File uploading method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a file uploading method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps that a starting request sent by a terminal is received, connection between the terminal and a remote isolation server is established based on the starting request, and the connection is used for the terminal to send an interception permission request to the remote isolation server, so that the remote isolation server intercepts a file uploading request sent by the terminal; receiving a file uploading request sent by the terminal, wherein the file uploading request carries the terminal identifier; verifying whether a terminal corresponding to the terminal identifier starts an uploading function or not and whether a file size limit corresponding to the uploading function is configured or not; and under the condition that the uploading function is started and the file size limitation corresponding to the uploading function is configured, sending a file uploading starting instruction to the terminal based on the configured file size so as to indicate the terminal to upload the corresponding to-be-uploaded file. By adopting the method, the flexibility can be improved.

Description

Technical Field

[0001] The present application relates to the field of IT technology, and in particular to a file uploading method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of the Internet, users' demand for online services is increasing, especially in the fields of remote office, online education and e-commerce. Browsers have become the main tool for users to access Internet services. In order to improve security, Remote Browser Isolation (RBI) technology has emerged. By isolating browser sessions on remote servers, it can effectively prevent malicious code from invading the user's local system. However, in the process of using RBI technology, file upload control becomes a key issue, which requires both ensuring user convenience and preventing potential security threats.

[0003] In the current solution of directly uploading files in a local browser, the file transfer function is fixed and lacks flexibility. Summary of the invention

[0004] Based on this, it is necessary to provide a file uploading method, apparatus, computer device, computer-readable storage medium and computer program product that can improve flexibility in response to the above technical problems.

[0005] In a first aspect, the present application provides a file uploading method, which is applied to a management server, and the method comprises:

[0006] Receiving a startup request sent by a terminal, and establishing a connection between the terminal and a remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server, so that the remote isolation server intercepts the file upload request sent by the terminal;

[0007] Receiving a file upload request sent by a terminal, wherein the file upload request carries a terminal identifier;

[0008] Verify whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured;

[0009] When the upload function is enabled and the file size limit corresponding to the upload function is configured, a file start upload instruction is sent to the terminal based on the configured file size to instruct the terminal to upload the corresponding file to be uploaded.

[0010] In one of the embodiments, before sending a file upload start instruction to the terminal based on the configured file size, the method further includes:

[0011] Send an upload address acquisition request to the storage server, and obtain the upload address returned by the storage server;

[0012] The upload address is returned to the terminal, and the terminal is used to upload the file to be uploaded to the upload address corresponding to the storage server.

[0013] In one embodiment, the method further comprises:

[0014] receiving a first notification from the terminal that the file to be uploaded is successfully uploaded to the upload address, and sending the first notification to the remote isolation server, the remote isolation server is used to download the file to be uploaded from the storage server based on the first notification, and generate a relative path based on the downloaded file to be uploaded, and send the relative path to the management server;

[0015] The received relative path is sent to the terminal, and the terminal is used to send a second notification to the remote isolation server based on the relative path. The second notification is used to instruct the remote isolation server to generate an absolute path based on the relative path and send the absolute path to the server corresponding to the remote browser.

[0016] In one of the embodiments, before uploading the file to be uploaded to the upload address, the file to be uploaded is also subjected to primary verification based on the file size, and the file to be uploaded that has passed the primary verification is uploaded to the storage server through signature verification and encryption transmission technology;

[0017] The remote isolation server is also used to perform content security verification and malicious code detection on the to-be-uploaded file downloaded from the storage server;

[0018] When both the content security check and the malicious code detection are passed, the file to be uploaded is stored.

[0019] In one embodiment, the method further comprises:

[0020] Recording upload information related to the file to be uploaded;

[0021] Generate a real-time upload status based on the upload information and / or perform a file upload review based on the upload information.

[0022] In one embodiment, the method further comprises:

[0023] receiving an upload information viewing instruction, and displaying corresponding upload information based on the upload information viewing instruction;

[0024] Upload function permission configuration and file size limit configuration are performed based on the upload information.

[0025] In a second aspect, the present application further provides a file uploading device, the device comprising:

[0026] A connection establishment module, used to receive a startup request sent by a terminal, and establish a connection between the terminal and a remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server so that the remote isolation server intercepts the file upload request sent by the terminal;

[0027] A receiving module, used for receiving a file upload request sent by a terminal, wherein the file upload request carries a terminal identifier;

[0028] A verification module, used to verify whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured;

[0029] The upload module is used to send a file start upload instruction to the terminal based on the configured file size when the upload function is turned on and the file size limit corresponding to the upload function is configured, so as to instruct the terminal to upload the corresponding file to be uploaded.

[0030] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0031] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0032] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0033] The above-mentioned file uploading method, device, computer equipment, computer-readable storage medium and computer program product, receive the start request sent by the terminal on the management server, and establish a connection between the terminal and the remote isolation server based on the start request, the connection is used for the terminal to send an interception permission request to the remote isolation server, so that the remote isolation server intercepts the file upload request sent by the terminal, so that after the subsequent management server receives the file upload request, it verifies whether the terminal corresponding to the terminal identifier has the upload function turned on and whether the file size limit corresponding to the upload function is configured; when the upload function is turned on and the file size limit corresponding to the upload function is configured, a file start upload instruction is sent to the terminal based on the configured file size to instruct the terminal to upload the corresponding file to be uploaded, so as to provide the ability to dynamically turn on or off the file upload function according to user needs, and the administrator can flexibly configure whether to allow the upload function and set the maximum size of the file allowed to be uploaded, so as to better adapt to the needs of different scenarios and improve flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] FIG1 is an application environment diagram of a file uploading method in one embodiment;

[0036] FIG2 is a schematic diagram of a process of uploading a file in one embodiment;

[0037] FIG3 is a functional module diagram of a file upload method in one embodiment;

[0038] FIG4 is a timing diagram of a file uploading method in one embodiment;

[0039] FIG5 is a flow chart of a start selection step in one embodiment;

[0040] FIG6 is a flow chart of upload operation steps in one embodiment;

[0041] FIG7 is a flow chart of remote downloading steps in one embodiment;

[0042] FIG8 is a flow chart of the steps of notifying a remote browser server according to one embodiment;

[0043] FIG9 is a structural block diagram of a file uploading device in one embodiment;

[0044] FIG. 10 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] The file uploading method provided in the embodiment of the present application can be applied to the application environment shown in FIG1 . The terminal 102 communicates with the management server 104, the remote isolation server 106, the storage server 108 and the remote browser server 110 through the network, the management server 104 communicates with the remote isolation server 106, and the remote isolation server 106 communicates with the storage server 108 and the remote browser server 110.

[0047] The management server 104 is used to manage each remote isolation server 106, so as to assign the corresponding remote isolation server 106 for communication to the terminal 102, and establish a communication relationship between the terminal 102 and the remote isolation server 106. The management server 104 can obtain the upload address from the storage server 108, and instruct the terminal 102 to upload the file to be uploaded to the upload address corresponding to the storage server 108, and inform the remote isolation server 106 that the upload is completed, so that the remote server 106 can download the corresponding file to be uploaded from the storage server 108, and send the relative path to the terminal 102 through the management server 104. The terminal 102 requests the remote isolation server 106 to share the absolute path to the remote browser server 110 based on the relative path.

[0048] At the beginning of the entire upload, the management server 104 can check whether the terminal has enabled the upload function and whether the file size limit corresponding to the upload function is configured, so as to flexibly control the entire file upload process, and can prohibit file upload based on scenarios, etc., or configure the size of the uploaded file based on scenarios, etc. In this way, the ability to dynamically enable or disable the file upload function according to user needs is provided, and the administrator can flexibly configure whether to allow the upload function and set the maximum size of the file allowed to be uploaded, so as to better adapt to the needs in different scenarios and improve flexibility.

[0049] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0050] The management server 104, the remote isolation server 106, the storage server 108, and the remote browser server 110 may be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. In addition, the management server 104, the remote isolation server 106, the storage server 108, and the remote browser server 110 may be integrated into one server, or a distributed architecture may be adopted, and each server and the server and the terminal communicate through APIs and message queues to ensure the scalability and flexibility of the system.

[0051] In an exemplary embodiment, as shown in FIG2 , a file uploading method is provided, which is described by taking the method applied to the management server in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0052] S202: Receive a startup request sent by the terminal, and establish a connection between the terminal and the remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server so that the remote isolation server intercepts the file upload request sent by the terminal.

[0053] The startup request is to establish a connection between the terminal and the remote isolation server, that is, the two can communicate. Specifically, the terminal opens the front-end interface and opens the corresponding link to trigger the system startup, so that the terminal can call the corresponding interface of the management server to enable the management server to allocate the corresponding remote isolation server to the terminal, and then establish a connection between the terminal and the remote isolation server.

[0054] Specifically, the user opens the link to trigger the system startup, calling the start interface of the management server rbi-manager. The management server rbi-manager selects the appropriate remote isolation server rbi-edge according to the needs, establishes a connection with the rbi front end (i.e., terminal), and ensures a safe browsing environment.

[0055] The terminal can then send an interception permission request to the management server so that the remote isolation server intercepts the file upload request sent by the terminal. This function can be implemented through the CDP (Chrome DevTools Protocol, a debugging and diagnostic protocol provided by the Google Chrome browser that allows developers to interact with the browser through a programming interface) protocol.

[0056] In one of the optional embodiments, the RBI front-end (RBI (Remote Browser Isolation): Remote browser isolation is a network security technology that protects user devices from network threats and malicious content by isolating browser sessions to run on remote servers.) sends CDP protocols, such as Page.setInterceptFileChooserDialo and DOM.enable, to the remote isolation server rbi-edge. The remote isolation server rbi-edge intercepts the CDP protocol, especially Page.fileChooserOpened, and prepares to intercept the file selection box operation of the terminal's local browser.

[0057] The remote isolation server includes rbi-streaming-client and rbi-manager-client, wherein the CDP protocol sent by the terminal is intercepted by the rbi-streaming-client to intercept the file upload of the terminal.

[0058] S204: Receive a file upload request sent by a terminal, where the file upload request carries a terminal identifier.

[0059] A file selection box pops up in the local browser of the terminal, and the user can select the file to be uploaded and send the upload request to the remote isolation server so that the remote isolation server can verify the file upload request.

[0060] Specifically, the local browser of the terminal can send an instruction to start uploading, that is, a file upload request, to the remote isolation server rbi-manager through websocket.

[0061] S206: Check whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured.

[0062] After receiving the file upload request sent by the terminal, the remote isolation server rbi-manager verifies the file upload request, including whether the terminal corresponding to the terminal identifier has the upload function enabled and whether the file size limit corresponding to the upload function is configured.

[0063] In one of the optional embodiments, the present application also includes dynamically turning on or off the file upload function corresponding to the terminal based on user needs, and setting a file size limit corresponding to the upload function.

[0064] The user demand can be determined based on the scenario, and different scenarios correspond to different user demands. Optionally, the management server can configure the terminal upload function based on the terminal identifier and the upload scenario corresponding to the terminal, or the administrator can perform flexible manual configuration to meet the needs of different scenarios. The administrator can flexibly configure the opening or closing of the file upload function and set different file size limits according to actual needs to meet the needs of various business scenarios.

[0065] S208: When the upload function is enabled and the file size limit corresponding to the upload function is configured, a file start upload instruction is sent to the terminal based on the configured file size to instruct the terminal to upload the corresponding file to be uploaded.

[0066] The management server verifies whether the terminal has enabled the file upload function based on the terminal identifier. If so, the management server queries the file size corresponding to the terminal identifier. Optionally, the management server can also detect whether the size of the file to be uploaded selected by the terminal meets the requirements based on the file size. If it meets the requirements, the terminal is instructed to upload the corresponding file to be uploaded. Specifically, the file to be uploaded is uploaded to the remote isolation server, and then the remote browser server is informed to facilitate a normal session.

[0067] In addition, it is also necessary to explain that if the management server determines that the terminal does not have the file upload function turned on or the size of the file to be uploaded selected by the terminal is larger than the file size limit corresponding to the upload function, the management server returns verification failure information to the terminal. Optionally, the verification failure information may include the reason for the failure, such as the file upload function not being turned on or the file size not meeting the requirements. If the reason for the failure is that the file size does not meet the requirements, the terminal may segment the file to be uploaded based on the file size limit corresponding to the upload function to make a file upload request again.

[0068] In the above-mentioned file uploading method, the management server receives a start request sent by the terminal, and establishes a connection between the terminal and the remote isolation server based on the start request, and the connection is used for the terminal to send an interception permission request to the remote isolation server, so that the remote isolation server intercepts the file upload request sent by the terminal. In this way, after the subsequent management server receives the file upload request, it verifies whether the terminal corresponding to the terminal identifier has the upload function turned on and whether the file size limit corresponding to the upload function is configured; when the upload function is turned on and the file size limit corresponding to the upload function is configured, a file start upload instruction is sent to the terminal based on the configured file size to instruct the terminal to upload the corresponding file to be uploaded. In this way, the ability to dynamically turn on or off the file upload function according to user needs is provided, and the administrator can flexibly configure whether to allow the upload function and set the maximum size of the file allowed to be uploaded, so as to better adapt to the needs of different scenarios and improve flexibility.

[0069] In one of the optional embodiments, before sending a file upload start instruction to the terminal based on the configured file size, it also includes: sending an upload address acquisition request to a storage server, and obtaining the upload address returned by the storage server; returning the upload address to the terminal, and the terminal is used to upload the file to be uploaded to the upload address corresponding to the storage server.

[0070] Among them, the upload address is the upload address of the corresponding storage server. The storage server can be obtained based on the S3 service. S3 (Amazon Simple Storage Service) is an object storage service provided by Amazon Web Services (AWS). In other embodiments, the storage server can use other object storage services. This is only an embodiment, and it does not mean that this solution must rely on the object storage service.

[0071] After successfully verifying the file upload request of the terminal, the management server sends an upload address acquisition request to the storage server and obtains the upload address returned by the storage server. The management server then returns the upload address to the terminal so that the terminal can upload the file to be uploaded to the upload address corresponding to the storage server.

[0072] Specifically, the storage server returns the upload address to the management server, and the management server returns the address to the terminal via websocket.

[0073] In the above embodiment, the object storage service is introduced to ensure the accuracy of file upload under the influence of network instability or other factors. And because the storage server and the remote isolation server are located on the same server or in a distributed architecture, the accuracy of file transmission can be guaranteed.

[0074] In one of the optional embodiments, the method also includes: receiving a first notification sent by the terminal that the file to be uploaded is successfully uploaded to the upload address, and sending the first notification to the remote isolation server, the remote isolation server is used to download the file to be uploaded from the storage server based on the first notification, and generate a relative path based on the downloaded file to be uploaded, and send the relative path to the management server; sending the received relative path to the terminal, the terminal is used to send a second notification to the remote isolation server based on the relative path, the second notification is used to instruct the remote isolation server to generate an absolute path based on the relative path, and send the absolute path to the server corresponding to the remote browser.

[0075] After receiving the upload address, the terminal uploads the file to be uploaded to the storage server. The storage server returns the upload status of the file to be uploaded to the terminal. When the terminal receives that the upload status of the file to be uploaded is complete, it generates a first notification that the file to be uploaded is successfully uploaded to the upload address, and sends the first notification to the management server. The management server sends the first notification to the remote isolation server, for example, to the rbi-manager-client of the remote isolation server. After receiving the first notification, the remote isolation server returns a successful reception message to the management server, and the remote isolation server is also used to download the file to be uploaded from the storage server. If the download fails, the remote isolation server rbi-manager-client notifies the download status through websocket, and the process ends here.

[0076] If the download is successful, the storage server notifies the remote isolation server that the download is complete, and the remote isolation server notifies the management server of the relative path of the file. For example, the management server S3 notifies the rbi-manager-client that the download is complete. The rbi-manager-client notifies the management server rbi-manager of the relative path of the file. The management server returns the relative path to the terminal. For example, the management server rbi-manager notifies the terminal of the relative path of the file through websocket. The terminal sends the CDP protocol again, such as DOM.setFileInputFiles, where the path is a relative path. The rbi-streaming-client intercepts the CDP protocol, modifies the file path to an absolute path, and notifies the remote browsing server (such as Chrome).

[0077] In one of the optional embodiments, before uploading the file to be uploaded to the upload address, the file to be uploaded is also subjected to primary verification based on the file size, and the file to be uploaded that has passed the primary verification is uploaded to the storage server through signature verification and encryption transmission technology; the remote isolation server is also used to perform content security verification and malicious code detection on the file to be uploaded downloaded from the storage server; if the content security verification and malicious code detection are passed, the file to be uploaded is stored.

[0078] Among them, in order to improve security in this application, the injection of malicious code and the leakage of sensitive data are prevented by controlling the security of the file upload process. The system uses signature verification and file size restrictions to ensure that only authenticated files can be uploaded, and prevents forgery and tampering of upload requests. By strictly controlling the file upload process, the risk of malicious code and viruses invading the enterprise network through file upload is reduced, and the security of the enterprise intranet environment is protected.

[0079] Specifically, before uploading a file, we first check the permissions, that is, whether the file upload function is enabled, and the file size limit. Secondly, we also perform basic checks on the file before uploading, including format and size checks, as well as basic security checks. We ensure that the file uploaded by the user meets the expected format and size requirements, and perform basic security checks, such as virus scanning and file integrity verification.

[0080] When downloading files to be uploaded from the storage server, strict security control measures are also implemented to ensure the security of uploaded files and prevent malicious code injection and data leakage. Uploaded files are deeply checked and verified for security, including content security scanning and malicious code detection, to ensure security.

[0081] In one of the optional embodiments, the method further includes: recording upload information related to the file to be uploaded; generating a real-time upload status based on the upload information and / or performing a file upload review based on the upload information.

[0082] In one of the optional embodiments, the method further includes: receiving an upload information viewing instruction, and displaying corresponding upload information based on the upload information viewing instruction; and performing upload function permission configuration and file size limit configuration based on the upload information.

[0083] Among them, security audit services can also be introduced in this application, that is, logs and audit information of upload activities are recorded and stored. The management console service can be used by administrators to monitor and manage the system and receive security audit records.

[0084] Specifically, the security audit service records the logs and audit information of upload operations, providing audit functions for administrators. It records the user's upload activities, operation time, file information, etc. in detail, supporting security audits and compliance checks.

[0085] The management console service provides administrators with the ability to monitor and manage the system, and receive log information from the security audit module. It allows administrators to monitor file upload activities in real time, configure upload permissions, and view upload statistics.

[0086] In the above embodiment, real-time monitoring and management functions of the file upload process are provided, and the administrator can understand the status and results of the file upload in real time. The system also supports the audit and recording functions of the uploaded files, which is convenient for tracing and analyzing historical records and security events. In addition, through automated support and a more reliable upload process, the upload failure is reduced and the user satisfaction is improved. When uploading files, the system ensures the smoothness and success rate of the upload process through pre-verification and multi-step confirmation mechanisms. The file upload control system and method are introduced in the remote isolation security browser (RBI) technology, which helps to improve the security and reliability of the overall system. Through flexible functional configuration, strict security control, simplified management process and optimized user experience, this application has important technical and commercial value while meeting user needs. By promoting and applying this application, the level of enterprise network security protection can be further improved, the service quality in the fields of remote office, online education and e-commerce can be improved, and the safe, stable and efficient development of Internet services can be promoted.

[0087] For ease of understanding, in conjunction with FIG3, FIG3 is a functional module diagram of a file upload method in an embodiment, wherein the user interface module, the file pre-verification module, the file transfer and processing module are located in the terminal, the authority management module, the management console module are located in the management server, and the security control module and the file transfer and processing module are located in the remote isolation server. Among them, the file pre-verification module performs file inspection, the authority management module manages upload authority, the management console module monitors system operation, the security control module ensures file security, the file transfer and processing module is responsible for uploading files to the remote server, the remote isolation security browser module provides a secure browsing environment, and the security audit module records upload logs.

[0088] Specifically, the user interface module is responsible for interacting with the user, including file selection, upload operations, and receiving system notifications. It provides a user-friendly interface that allows users to easily select and upload files.

[0089] The file pre-verification module is used to perform basic verification on files before uploading, including format and size checks, as well as basic security checks. It ensures that the files uploaded by users meet the expected format and size requirements, and performs basic security checks such as virus scanning and file integrity verification.

[0090] The permission management module is used to manage users' upload permissions, dynamically configure upload functions and file size limits. Based on the policies configured by the administrator, it determines whether users are allowed to perform upload operations and sets file size limits to control system resource usage.

[0091] The management console module is used to provide administrators with monitoring and management functions, and receive the record information of the security audit module. It allows administrators to monitor file upload activities in real time, configure upload permissions, and view upload statistics.

[0092] The security control module is used to implement strict security control measures to ensure the security of uploaded files and prevent malicious code injection and data leakage. It performs in-depth inspection and security verification on uploaded files, including content security scanning and malicious code detection.

[0093] The file transmission and processing module is responsible for uploading files to the remote server securely and performing subsequent processing. Encrypted transmission and verification mechanisms are used to ensure data integrity and security during file upload.

[0094] The Remote Isolation Secure Browser Module (RBI Edge) is used to provide a secure remote browsing environment, ensuring that the user's browsing activities are performed in an isolated environment, preventing malicious websites and attacks from endangering the user's system security through the browser session.

[0095] The security audit module is used to record the logs and audit information of upload operations, providing audit functions for administrators. It records the user's upload activities, operation time, file information, etc. in detail, supporting security audits and compliance checks.

[0096] As shown in FIG. 4, FIG. 4 is a timing diagram of a file upload method in an embodiment. In this embodiment, after the system is started, the user interface module establishes a connection with the remote isolation security browser module, and the front end issues the CDP protocol to intercept the file selection box operation of the local browser. After the user selects the file, an upload instruction is sent to the authority management module through websocket, and the pre-verified upload address is requested after the authority is verified. After the upload is successful, the management console module is notified to download the file, and the file is uploaded to the remote server through the file transfer and processing module. The remote isolation security browser module receives the CDP protocol and forwards the secure path to the remote browser.

[0097] The file upload method specifically includes the following steps:

[0098] (1) System startup and connection establishment

[0099] Specifically, as shown in Figure 5, the user opens a link to trigger the system startup, calling the start interface of the rbi-manager. The rbi-manager selects the appropriate rbi-edge according to the needs, establishes a connection with the rbi front end, and ensures a safe browsing environment.

[0100] (2) CDP protocol issuance and interception

[0101] The RBI frontend (located in the local browser in the terminal) sends the CDP protocol to the remote isolation server rbi-edge, such as Page.setInterceptFileChooserDialo and DOM.enable. rbi-edge intercepts the CDP protocol, especially Page.fileChooserOpened, to intercept the file selection box operation of the local browser.

[0102] (3) File selection and upload preparation

[0103] The local browser pops up a file selection box and the user selects the file to upload.

[0104] (4) Sending and verifying upload instructions

[0105] Specifically, as shown in Figure 6, the front end sends an instruction to start uploading to the management server rbi-manager through websocket. The management server rbi-manager receives the instruction and verifies whether the upload function and file size limit are enabled.

[0106] (5) Pre-verification address request and response

[0107] After verification, the management server rbi-manager requests the pre-verified upload address from the storage server S3. The storage server S3 returns the upload address to rbi-manager, and rbi-manager returns the address to the front end through websocket.

[0108] (6) Upload the file to the storage server S3

[0109] After the terminal receives the pre-verified upload address, the user clicks the upload button to upload the file to the storage server S3. The storage server S3 processes the file upload and returns the upload status to the front end.

[0110] (7) Upload result notification and file download trigger

[0111] Specifically, as shown in Figure 7, the local browser notifies the management server rbi-manager of the upload result (success or failure) through websocket. If the upload is successful, the management server rbi-manager notifies rbi-manager-client to download the file.

[0112] (8) File download processing

[0113] After receiving the notification, rbi-manager-client requests the storage server S3 to download the file. Storage server S3 processes the download request and transfers the file to rbi-manager-client.

[0114] (9) Download status notification

[0115] If the download fails, rbi-manager-client notifies the download status via websocket, and the process ends here.

[0116] (10) Download success notification and file path transmission

[0117] Specifically, as shown in Figure 8, if the download is successful, the storage server S3 notifies the rbi-manager-client that the download is complete. The rbi-manager-client notifies the management server rbi-manager of the relative path of the file.

[0118] (11) Notify the front end of the file path

[0119] The management server rbi-manager notifies the front end of the relative path of the file through websocket.

[0120] (12) CDP protocol issuance and path modification

[0121] The RBI front-end (located at the terminal) sends the CDP protocol again (such as DOM.setFileInputFiles), and the path is a relative path. The rbi-streaming-client intercepts the CDP protocol, changes the file path to an absolute path, and notifies the remote browser (such as Chrome).

[0122] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0123] Based on the same inventive concept, the embodiment of the present application also provides a file uploading device for implementing the file uploading method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more file uploading device embodiments provided below can refer to the limitations on the file uploading method above, and will not be repeated here.

[0124] In an exemplary embodiment, as shown in FIG. 9 , a file uploading device is provided, including: a connection establishment module 901, a receiving module 902, a verification module 903, and an uploading module 904, wherein:

[0125] A connection establishment module 901 is used to receive a startup request sent by a terminal, and to establish a connection between the terminal and a remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server so that the remote isolation server intercepts the file upload request sent by the terminal;

[0126] A receiving module 902 is used to receive a file upload request sent by a terminal, where the file upload request carries a terminal identifier;

[0127] A verification module 903, used to verify whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured;

[0128] The upload module 904 is used to send a file start upload instruction to the terminal based on the configured file size when the upload function is enabled and the file size limit corresponding to the upload function is configured, so as to instruct the terminal to upload the corresponding file to be uploaded.

[0129] In one of the optional embodiments, the device also includes: an upload address acquisition module, which is used to send an upload address acquisition request to the storage server and obtain the upload address returned by the storage server; return the upload address to the terminal, and the terminal is used to upload the file to be uploaded to the upload address corresponding to the storage server.

[0130] In one of the optional embodiments, the above-mentioned upload module is also specifically used to receive a first notification sent by the terminal that the file to be uploaded is successfully uploaded to the upload address, and send the first notification to the remote isolation server, the remote isolation server is used to download the file to be uploaded from the storage server based on the first notification, and generate a relative path based on the downloaded file to be uploaded, and send the relative path to the management server; send the received relative path to the terminal, the terminal is used to send a second notification to the remote isolation server based on the relative path, the second notification is used to instruct the remote isolation server to generate an absolute path based on the relative path, and send the absolute path to the server corresponding to the remote browser.

[0131] In one of the optional embodiments, before uploading the file to be uploaded to the upload address, the file to be uploaded is also subjected to primary verification based on the file size, and the file to be uploaded that has passed the primary verification is uploaded to the storage server through signature verification and encryption transmission technology; the remote isolation server is also used to perform content security verification and malicious code detection on the file to be uploaded downloaded from the storage server; if the content security verification and malicious code detection are passed, the file to be uploaded is stored.

[0132] In one of the optional embodiments, it further includes a recording module for recording upload information related to the file to be uploaded; generating a real-time upload status based on the upload information and / or performing a file upload review based on the upload information.

[0133] In one of the optional embodiments, it further includes a configuration module, which is used to receive an upload information viewing instruction and display corresponding upload information based on the upload information viewing instruction;

[0134] Upload function permission configuration and file size limit configuration are performed based on the upload information.

[0135] Each module in the above-mentioned file uploading device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module above.

[0136] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG10. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a file upload method is implemented.

[0137] Those skilled in the art will understand that the structure shown in FIG. 10 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0139] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0140] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0141] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0142] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0144] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A file uploading method, characterized in that: Applied to a management server, the method comprises: Receiving a startup request sent by a terminal, and establishing a connection between the terminal and a remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server, so that the remote isolation server intercepts the file upload request sent by the terminal; Receiving a file upload request sent by a terminal, wherein the file upload request carries a terminal identifier; Verify whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured; When the upload function is enabled and the file size limit corresponding to the upload function is configured, a file start upload instruction is sent to the terminal based on the configured file size to instruct the terminal to upload the corresponding file to be uploaded.

2. The method according to claim 1, characterized in that Before sending a file upload start instruction to the terminal based on the configured file size, the method further includes: Send an upload address acquisition request to the storage server, and obtain the upload address returned by the storage server; The upload address is returned to the terminal, and the terminal is used to upload the file to be uploaded to the upload address corresponding to the storage server.

3. The method according to claim 2, characterized in that The method further comprises: receiving a first notification sent by the terminal that the file to be uploaded is successfully uploaded to the upload address, and sending the first notification to the remote isolation server, the remote isolation server is used to download the file to be uploaded from the storage server based on the first notification, and generate a relative path based on the downloaded file to be uploaded, and send the relative path to the management server; The received relative path is sent to the terminal, and the terminal is used to send a second notification to the remote isolation server based on the relative path. The second notification is used to instruct the remote isolation server to generate an absolute path based on the relative path and send the absolute path to the server corresponding to the remote browser.

4. The method according to claim 3, characterized in that: Before uploading the file to be uploaded to the upload address, the file to be uploaded is also subjected to primary verification based on the file size, and the file to be uploaded that has passed the primary verification is uploaded to the storage server through signature verification and encryption transmission technology; The remote isolation server is also used to perform content security verification and malicious code detection on the to-be-uploaded file downloaded from the storage server; When both the content security check and the malicious code detection are passed, the file to be uploaded is stored.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Recording upload information related to the file to be uploaded; Generate a real-time upload status based on the upload information and / or perform a file upload review based on the upload information.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: receiving an upload information viewing instruction, and displaying corresponding upload information based on the upload information viewing instruction; Upload function permission configuration and file size limit configuration are performed based on the upload information.

7. A file uploading device, characterized in that: The device comprises: A connection establishment module, used to receive a startup request sent by a terminal, and establish a connection between the terminal and a remote isolation server based on the startup request, wherein the connection is used for the terminal to send an interception permission request to the remote isolation server so that the remote isolation server intercepts the file upload request sent by the terminal; A receiving module, used for receiving a file upload request sent by a terminal, wherein the file upload request carries a terminal identifier; A verification module, used to verify whether the terminal corresponding to the terminal identifier has an upload function enabled and whether a file size limit corresponding to the upload function is configured; The upload module is used to send a file start upload instruction to the terminal based on the configured file size when the upload function is turned on and the file size limit corresponding to the upload function is configured, so as to instruct the terminal to upload the corresponding file to be uploaded.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images