC protocol, secure and compatible real-time communication between the public and private networks can be achieved.

[0046] In some embodiments, the original HTTP / HTTPS private service is converted into an end of WebRTC. In the WebRTC connection, the private service does not exist as a service, but exists as a peer of the client 110. Since the private service is deployed on the server 120 of the private network, it is necessary to use server technology to build a WebRTC end environment for the server 120, such as node-webrtc and other technologies. In addition, WebRTC has good compatibility in modern browsers, and most modern browsers natively support the WebRTC protocol, which eliminates the trouble of users downloading and installing specific software or plug-ins. The client 110 does not need to install any additional software or plug-ins, which reduces the technical threshold and improves the user experience.

[0047] Next, combine Figure 1 The system architecture shown introduces the secure access method provided by the embodiment of the present application. Figure 3 It is a flowchart of a secure access method provided in an embodiment of the present application.

[0048] For example, Figure 3 As shown, the method includes:

[0049] S201, the client sends a connection request to the signaling server to establish a first signaling transmission connection with the signaling server.

[0050] Specifically, the client is deployed on the public network and cannot directly access the server located in the private network. The signaling server is deployed on the public network, and the client can directly access the signaling server, and the server located in the private network can also directly access the above signaling server. Therefore, the client can send a connection request to the signaling server, and after the signaling server receives the request, it can establish a first signaling transmission connection with the signaling server. The first signaling transmission connection can be a bidirectional long connection so that signaling transmission exchanges can be performed later.

[0051] Since the signaling server cannot directly access the server located on the private network, but the server can access the signaling server located on the public network, the server can establish a second signaling transmission connection with the signaling server in advance, so that after the signaling server establishes a first signaling transmission connection with the client, the client can directly send a request to create a WebRTC connection to the server through the first signaling transmission connection, the signaling server and the second signaling transmission connection to establish a WebRTC connection.

[0052] In some embodiments, the first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

[0053] The WebSocket protocol provides a full-duplex, two-way communication mechanism between the client / server and the signaling server. Using WebSocket, the client / server can actively push data to the signaling server, and the signaling server can also actively send data to the client / server to achieve instant communication. Using WebSocket as a signaling transmission connection can ensure the real-time and continuity of signaling information, and improve the performance and response speed of the system. In addition, the WebSocket protocol is based on TCP (Transmission Control Protocol), which ensures the reliability of data transmission. At the same time, its small data packet and fast transmission speed are suitable for signaling information transmission that requires frequent and real-time interaction.

[0054] Therefore, using WebSocket connection as a signaling transmission connection can improve the communication efficiency of the system, improve the system's operating performance, and ensure real-time and reliable transmission of signaling information.

[0055] S202, the client exchanges signaling information with the server through the signaling server and establishes a WebRTC connection with the server.

[0056] Specifically, since the server is located in a private network, it is a restricted network environment, and the client and the server cannot directly exchange signaling information. At this time, the signaling server plays the role of a bridge, which can assist the client and the server to exchange necessary signaling information to establish a WebRTC connection.

[0057] In WebRTC, signaling information is necessary to establish a connection. These connections can include parameters and connection information of the network session (such as IP address) and any other options to be sent on the peer connection. The process of exchanging signaling information can be called the signaling process, which is a key step in establishing a WebRTC connection. Once these signaling messages are exchanged through the signaling server, the client and the server can establish a WebRTC connection for direct point-to-point communication. This communication can include audio, video, and data, and is all encrypted to ensure the security of the communication.

[0058] In some embodiments, the above-mentioned signaling information includes session description protocol information and interactive connection establishment candidate information.

[0059] Session Description Protocol (SDP) information can describe the parameters of the network session during the WebRTC connection establishment process, such as protocol version, session name and purpose, start time, connection information (such as IP address), etc. In the WebRTC signaling process, one party creates and sends an SDP description containing this information, and the other party receives and responds to the description.

[0060] Interactive Connectivity Establishment (ICE) candidate information During the WebRTC connection establishment process, a communication path between two points can be found in an environment that may involve network barriers such as NAT, firewalls, etc. This involves collecting various possible IP addresses and ports (i.e. ICE Candidates) and exchanging these candidate information through a signaling server, and then trying these candidates through a process called ICE to find a valid communication path.

[0061] The above two types of signaling information are the basis for establishing a WebRTC connection. The client and the server can establish a WebRTC connection through the exchange of the above two types of information to achieve a secure connection between end-to-end.

[0062] In some embodiments, exchanging signaling information with the server through the signaling server to establish a WebRTC connection with the server includes:

[0063] The client sends first session description protocol information to the server;

[0064] The server receives the first session description protocol information and sends the second session description protocol information to the client;

[0065] The client receives the second session description protocol information, and sends first interactive connection establishment candidate information to the server based on the first session description protocol information and the second session description protocol information;

[0066] The server receives the first interactive connection establishment candidate information, and sends the second interactive connection establishment candidate information to the client;

[0067] The client and the server establish a WebRTC connection based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information.

[0068] Specifically, Figure 4 As shown, the signaling process includes SDP exchange and ICE Candidates exchange process.

[0069] SDP exchange occurs at the beginning of communication. The initiator (client) will create the first session description protocol information (i.e. SDP Offer in the figure). This SDP Offer contains the parameters describing the network session of the initiator and any other options to be sent on the peer connection. The client sets this created SDP Offer as a local description and sends it to the server (the initiated party).

[0070] After receiving the above SDP Offer, the server sets it as the remote description and generates a second session description protocol message (SDP Answer), which contains parameters describing the network session of the initiated party and any other options to be sent on the peer connection. The server sets the SDP Answer as the local description and sends it to the client.

[0071] After receiving the above SDP Answer, the client sets it as the remote description. In this way, the client and the server complete the SDP negotiation. Both ends know the network capabilities of the other party and how to send and receive data.

[0072] The client starts to exchange ICE Candidates according to the local description and remote description set above, collects the client's ICE Candidates, which include the IP address and port information that the client may establish a connection with, generates first interactive connection establishment candidate information (i.e., generates local candidate information); and sends the first interactive connection establishment candidate information to the server.

[0073] After receiving the above-mentioned first interactive connection establishment candidate information, the server adds the client's ICE Candidates to its own candidate list (i.e., adds candidate information), and then collects the server's ICE Candidates, which include the IP address and port information that the server may establish a connection with; generates second interactive connection establishment candidate information (i.e., generates local candidate information); and sends the second interactive connection establishment candidate information to the client.

[0074] After receiving the second interactive connection establishment candidate information, the client adds the server's ICE Candidates to its own candidate list (i.e., adds candidate information). Then, the client and server begin to search for matching candidate pairs in their own candidate lists. This process is called ICE candidate pairing.

[0075] After finding a matching candidate pair, the client and server can try to establish a connection through this candidate pair, a process called ICE Connectivity Checking. If the connection detection is successful, then this candidate pair will be selected as the final path for data transmission, which is the so-called "selected candidate pair". This process may be repeated many times until a candidate pair is found that can successfully establish a connection.

[0076] The client and server establish a WebRTC connection based on the selected candidate pair found. This connection is secure because it uses the DTLS protocol and all data is transmitted encrypted. In addition, the WebRTC connection is end-to-end, and data is sent directly from the client to the server without passing through any intermediate server, which greatly improves the efficiency of data transmission.

[0077] It should be noted that, during the WebRTC connection establishment process, the initiator of the SDP exchange and the ICE Candidates exchange process can be either the client or the server, and the above embodiment is only exemplary and not restrictive. The signaling transmission between the above client and the server is transmitted through the first signaling transmission connection, the second signaling transmission connection and the signaling server established above.

[0078] In one or more embodiments of the present application, a client located on the public network sends a connection request to a signaling server located on the public network, and establishes a first signaling transmission connection with the signaling server; a server located on the private network sends a connection request to the signaling server, and establishes a second signaling transmission connection with the signaling server; the client exchanges signaling information with the server through the signaling server, and establishes a WebRTC connection with the server. Thus, the public network client can directly establish a secure connection with the private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience.

[0079] Please refer to the following Figure 5 ,like Figure 5 As shown, in the above S202, after the client exchanges signaling information with the server through the signaling server and establishes a WebRTC connection with the server, the method further includes:

[0080] S301, the client encapsulates the request data into a simulated HTTP request.

[0081] Specifically, the original request data of the client is converted into HTTP request format. The purpose of encapsulating into HTTP request format is to transmit in WebRTC connection, because WebRTC connection is essentially a channel for transmitting data, and HTTP request is a standard data format. By encapsulating and simulating HTTP request, the versatility and compatibility of data transmission can be improved.

[0082] The encapsulation process can convert the original request data into the HTTP request format according to the preset encapsulation protocol. This process may include filling the request method, path, protocol version, request header and other contents into the HTTP request template.

[0083] S302, the client simulates an HTTP request and sends it to the server.

[0084] Specifically, the HTTP request data encapsulated in the previous step is sent to the server. The data sending process is completed through the data channel (Data Channel) in the previously established WebRTC connection.

[0085] Data Channel is a channel that can be created in a WebRTC connection to transmit text message-like data. Data that simulates HTTP requests can be transmitted through Data Channel, replacing regular insecure HTTP requests.

[0086] S303, the server receives the simulated HTTP request and obtains the request data after decapsulation.

[0087] Specifically, after receiving the simulated HTTP request sent by the client, the server decapsulates it to obtain the original request data of the client.

[0088] The decapsulation process can parse the received simulated HTTP request into the HTTP request format according to the preset encapsulation protocol, including extracting the request method, path, protocol version, request header and other contents; then, the server converts the extracted request content into the original request data

[0089] S304, the server generates response data according to the request data and encapsulates it into a simulated HTTP response.

[0090] Specifically, the server generates response data after processing according to the received request data, and then encapsulates the response data into the format of HTTP response. The encapsulation process is similar to the encapsulation process of the HTTP request in S301.

[0091] S305, the server sends a simulated HTTP response to the client.

[0092] Specifically, the server sends the encapsulated simulated HTTP response data back to the client. Similarly, this process is completed through the data channel in the WebRTC connection.

[0093] S306, the client receives the simulated HTTP response and obtains the response data after decapsulation.

[0094] Specifically, after receiving the simulated HTTP response data sent by the server, the client decapsulates it to obtain the original response data of the server. The decapsulation process is similar to the decapsulation process of the HTTP request in S303.

[0095] In this embodiment, data is encapsulated in HTTP format to simulate HTTP requests and responses, so that the data exchange process of the WebRTC connection remains transparent to the other parts of the client and the server, so that the other parts of the client and the server do not need to care about the specific implementation method of the data exchange, and only need to operate according to the normal HTTP request / response mode; and the versatility and compatibility of using WebRTC connections are improved, so that the simulated HTTP request / response can use the existing network facilities for data transmission, and can be recognized and correctly processed by almost all network applications without adding complex software configurations and hardware equipment.

[0096] The following will describe the secure access method provided by the embodiment of the present application in conjunction with a specific embodiment. Figure 6 Schematic diagram of an interactive process of a secure access method provided by an embodiment of the present application. Figure 6As shown, the method includes:

[0097] S401, the file server builds a WebRTC environment and establishes a WebSocket connection with the signaling server.

[0098] Specifically, the file server will be deployed on the private network, and the business server will be deployed on the cloud. When the client deployed on the public network opens the business website on the cloud, it will request the data from the file server for display. Since the current browser will restrict insecure cloud services from requesting privately deployed services, the business server needs to establish a secure connection such as HTTPS with the file server to access each other.

[0099] In this embodiment, by building a WebRTC connection, an end-to-end direct connection between the client and the file server is achieved, so that the client can directly obtain the business data of the file server without going through the cloud business server. This not only improves the efficiency of data transmission, but also ensures the security of data transmission.

[0100] In order to successfully establish a WebRTC connection, the file server needs to pre-configure the WebRTC environment to meet the requirements of being a WebRTC endpoint. On this basis, the file server establishes a WebSocket connection with the signaling server by sending a connection request to the signaling server located on the public network. In this way, once the client connects to the signaling server, signaling information can be exchanged immediately, thereby establishing a WebRTC connection between the client and the file server.

[0101] The signaling server and the service server can be deployed on the same physical server.

[0102] S402, the client browser opens the business website and establishes a WebSocket connection with the signaling server.

[0103] Specifically, enter the URL in the browser on the client to open the business website. The browser will request the server of the business website to load the webpage content and trigger the instruction to establish a WebSocket connection with the signaling server. For example, the code of the business website contains a JavaScript code for establishing a WebSocket connection. When the browser loads and executes this code, it will try to establish a WebSocket connection with the signaling server.

[0104] S403, the client exchanges SDP and ICE Candidates data with the file server through the signaling server.

[0105] Specifically, after the client establishes a WebSocket connection with the signaling server, the client and the signaling server can communicate bidirectionally. The client exchanges SDP and ICE Candidates data with the file server in turn through the signaling server to establish a WebRTC connection between the client and the file server.

[0106] SDP data describes the parameters of network communication, such as encoding format, transmission protocol, etc., to ensure that both parties have consistent protocol parameters when communicating. ICE Candidates data contains network interface and port information that may be used to establish a connection, with the purpose of finding an available network path.

[0107] S404: The client establishes a WebRTC connection with the file server.

[0108] Specifically, through SDP exchange, the client and the file server negotiate to determine the parameters of network communication. Subsequently, through the collection and exchange of ICE candidate information, and after mutual attempts, an optimal and available network path is finally determined. In this way, a secure and efficient end-to-end WebRTC connection can be established between the client and the file server to achieve data exchange between the two parties. Technically, end-to-end data transmission is achieved. At the same time, due to the characteristics of WebRTC, the WebRTC connection also has good security, and the data will not be stolen or tampered with by a third party during the transmission process. Therefore, this method not only ensures the security of the data, but also improves the efficiency of data transmission.

[0109] S405: The client encapsulates a simulated HTTP request and sends it to the server via a WebRTC connection.

[0110] Specifically, the client will first encapsulate the request data into a simulated HTTP request. The format of the simulated HTTP request is similar to that of a real HTTP request, including the request method (such as GET or POST), request path, request header, and request body. The encapsulated simulated HTTP request will be sent to the file server through the Data Channel of the established WebRTC connection. At this time, although the request data is encapsulated in the form of an HTTP request, the actual data transmission is not carried out through the HTTP protocol, but through the WebRTC connection, which improves the efficiency and security of data transmission.

[0111] S406: The server responds to the simulated HTTP request by encapsulating a simulated HTTP response and returning it to the client via WebRTC.

[0112] Specifically, after receiving the simulated HTTP request from the client, the file server will decapsulate it and extract the client's request data. Then, based on the request data, the file server will generate corresponding response data, and then encapsulate the response data into a simulated HTTP response. The simulated HTTP response is similar to the real HTTP response, including information such as the response status code, response header, and response body. Then, the simulated HTTP response is sent back to the client through the DataChannel of the WebRTC connection.

[0113] S407, the client receives the simulated HTTP response and decrypts it to obtain the required business data.

[0114] Specifically, after receiving the simulated HTTP response from the file server, the client will decapsulate it to obtain the business data returned by the file server. In this way, the client can directly use the business data for subsequent processing without forwarding it through the cloud business server. This process not only improves the efficiency of data transmission, but also further ensures the security of data.

[0115] In this embodiment, a direct end-to-end connection can be established between the client and the file server by using the WebRTC protocol, without the need for data forwarding through an intermediate server, thereby reducing the complexity of communication and improving efficiency and security. In addition, the data communication between the client and the server is carried out by simulating HTTP requests and responses. The other parts of the client and the server do not need to care about the specific implementation method of data communication. They only need to operate in accordance with the normal HTTP request / response mode, which is compatible with a variety of operating systems on mobile and PC terminals. At the same time, the client does not need to install any additional plug-ins or software, and the user can directly use the business website in the browser to access the private network server, which greatly improves the user experience.

[0116] See also Figure 7 , Figure 7 A schematic diagram of the structure of a secure access device provided by an exemplary embodiment of the present application. The secure access device can be implemented as all or part of the device through software, hardware, or a combination of both. The secure access device 500 is configured on a client, which is located on a public network, and includes a first request module 510 and a first construction module 520.

[0117] The first request module 510 is used to send a connection request to the signaling server and establish a first signaling transmission connection with the signaling server; the signaling server is located in the public network and has a second signaling transmission connection established with a server located in the private network;

[0118] The first building module 520 is used to exchange signaling information with the above-mentioned server through the above-mentioned signaling server and establish a WebRTC connection with the above-mentioned server.

[0119] Optionally, the above-mentioned secure access device 500 further includes a first encapsulation module, which is used to:

[0120] Encapsulate the request data into a simulated HTTP request;

[0121] Sending the simulated HTTP request to the server via the data channel of the WebRTC connection;

[0122] Receiving a simulated HTTP response returned by the server; the simulated HTTP response is obtained by encapsulating the response data returned by the server in response to the simulated HTTP request;

[0123] Decapsulate the simulated HTTP response to obtain the response data.

[0124] Optionally, the above signaling information includes session description protocol information and interactive connection establishment candidate information.

[0125] Optionally, the first building module 520 is specifically used to:

[0126] Sending first session description protocol information to the server through the signaling server;

[0127] receiving second session description protocol information returned by the server in response to the first session description protocol information;

[0128] Based on the first session description protocol information and the second session description protocol information, sending first interactive connection establishment candidate information to the server through the signaling server;

[0129] receiving second interactive connection establishment candidate information returned by the server in response to the first interactive connection establishment candidate information;

[0130] Based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information, a WebRTC connection is established with the server.

[0131] Optionally, the first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

[0132] In one or more embodiments of the present application, a client located on the public network sends a connection request to a signaling server located on the public network, and establishes a first signaling transmission connection with the signaling server; the signaling server is located on the public network, and establishes a second signaling transmission connection with a server located on a private network; the client exchanges signaling information with the server through the signaling server, and establishes a WebRTC connection with the server. As a result, the public network client can directly establish a secure connection with the private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience.

[0133] See also Figure 8 , Figure 8 A schematic diagram of the structure of a secure access device provided for an exemplary embodiment of the present application. The secure access device can be implemented as all or part of the device through software, hardware, or a combination of both. The secure access device 600 is configured on a server, which is located in a private network, and includes a second request module 610 and a second construction module 620.

[0134] The second request module 610 is used to send a connection request to the signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in the public network and has established a first signaling transmission connection with the client located in the public network;

[0135] The second building module 620 is used to exchange signaling information with the client through the signaling server and establish a WebRTC connection with the client.

[0136] Optionally, the secure access device 600 further includes a second encapsulation module, configured to:

[0137] Receiving a simulated HTTP request sent by the client through the data channel of the WebRTC connection; the simulated HTTP request is obtained by encapsulating the request data of the client;

[0138] Decapsulate the above simulated HTTP request to obtain the above request data;

[0139] Generate response data based on the above request data and encapsulate it into a simulated HTTP response;

[0140] The simulated HTTP response is sent to the client.

[0141] Optionally, the above signaling information includes session description protocol information and interactive connection establishment candidate information.

[0142] Optionally, the second building module 620 is specifically used to:

[0143] Receiving first session description protocol information sent by the client;

[0144] Sending second session description protocol information to the client through the signaling server;

[0145] receiving first interactive connection establishment candidate information sent by the client based on the first session description protocol information and the second session description protocol information, and sending second interactive connection establishment candidate information to the client through the signaling server;

[0146] Based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information, a WebRTC connection is established with the client.

[0147] Optionally, the first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

[0148] In one or more embodiments of the present application, a server located in a private network sends a connection request to a signaling server located in a public network, and establishes a second signaling transmission connection with the signaling server; the signaling server is located in a public network, and establishes a first signaling transmission connection with a client located in a public network; the server exchanges signaling information with the client through the signaling server, and establishes a WebRTC connection with the client. Thus, a public network client can directly establish a secure connection with a private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience.

[0149] It should be noted that the security access device provided in the above embodiment only uses the division of the above functional modules as an example when executing the security access method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the security access device provided in the above embodiment and the security access method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0150] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0151] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1-Figure 6 The above-mentioned secure access method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 6The specific description of the illustrated embodiment will not be repeated here.

[0152] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-Figure 6 The above-mentioned secure access method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0153] See also Fig. 9 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig. 9 As shown, the electronic device 700 may include: at least one processor 710 , at least one network interface 720 , a user interface 730 , a memory 740 , and at least one communication bus 750 .

[0154] The communication bus 750 is used to realize the connection and communication between these components.

[0155] The user interface 730 may include a display screen (Display) and a camera (Camera), and the optional user interface 730 may also include a standard wired interface and a wireless interface.

[0156] The network interface 720 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0157] Among them, the processor 710 may include one or more processing cores. The processor 710 uses various interfaces and lines to connect various parts within the entire electronic device 700, and executes various functions and processes data of the electronic device 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 740, and calling data stored in the memory 740. Optionally, the processor 710 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 710 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 710, and it can be implemented separately through a chip.

[0158] Among them, the memory 740 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 740 includes a non-transitory computer-readable storage medium. The memory 740 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 740 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 740 may also be optionally at least one storage device located away from the aforementioned processor 710. As Fig. 9 As shown, the memory 740 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a security access program.

[0159] exist Fig. 9When the electronic device 700 is configured on a client located in a public network, the user interface 730 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 710 can be used to call the security access program stored in the memory 740 and specifically perform the following operations:

[0160] Send a connection request to the signaling server, and establish a first signaling transmission connection with the signaling server; the signaling server is located in the public network, and a second signaling transmission connection is established with a server located in the private network;

[0161] The signaling server exchanges signaling information with the server and establishes a WebRTC connection with the server.

[0162] Optionally, after executing the above-mentioned establishment of the WebRTC connection with the above-mentioned server, the processor 710 further performs the following operations:

[0163] Encapsulate the request data into a simulated HTTP request;

[0164] Sending the simulated HTTP request to the server via the data channel of the WebRTC connection;

[0165] Receiving a simulated HTTP response returned by the server; the simulated HTTP response is obtained by encapsulating the response data returned by the server in response to the simulated HTTP request;

[0166] Decapsulate the simulated HTTP response to obtain the response data.

[0167] Optionally, the above signaling information includes session description protocol information and interactive connection establishment candidate information.

[0168] Optionally, when executing the above-mentioned exchanging signaling information with the above-mentioned server through the above-mentioned signaling server and establishing a WebRTC connection with the above-mentioned server, the processor 710 specifically performs the following operations:

[0169] Sending first session description protocol information to the server through the signaling server;

[0170] receiving second session description protocol information returned by the server in response to the first session description protocol information;

[0171] Based on the first session description protocol information and the second session description protocol information, sending first interactive connection establishment candidate information to the server through the signaling server;

[0172] receiving second interactive connection establishment candidate information returned by the server in response to the first interactive connection establishment candidate information;

[0173] Based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information, a WebRTC connection is established with the server.

[0174] Optionally, the first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

[0175] In one or more embodiments of the present application, a client located on the public network sends a connection request to a signaling server located on the public network, and establishes a first signaling transmission connection with the signaling server; the signaling server is located on the public network, and establishes a second signaling transmission connection with a server located on a private network; the client exchanges signaling information with the server through the signaling server, and establishes a WebRTC connection with the server. As a result, the public network client can directly establish a secure connection with the private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience.

[0176] exist Fig. 9 When the electronic device 700 is configured on a server located in a private network, the user interface 730 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 710 can be used to call the security access program stored in the memory 740 and specifically perform the following operations:

[0177] Sending a connection request to a signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in a public network and has a first signaling transmission connection established with a client located in the public network;

[0178] The signaling server exchanges signaling information with the client and establishes a WebRTC connection with the client.

[0179] Optionally, after executing the above-mentioned establishment of the WebRTC connection with the above-mentioned client, the processor 710 further performs the following operations:

[0180] Receiving a simulated HTTP request sent by the client through the data channel of the WebRTC connection; the simulated HTTP request is obtained by encapsulating the request data of the client;

[0181] Decapsulate the above simulated HTTP request to obtain the above request data;

[0182] Generate response data based on the above request data and encapsulate it into a simulated HTTP response;

[0183] The simulated HTTP response is sent to the client.

[0184] Optionally, when executing the above-mentioned exchanging signaling information with the above-mentioned client through the above-mentioned signaling server and establishing a WebRTC connection with the above-mentioned client, the processor 710 specifically performs the following operations:

[0185] Receiving first session description protocol information sent by the client;

[0186] Sending second session description protocol information to the client through the signaling server;

[0187] receiving first interactive connection establishment candidate information sent by the client based on the first session description protocol information and the second session description protocol information, and sending second interactive connection establishment candidate information to the client through the signaling server;

[0188] Based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information, a WebRTC connection is established with the server.

[0189] Optionally, the first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

[0190] In one or more embodiments of the present application, a server located in a private network sends a connection request to a signaling server located in a public network, and establishes a second signaling transmission connection with the signaling server; the signaling server is located in a public network, and establishes a first signaling transmission connection with a client located in a public network; the server exchanges signaling information with the client through the signaling server, and establishes a WebRTC connection with the client. Thus, a public network client can directly establish a secure connection with a private network server for real-time data transmission, which improves the security of data transmission and reduces the complexity and cost of network configuration; in addition, the process of establishing a WebRTC connection does not require user intervention, making it more convenient for users to use and improving user experience.

[0191] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the above-mentioned program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The above-mentioned storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0192] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A secure access method, characterized in that: Applied to a client, the client is located in a public network, and the method includes: Sending a connection request to a signaling server to establish a first signaling transmission connection with the signaling server; the signaling server is located in a public network, and a second signaling transmission connection is established with a server located in a private network; The signaling server exchanges signaling information with the server and establishes a WebRTC connection with the server.

2. The method according to claim 1, characterized in that: After establishing the WebRTC connection with the server, the method includes: Encapsulate the request data into a simulated HTTP request; Sending the simulated HTTP request to the server via the data channel of the WebRTC connection; Receiving a simulated HTTP response returned by the server; the simulated HTTP response is obtained by encapsulating response data returned by the server in response to the simulated HTTP request; Decapsulate the simulated HTTP response to obtain the response data.

3. The method according to claim 1, characterized in that The signaling information includes session description protocol information and interactive connection establishment candidate information.

4. The method according to claim 1, characterized in that: Exchanging signaling information with the server through the signaling server and establishing a WebRTC connection with the server includes: Sending first session description protocol information to the server through the signaling server; receiving second session description protocol information returned by the server in response to the first session description protocol information; Based on the first session description protocol information and the second session description protocol information, sending first interactive connection establishment candidate information to the server through the signaling server; receiving second interactive connection establishment candidate information returned by the server in response to the first interactive connection establishment candidate information; A WebRTC connection is established with the server based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information.

5. The method according to claim 1, characterized in that The first signaling transmission connection and the second signaling transmission connection are both WebSocket connections.

6. A secure access method, characterized in that: Applied to a server, the server being located in a private network, the method comprising: Sending a connection request to a signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in a public network and has established a first signaling transmission connection with a client located in the public network; The signaling server exchanges signaling information with the client and establishes a WebRTC connection with the client.

7. The method according to claim 6, characterized in that After establishing the WebRTC connection with the client, the method includes: Receiving a simulated HTTP request sent by the client through the data channel of the WebRTC connection; the simulated HTTP request is obtained by encapsulating the request data of the client; Decapsulating the simulated HTTP request to obtain the request data; Generate response data according to the request data and encapsulate it into a simulated HTTP response; The simulated HTTP response is sent to the client.

8. The method according to claim 6, characterized in that Exchanging signaling information with the client through the signaling server and establishing a WebRTC connection with the client includes: Receiving first session description protocol information sent by the client; Sending second session description protocol information to the client through the signaling server; receiving first interactive connection establishment candidate information sent by the client based on the first session description protocol information and the second session description protocol information, and sending second interactive connection establishment candidate information to the client through the signaling server; A WebRTC connection is established with the client based on the first interactive connection establishment candidate information and the second interactive connection establishment candidate information.

9. A secure access device, characterized in that: Configured on a client, the client is located on a public network, and the device includes: A first request module is used to send a connection request to a signaling server and establish a first signaling transmission connection with the signaling server; the signaling server is located in a public network and has a second signaling transmission connection established with a server located in a private network; The first building module is used to exchange signaling information with the server through the signaling server and establish a WebRTC connection with the server.

10. A secure access device, characterized in that: The device is configured on a server, the server is located in a private network, and the device includes: A second request module is used to send a connection request to a signaling server to establish a second signaling transmission connection with the signaling server; the signaling server is located in a public network and has established a first signaling transmission connection with a client located in the public network; The second building module is used to exchange signaling information with the client through the signaling server and establish a WebRTC connection with the client.

11. A secure access system, characterized in that: Includes client, server and signaling server; The client and the signaling server are located in a public network, and the server is located in a private network; The client is used to perform the method steps as claimed in any one of claims 1 to 5; The server is used to perform the method steps as claimed in any one of claims 6 to 8; The signaling server is used to exchange signaling information between the client and the server.

12. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

13. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 8.

Images