Network proxy method and system

Abstract

The invention provides a network proxy method and system, and the method comprises the steps that a client obtains a first user token from a server based on a login request, and transmits a starting proxy request comprising the first user token and a first user identifier to target proxy service equipment; and the target proxy service equipment obtains the query identifier of the first user from the server based on the first user token, and compares the query identifier with the first user identifier, so that verification passing information is sent to the server under the condition that the query identifier and the first user identifier are consistent, and a network proxy starting service is provided for the first user. And a dynamic identity verification mechanism for the user can be realized. Therefore, a safer, more reliable and more efficient network security solution is provided for enterprises.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a network proxy method and system. Background Art

[0002] With the development of the Internet, network proxy services have gradually evolved into a technical means to solve various network needs. Network proxy services are middle-layer services that initiate requests to other services on behalf of clients, receive responses, and then return them to the original client.

[0003] In the related art, a virtual private network (VPN) can be used to provide network proxy services. VPN is a network technology that allows users to establish a secure connection through a public network (usually the Internet) as if they were in a private local area network (LAN). The main purpose of VPN is to protect the privacy and data security of users while providing access to private network resources.

[0004] However, using VPN to provide network proxy services has problems with low security and reliability.

[0005] It is worth noting that the contents of the above-mentioned related technologies are merely information known to the inventor personally, which does not mean that the above-mentioned information has entered the public domain before the filing date of this specification, nor does it mean that it can become the prior art of this specification. Summary of the invention

[0006] This specification provides a network proxy method and system to avoid at least one of the above technical problems.

[0007] In a first aspect, this specification provides a network proxy method, applied to a target proxy service device, comprising:

[0008] Receiving a proxy start request initiated by a first user through a client, wherein the proxy start request includes a first user identifier and a first user token, and the first user token is obtained by the client from a server based on a login request;

[0009] Initiating a first query request to the server for a user identifier corresponding to the first user token, and receiving a query identifier fed back by the server in response to the first query request; and

[0010] If the first user identifier is the same as the query identifier, verification pass information is sent to the server so that the server provides a service of starting a network proxy based on the verification pass information.

[0011] In a second aspect, this specification provides a network proxy method, applied to a server, comprising:

[0012] Verifying a login request initiated by the first user through the client;

[0013] If the login request is verified successfully, the first user token is fed back to the client;

[0014] Receiving a first query request initiated by a target proxy service device to query a user identifier corresponding to the first user token, wherein the first query request is initiated by the target proxy service device after receiving a proxy start request initiated by the first user through the client and based on the first user token in the proxy start request;

[0015] Feedback a query identifier corresponding to the first query request to the target proxy service device;

[0016] receiving verification pass information sent by the target proxy service device, wherein the verification pass information is determined by the target proxy service device comparing the query identifier with the first user identifier in the proxy start request, and the query identifier and the first user identifier are identical; and

[0017] The network proxy activation service is provided to the first user according to the verification pass information.

[0018] In a third aspect, this specification provides a network proxy method, applied to a client, comprising:

[0019] Initiate a login request of the first user to the server;

[0020] Receiving a first user token sent by the server when the login request is verified successfully;

[0021] Initiating a proxy start request to a target proxy service device, wherein the proxy start request includes a first user identifier and a first user token, the first user token is used by the target proxy service device to query the server to obtain a query identifier corresponding to the first user token, and the query identifier is used to compare with the first user identifier; and

[0022] A network proxy activation service provided by the server for the first user is received, wherein the network proxy activation service is determined when the query identifier and the first user identifier are identical.

[0023] In a fourth aspect, this specification provides an agent service device, including:

[0024] at least one storage medium storing at least one instruction set to perform network proxying;

[0025] At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, it reads the at least one instruction set and executes the method as described in the first aspect according to the instructions of the at least one instruction set.

[0026] In a fifth aspect, this specification provides a server, including:

[0027] at least one storage medium storing at least one instruction set to perform network proxying;

[0028] At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, it reads the at least one instruction set and executes the method as described in the second aspect according to the instructions of the at least one instruction set.

[0029] In a sixth aspect, this specification provides a client, including:

[0030] at least one storage medium storing at least one instruction set to perform network proxying;

[0031] At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, it reads the at least one instruction set and executes the method described in the third aspect according to the instructions of the at least one instruction set.

[0032] In a seventh aspect, this specification provides a network proxy system, comprising:

[0033] The proxy service device as described in the fourth aspect;

[0034] The server as described in the fifth aspect;

[0035] A client as described in the sixth aspect.

[0036] It can be seen from the above technical solutions that the network proxy method and system provided in this specification completes the dynamic identity authentication mechanism for users by combining the user token through the interaction between the client, the target proxy service device, and the server. And when the verification is passed, the network proxy service is provided to the user. Therefore, a more secure, reliable, and efficient network security solution is provided to the enterprise.

[0037] Other functions of the network proxy method and system provided in this specification will be partially listed in the following description. The creative aspects of the network proxy method and system provided in this specification can be fully explained by practicing or using the methods, devices and combinations described in the following detailed examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A schematic diagram of an application scenario of the network proxy method provided in the embodiments of this specification;

[0040] Figure 2 A schematic diagram of the structure of the server provided in the embodiments of this specification;

[0041] Figure 3 An interactive schematic diagram of a network proxy method for starting a proxy phase provided by an embodiment of this specification;

[0042] Figure 4 A schematic diagram of the principle of a network proxy method for starting a proxy phase provided by an embodiment of this specification;

[0043] Figure 5 A schematic diagram of the structure of a distributed system provided in an embodiment of this specification;

[0044] Figure 6 A schematic diagram of the principle of matching a user token with a cache provided in the embodiments of this specification;

[0045] Figure 7 A schematic diagram of the principles of a network proxy method in the proxy access phase provided by an embodiment of this specification. DETAILED DESCRIPTION

[0046] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0047] It should be understood that the terms "including" and "having" and any variations thereof in the embodiments of this specification are intended to cover but not exclude inclusion. For example, a product or device comprising a series of components is not necessarily limited to those components explicitly listed, but may include other components not explicitly listed or inherent to these products or devices.

[0048] In the embodiments of this specification, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0049] The term "plurality" in the embodiments of the present specification refers to two or more than two, and other quantifiers are similar thereto.

[0050] The terms "first", "second", "third", etc. in this specification are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise indicated. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented in an order other than those given in the diagrams or descriptions of the embodiments of this specification.

[0051] The term "unit / module" as used in this specification refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0052] To facilitate readers' understanding of this specification, at least some of the terms in this specification are explained as follows:

[0053] Proxy Functionality, also known as network proxy service, refers to the function and service of forwarding client requests and responses through a proxy server in network communications. The proxy server acts as an intermediary between the client and the target server and can provide a variety of functions and services. Network proxy services include services to enable network proxy (which can be referred to as enabling proxy or starting proxy) and network proxy access (which can be referred to as proxy access).

[0054] Zero Trust Network is a network security architecture whose core concept is that no device, user or system is trusted by default, whether it is in the internal network or not. Zero Trust Architecture ensures that only verified users and devices can access the corresponding resources through strict authentication.

[0055] A distributed system is a system where components are distributed on different network nodes and work together to achieve system functions. Distributed systems are highly available, scalable, and fault-tolerant, and are often used in large and complex scenarios. Distributed systems can effectively utilize resources, avoid single points of failure, and improve overall reliability and performance.

[0056] Device fingerprinting is a technology that uniquely identifies a device by collecting multiple parameters such as the device's hardware characteristics, operating system information, browser characteristics, etc.

[0057] APISIX is a high-performance, dynamic, real-time Application Programming Interface (API) gateway. APISIX has a dynamic plug-in mechanism that allows it to be easily extended to support more functions and scenarios.

[0058] NGinx is a high-performance Hypertext Transfer Protocol (HTTP) and reverse proxy server that processes HTTP requests and responses and can also be used as a proxy server.

[0059] afclientproxy is a software that can be used to establish a secure connection between a desktop and a server so that client applications running on the desktop can securely access resources on the server through this connection.

[0060] Cache is a technology used to temporarily store data in order to speed up data access and improve system performance.

[0061] The principle of least privilege is a security strategy that requires users, applications, and system processes to have only the minimum permissions required to perform their work. This principle can effectively reduce the risk of system attacks and data leaks, and ensure the security and stability of the system.

[0062] Virtual Private Network, or VPN for short, is a network that establishes a private network on a public network for encrypted communication. It is widely used in enterprise networks. VPN gateways enable remote access by encrypting data packets and converting the destination address of data packets. VPN can be implemented in a variety of ways, including servers, hardware, and software.

[0063] Secure Access Service Edge (SASE) is a cloud-based IT model that bundles software-defined networking and network security capabilities and is provided by a single service provider.

[0064] To facilitate readers' understanding of this specification, the application scenarios of this specification are now introduced.

[0065] The technical solution provided in this specification is applicable to scenarios where network proxy services are required. For example, the technical solution provided in this specification is applicable to application scenarios such as enterprise networks, public mobile hotspots (Wi-Fi) networks, data centers, content delivery networks (CDNs), and personal privacy protection.

[0066] Take the scenario where the technical solution provided in this specification is applied to an enterprise network as an example:

[0067] Enterprises can control access to their internal networks (which can be referred to as intranets) through the technical solutions provided in this specification to ensure security protection and access control of intranets. For example, enterprise A supports working from home. Enterprise A includes employee A1. Through the technical solutions provided in this specification, employee A1 can access enterprise A's internal network at home. On the contrary, user B is not an employee of enterprise A, and enterprise A's intranet is strictly prohibited from being accessed by employees other than employees of enterprise A. Through the technical solutions provided in this specification, user B cannot access enterprise A's intranet.

[0068] In actual applications, network proxy services can be provided through VPN or SASE.

[0069] However, using VPN to provide network proxy services has at least one of the following problems:

[0070] On the one hand, VPNs usually provide protection at the network layer, but they do not have the fine-grained access control and dynamic authentication in the zero-trust architecture, making them easy targets for network attacks. On the other hand, VPNs use a full tunnel mode, routing all traffic through the corporate intranet, which may cause bandwidth pressure and performance bottlenecks. On the other hand, once a VPN connection is established, users can access the entire corporate intranet resources, lacking fine-grained permission control and the principle of least privilege. On the other hand, maintaining and managing VPN infrastructure requires a lot of time and resources, especially in dealing with certificate management and network configuration.

[0071] Using SASE to provide network proxy services may result in at least one of the following problems:

[0072] On the one hand, the full implementation of SASE requires large-scale transformation of the existing network architecture, involving multiple technologies, and the implementation process is complex and has a long period of time. On the other hand, it involves multiple security functions, and the implementation and operation costs are high, which may exceed the budget of some small and medium-sized enterprises. On the other hand, SASE usually relies on cloud platforms to provide services, and there may be compatibility issues for enterprises that have restrictions on the use of cloud environments. On the other hand, in a high-concurrency access environment, SASE may be subject to performance limitations, especially when the edge nodes are overloaded, affecting the user experience.

[0073] It is worth noting that the contents of the above-mentioned related technologies are merely information known to the inventor personally, which does not mean that the above-mentioned information has entered the public domain before the filing date of this specification, nor does it mean that it can become the prior art of this specification.

[0074] Therefore, in order to avoid at least one of the above problems, this specification proposes a technical conception that has been creatively worked on: constructing a network proxy system with a zero-trust architecture including a client (also referred to as a desktop), a target proxy service device (which can be any proxy service device in a distributed system, also referred to as a target proxy node), and a server (also referred to as a server or an external server, such as the target server in the above example). Among them, the target proxy service device is an intermediary role, located between the enterprise intranet and the Internet. In the technical solution provided in this specification, through the interaction between the desktop, the target proxy node, and the server, the legitimacy of the user requesting the network proxy service is verified to verify whether the user can obtain the network proxy service provided by the network proxy system. Accordingly, if the verification is passed, the network proxy system provides the user with a network proxy service. On the contrary, if the verification is not passed, the network proxy system does not provide the user with a network proxy service to improve the access security of the enterprise intranet and avoid information leakage in the enterprise intranet.

[0075] Figure 1 FIG. 1 is a schematic diagram of an application scenario of the network proxy method of an embodiment of the present specification, wherein the network proxy method of the present specification can be applied to Figure 1 The application scenario 100 shown. Figure 1 As shown, the application scenario 100 may include a target user 101, a desktop terminal 102, a target proxy node 103, and a server terminal 104. The network proxy system may include the desktop terminal 102, the target proxy node 103, and the server terminal 104.

[0076] The target user 101 can be a user who triggers the request for the network proxy system to provide a network proxy service. Exemplarily, the target user 101 can perform a target operation on the desktop 102 to trigger the request for the network proxy system to provide a network proxy service.

[0077] For example, the application scenario 100 is the scenario of the enterprise network. The target user 101 may be an employee A1 in the enterprise A. In order to complete corresponding work at home, the employee A1 may trigger a request for obtaining a network proxy service based on the desktop 102 .

[0078] The desktop terminal 102 is deployed on an electronic device that can provide interactive functions to the target user 101. For example, the desktop terminal 102 can provide an interactive interface to the target user 101, and the target user 101 can perform interactive operations in the interactive page.

[0079] In some embodiments, the electronic devices deployed by the desktop 102 may include mobile devices, tablet computers, laptop computers, built-in devices of motor vehicles, or similar content, or any combination thereof. In some embodiments, the mobile devices may include smart home devices, smart mobile devices, virtual reality devices, augmented reality devices, or similar devices, or any combination thereof. In some embodiments, smart home devices may include smart TVs, desktop computers, etc., or any combination thereof. In some embodiments, smart mobile devices may include smart phones, personal digital assistants, gaming devices, navigation devices, etc., or any combination thereof. In some embodiments, built-in devices in motor vehicles may include onboard computers, onboard TVs, etc.

[0080] In some embodiments, one or more applications (Application, APP) may be installed in the electronic device deployed by the desktop 102. APP can provide the target user 101 with the ability and interface to interact with the outside world through the network. APP includes but is not limited to: web browser APP programs, search APP programs, chat APP programs, shopping APP programs, video APP programs, financial management APP programs, instant messaging tools, email clients, social platform software, etc.

[0081] like Figure 1 As shown, the desktop terminal 102 can be respectively connected to the target proxy node 103 and the server 104 through the network. The target proxy node 103 and / or the server 104 can be connected to one desktop terminal 102 or multiple desktop terminals 102. The server 104 can be a server that provides various services.

[0082] The target proxy node 103 and the server 104 may also be connected to each other through a network for communication.

[0083] That is, the network is a medium for providing a communication connection between the desktop terminal 102 and the target proxy node 103, a medium for providing a communication connection between the desktop terminal 102 and the server terminal 104, and a medium for providing a communication connection between the target proxy node 103 and the server terminal 104.

[0084] The network can facilitate the exchange of information or data. For example, the desktop terminal 102 and the server terminal 104 can be connected to the network respectively, and transmit information or data to each other through the network.

[0085] In some embodiments, the network may be any type of wired or wireless network, or a combination thereof. For example, the network may include a cable network, a wired network, a fiber optic network, a telecommunications network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a public switched telephone network (PSTN), a Bluetooth network TM, a short-range wireless network (ZigBee TM), a near field communication (NFC) network, or a similar network.

[0086] In some embodiments, the network may include one or more network access points. For example, the network may include a wired or wireless network access point, such as a base station or an Internet exchange point, through which one or more components of the desktop 102 and the server 104 can connect to the network to exchange data or information.

[0087] Continuing with the above-mentioned enterprise network scenario, the target proxy node 103 receives the request initiated by the target user 101 through the desktop terminal 102, and interacts with the server 104 based on the request (for the specific interaction logic, please refer to the technical solution provided in this specification) to verify whether employee A1 can access the enterprise intranet of enterprise A.

[0088] Accordingly, if the verification result indicates that A1 can access the intranet of enterprise A, the network proxy system provides the proxy network service for employee A1, so that employee A1 can remotely access the intranet of enterprise A. On the contrary, if the verification result indicates that A1 cannot access the intranet of enterprise A, the network proxy system does not provide the proxy network service for employee A1, so that employee A1 cannot remotely access the intranet of enterprise A.

[0089] It is worth mentioning that Figure 1 The above examples are only used to illustrate the application scenarios to which the technical solution of this specification may be applicable, and should not be understood as limiting the application scenarios of the technical solution of this specification.

[0090] Figure 2 FIG. 1 shows a hardware structure diagram of a server 104 provided according to an embodiment of the present specification. Figure 2As shown, the server 104 may include at least one storage medium 203 and at least one processor 202. In some embodiments, the server 104 may also include a communication port 204 and an internal communication bus 201. The server 104 may also include an I / O component 205.

[0091] The internal communication bus 201 can connect different system components. For example, the internal communication bus 201 can connect the storage medium 203, the processor 202, the communication port 204 and the I / O component 205.

[0092] The I / O component 205 supports input / output between the server 104 and other components.

[0093] The communication port 204 is used for data communication between the server 104 and the outside world. For example, the communication port 204 can be used for data communication between the server 104 and the network. The communication port 204 can be a wired communication port or a wireless communication port.

[0094] The storage medium 203 may include a data storage device. The data storage device may be a non-temporary storage medium or a temporary storage medium. For example, the data storage device may include one or more of a disk 2031, a read-only storage medium (ROM) 2032, or a random access storage medium (RAM) 2033. The storage medium 203 also includes at least one instruction set stored in the data storage device. The instruction set includes computer program code, and the computer program code may include programs, routines, objects, components, data structures, processes, modules, etc. for executing the network proxy method provided in this specification and applied to the server 104.

[0095] At least one processor 202 may be communicatively connected to at least one storage medium 203. At least one processor 202 is used to execute the above-mentioned at least one instruction set. When the server 104 is running, at least one processor 202 reads the at least one instruction set, and executes the network proxy method applied to the server 104 provided in this specification according to the instructions of the at least one instruction set. The processor 202 may execute all the steps included in the network proxy method. The processor 202 may be in the form of one or more processors. In some embodiments, the processor 202 may include one or more hardware processors, such as a microcontroller, a microprocessor, a reduced instruction set computer (RISC), an application-specific integrated circuit (ASIC), an application-specific instruction set processor (ASIP), a central processing unit (CPU), a graphics processing unit (GPU), a physical processing unit (PPU), a microcontroller unit, a digital signal processor (DSP), a field programmable gate array (FPGA), an advanced RISC machine (ARM), a programmable logic device (PLD), any circuit or processor capable of performing one or more functions, etc., or any combination thereof.

[0096] For the purpose of illustration only, only one processor 202 is shown in the server 104 in the figure. However, it should be noted that the server 104 in this specification may also include multiple processors, and therefore, the operations and / or method steps disclosed in this specification may be performed by one processor or by multiple processors in combination.

[0097] It is understandable that the hardware structure of the target proxy node 103 can be found in Figure 2 The above description about the server 104 will not be repeated here.

[0098] See also Figure 3 , Figure 3 The interactive diagram of the network proxy method provided in the embodiment of this specification. Figure 3 As shown, the method includes the following S301 to S309:

[0099] S301: The client initiates a login request of a first user to a server.

[0100] Correspondingly, the server receives a login request initiated by the first user through the client.

[0101] Exemplary, combined Figure 4 It can be seen that the first user can perform a target operation on the desktop to initiate a login request through the target operation.

[0102] For example, the desktop terminal may provide an interactive interface for the first user. The interactive interface includes a login box. The first user may enter an account number and password in the login box and submit a login request by clicking a "Login" button.

[0103] S302: The server verifies the login request and sends the first user token to the client if the verification is successful.

[0104] Correspondingly, the client obtains the first user token sent by the server.

[0105] For example, in combination with the above analysis, when the server receives the account number and password of the first user, it can verify whether the password is correct. Figure 4 As shown, the server allocates a token (ie, the first user token) to the desktop.

[0106] The token assigned by the server is similar to the device fingerprint and is unique. Therefore, subsequent legitimacy verification based on tokens can effectively prevent fraud and abnormal behavior.

[0107] S303: The client generates a proxy start request based on the first user token, wherein the proxy start request includes a first user ID and the first user token.

[0108] Combining the above examples with Figure 4 This step can be understood as: when the desktop receives the first user token sent by the server, it generates a start proxy request based on the first user identifier and the first user token, so that the start proxy request includes at least two parts: one is the first user identifier, and the other is the first user token.

[0109] S304: The client initiates a proxy start request to the target proxy service device.

[0110] Correspondingly, the target proxy service device receives the proxy start request sent by the client, and specifically receives the first user identification and the first user token sent by the client.

[0111] S305: The target proxy service device initiates a first query request to the server for a user identifier corresponding to the first user token.

[0112] Correspondingly, the server receives a first query request sent by the target proxy service device, wherein the first query request is used to request a user identification corresponding to the first user token.

[0113] For example, combining the above analysis and Figure 4 After the target proxy node receives the proxy start request sent by the desktop, it can initiate a first query request carrying the first user token to the server.

[0114] S306: The server obtains a user identifier (ie, a query identifier) ​​corresponding to the first user token based on the first query request.

[0115] Exemplarily, a mapping relationship table between user tokens and user identifiers is stored in the server. Accordingly, when the server obtains the first user token, it can obtain the query identifier by querying the mapping relationship table.

[0116] S307: The server sends a query identifier to the target proxy service device.

[0117] Correspondingly, the target proxy service device receives the query identifier fed back by the server.

[0118] For example, combining the above analysis and Figure 4 ,After obtaining the query identifier, the server sends the query identifier to the target ,proxy node.

[0119] S308: If the query identifier is the same as the first user identifier, the target proxy service device sends verification pass information to the server.

[0120] Correspondingly, the server receives the verification pass information sent by the target proxy service device.

[0121] Exemplarily, after obtaining the query identifier, the target proxy node can compare the query identifier with the first user identifier to determine whether the two are consistent. That is, the target proxy node determines the consistency between the input parameter user ID it receives and the queried user ID. If the two are consistent, it means that the request to start the proxy is most likely a legitimate request rather than a stolen request. Therefore, the target service node sends a verification pass message to the service end.

[0122] Alternatively, the query identifier may be different from the first user identifier, and the request to start the proxy is likely to be illegal, such as a stolen request. Accordingly, the target service node can send a verification failure message to the server. This prevents illegal users from obtaining network proxy services. Of course, the target service node can also feedback an error code to the desktop to prompt the first user that the network proxy service cannot be obtained. The desktop can update the network proxy link status from "connecting" to "disconnected".

[0123] S309: The server provides a service of opening a network proxy based on the verification pass information.

[0124] Accordingly, the first user can obtain the service of opening the network proxy.

[0125] Combined with the above analysis of S301-S309, it can be seen that in this embodiment, the first user's legitimacy is verified by combining the interaction between the desktop, the target proxy node, and the server. If the legitimacy is verified, the server provides the first user with a service to enable the network proxy. Therefore, a more secure, reliable, and efficient network security solution is provided to the enterprise.

[0126] In other words, this specification provides a dynamic identity authentication mechanism. For example, through means such as user tokens, each proxy startup request is verified in real time to ensure that each network connection is carried out under strict security control. This mechanism not only improves the security of the network proxy system, but also effectively prevents external attacks. Therefore, a network proxy system that implements a zero-trust network structure can provide improved security and reliability in providing network proxy services.

[0127] Combined with the above analysis of S303 and S304, it can be seen that the client generates and sends a start proxy request to the target proxy service device, and the start proxy request includes a first user identifier and a first user token. In order to further achieve zero-trust secure proxy access to improve the security and reliability of network proxy services. In some embodiments, the client can encrypt the start proxy request. Accordingly, when the target proxy service device receives the encrypted start proxy request, it decrypts the encrypted start proxy request.

[0128] Exemplarily, the client may encrypt the first user token based on the current initiation time to obtain an encrypted proxy start request, and send the encrypted proxy start request to the target proxy service device.

[0129] For example, in combination with the above analysis, when the desktop needs to obtain the network proxy service and sends a request to start the proxy to the target proxy node, it obtains the current time (i.e., the initiation time, which may also be referred to as a timestamp). After the desktop concatenates the timestamp with the first user token, it obtains an encrypted string through an encryption algorithm. The desktop adds the encrypted string to the request header to obtain and send the encrypted request to start the proxy to the target proxy node. This embodiment does not limit the encryption algorithm.

[0130] Correspondingly, the target proxy service device decrypts the encrypted proxy start request to obtain the initiation time. The above S305 may include: if the time difference between the initiation time and the current time is less than a preset time threshold, initiating the first query request to the server.

[0131] The current time may be the time when the target service device receives the encrypted start proxy request, or the time when the target proxy service device decrypts to obtain the start time. The preset time threshold may be determined based on demand, historical records, experiments, etc., and is not limited in this embodiment.

[0132] Exemplarily, in combination with the above analysis, when the target proxy node receives the encrypted start proxy request, it first obtains the request header and decrypts the encrypted string in the request header to obtain the timestamp. The target proxy node then compares the timestamp with the current time to determine the difference between the two (i.e., the time difference). If the time difference is less than a preset time threshold (e.g., 10 seconds), the target proxy node sends a first query request to the server.

[0133] The time difference may also reach a preset time threshold. If the time difference reaches the preset time threshold, the proxy start request is likely to be a stolen request, and the target proxy node can reject the proxy start request initiated by the first user through the desktop to ensure secure access control to the enterprise intranet.

[0134] In this embodiment, the integrity and confidentiality of data during transmission can be ensured by encryption, so as to effectively prevent data from being eavesdropped, tampered with, and leaked.

[0135] In some embodiments, a prohibited list (also referred to as a blacklist) is stored in the target proxy service device. The target proxy service device may match the first user identifier with the prohibited list to obtain a first matching result. The above S305 may include: if the first matching result indicates that the prohibited list does not include the first user identifier, a first query request is initiated to the server.

[0136] Exemplarily, the disabled list includes user identifiers that cannot access the enterprise intranet. For example, the target proxy node stores user identifiers of illegal users. The illegal users here can be understood as users who cannot enjoy the network proxy service provided by the network proxy system. The target proxy node matches the first user identifier with the disabled user identifiers respectively to determine whether the first user identifier is included in the disabled list. Among them, the user identifiers in the disabled list can have time attributes. For example, the user identifiers in the disabled list have a prohibited access duration. After the prohibited access duration, the target proxy node can delete the user identifiers that exceed the prohibited access duration from the disabled list.

[0137] If the first user identifier is not included in the banned list, it means that the first user may be a user who can enjoy the network proxy service provided by the network proxy system. Therefore, the target proxy node can send a first query request to the server to continue to verify the legitimacy of the first user.

[0138] On the contrary, if the first user identifier is included in the disabled list, it means that the first user is a user who cannot enjoy the network proxy service provided by the network proxy system. Therefore, the target proxy node refuses to start the proxy request and does not need to continue to send the first query request to the server.

[0139] It is worth noting that the prohibited list in this embodiment can also be configured as a white list. The white list includes user identifiers that can enjoy the network proxy service provided by the network proxy system. The implementation principle can be found in the above example, and will not be repeated here.

[0140] In this embodiment, before verifying the legitimacy of the first user based on the first user token, the legitimacy of the first user is verified by first verifying the legitimacy of the first user in combination with the banned list, which can enhance the effectiveness and reliability of the verification.

[0141] In some embodiments, the specification may also introduce fine-grained access control strategies, such as the network proxy system may perform access control at a fine-grained level to further improve the effectiveness and reliability of the network proxy service provided by the network proxy system.

[0142] Exemplarily, in combination with the above analysis, the target proxy service device determines the consistency between the query identifier and the first user identifier. If the query identifier is the same as the first user identifier, the target proxy service device initiates a second query request to the server to query the attribute information of the first user.

[0143] Correspondingly, the server obtains a second query request initiated by the target proxy service device. The server obtains the attribute information of the first user (i.e., the target attribute information) and sends the target attribute information to the target proxy service device. The target attribute information includes at least one of target shift information, target role information, and target authority information.

[0144] Correspondingly, the target proxy service device receives the target attribute information sent by the server. The target proxy service device verifies the first user based on the target attribute information and obtains a first verification result. The above S308 "the target proxy service device sends verification pass information to the server" may include: if the first verification result indicates that the first user has passed the verification, then sending verification pass information to the server.

[0145] Exemplarily, in combination with the above analysis, the target proxy node may send a second query request to the server, and the second query request may carry the first user identifier. The server stores a mapping relationship table between user identifiers and attribute information. The server may query the mapping relationship table based on the first user identifier to obtain and send target attribute information to the target proxy node. The target proxy node verifies whether the first user can enjoy the network proxy service based on the target attribute information. If the target attribute information is one type, then if the first user passes the verification of the target attribute information, the target proxy node sends verification pass information to the client. If the target attribute information is multiple types, then if the first user passes various target attribute information verifications, the target proxy node sends verification pass information to the client.

[0146] Take the target attribute information including the target shift information as an example:

[0147] The target proxy node compares the shift time indicated by the target shift information with the current time to determine whether the current time is within the shift time. If yes, it means that the first user has passed the verification from the perspective of the shift. Otherwise, it means that the first user has not passed the verification from the perspective of the shift and cannot enjoy the network proxy service at the current time.

[0148] Take the target attribute information including the target role information as an example:

[0149] The proxy initiation request may carry the role information of the first user (for ease of distinction, it may be referred to as the first user role), or the target proxy node may determine the role information of the first user based on the first user identifier or the first user token (similarly, it may be referred to as the first user role). The target proxy node compares the first user role with the target role information to determine whether the role indicated by the target role information includes the first user role. If so, it means that from the dimension of role, the first user has passed the verification. On the contrary, if not, it means that from the dimension of role, the first user has not passed the verification and cannot enjoy the network proxy service.

[0150] For understanding of target attribute information including target permission information, please refer to the above description of target attribute information including target role information, which will not be repeated here.

[0151] It is worth noting that the target attribute information may also include attribute information of other granularity controls. This specification is only illustrative of shifts, roles, and permissions as examples, and cannot be understood as a limitation on the target attribute information. In this embodiment, by introducing the fine-grained access control strategy of the target attribute information as above, it supports dynamic adjustment of resource access attributes (such as permissions and roles, etc.) and implements the minimum granularity principle (such as the principle of least authority). This refined control method ensures that the enterprise intranet is as safe as possible under different circumstances.

[0152] In some embodiments, the target proxy service device is any proxy service device in a distributed system. The distributed system includes multiple proxy service devices and a load balancing device in communication with the multiple proxy service devices. The start proxy request is allocated to the target proxy service device by the load balancing device.

[0153] For example, Figure 5 As shown, the number of users is n, one user corresponds to one desktop, and n is an integer greater than 1. The distributed system includes a load balancing device and m proxy nodes, each proxy node is connected to the load balancing device for communication, and m is an integer greater than 1.

[0154] The load balancing device may obtain the request to start the proxy sent by n users. If proxy node 1 is the target proxy node in the above example, and the load balancing device assigns the request to start the proxy of user 1 to proxy node 1 based on the load balancing strategy, then user 1 is the first user in the above example. Accordingly, proxy node 1, desktop terminal 1, and server terminal can determine whether to start the proxy service for user 1 based on the above interaction logic.

[0155] In this embodiment, the network proxy system is deployed based on a distributed system, which can make the network proxy system have higher disaster tolerance and scalability, and can meet the needs of enterprises of different sizes. In addition, providing network proxy services based on a distributed system can effectively handle high concurrent requests and reduce performance bottlenecks.

[0156] In some embodiments, the target proxy service device includes an APISIX proxy server and a client gateway. The target proxy service device is deployed on an intranet server of a target enterprise to provide network proxy services to users of the target enterprise.

[0157] For example, Figure 4As shown, the target proxy node includes an APISIX proxy server based on NGiNX and a client gateway afclientproxy. The APISIX proxy server can send the start proxy request sent by the desktop to the client gateway afclientproxy, so that the client gateway afclientproxy interacts with the server, obtains the query identifier, and compares the query identifier with the first user identifier.

[0158] Among them, the target proxy service device can be deployed in the enterprise intranet. Specifically, the APISIX proxy server can be deployed on the enterprise's intranet server. Relatively speaking, this deployment greatly reduces the interference with the enterprise's existing network architecture and can quickly achieve seamless integration. The client gateway afclientproxy can be deployed in the cloud so that different enterprises can share computing resources. Of course, it is also possible to provide enterprises with a private client gateway afclientproxy deployment solution based on their needs to achieve physical isolation of the network and data.

[0159] It is worth noting that the above examples are only used to illustrate the possible proxy servers and client gateways, and cannot be understood as limiting the proxy servers and client gateways. For example, the APISIX proxy server can also be a reverse proxy and load balancer Traefik.

[0160] In some embodiments, the target proxy service device includes a preset cache, and the preset cache stores a user token corresponding to a verified user identifier. Combined with the above analysis, after obtaining the query identifier, the target proxy service device compares the query identifier with the first user. If the first user identifier is the same as the query identifier, the target proxy service device adds the first user token to the preset cache to update the preset cache. The updated preset cache is used to determine whether the user can perform proxy access.

[0161] The network proxy solution provided in this specification incorporates a cache mechanism, which is used to store frequently accessed data, authentication information, configuration files, etc., to improve the response speed and overall efficiency of the network proxy system.

[0162] Combined with the above analysis, it can be known that different users may correspond to different shift information. Accordingly, the user token may have time validity. Exemplarily, after the target proxy service device adds the first user token to the preset cache, as time passes, the time has exceeded the shift time period represented by the shift information, and the target proxy service device deletes the first user token from the preset cache. This allows the preset cache to store valid user tokens, thereby improving the effectiveness and reliability of the network proxy system in providing network proxy services to enterprises.

[0163] That is to say, the network proxy method provided in this specification can be divided into two stages, the first stage is the proxy startup stage, and the second stage is the proxy access stage. The above example mainly explains the technical solution of the first stage. In the first stage, for example, if the target proxy node determines that the first user identifier is consistent with the query identifier, it means that the service of starting the network proxy can be provided to the first user. And the target proxy node can update the preset cache based on the first user token, such as adding the first user token to the preset cache. Among them, the preset cache can be used for user verification in the second stage.

[0164] Now combined Figure 7 The technical solution for the second phase is described, such as Figure 7 As shown, the method includes:

[0165] S701: The client initiates a proxy access request of a second user to a target proxy service device, wherein the proxy access request includes a token of the second user.

[0166] Correspondingly, the target proxy service device receives the proxy access request from the second user initiated by the client.

[0167] It is worth noting that the second user can be the first user or other users, and this embodiment does not limit this. Taking the second user as the first user as an example, combined with the above analysis, the server determines that it can provide the first user with a service for starting a network proxy when obtaining the verification pass information. The server can send a prompt message to the desktop. Based on the prompt message, the first user can continue to perform corresponding operations on the desktop to initiate a proxy access request to the target proxy service device.

[0168] S702: The target proxy service device matches the second user token with the preset cache to obtain a second matching result.

[0169] Exemplarily, in combination with the above analysis, a user token whose user identifier is consistent with the identifier obtained by the query is stored in the preset cache. That is, a user token that passes the legitimacy check is stored in the preset cache. The target proxy node compares the second user token with the user token in the preset cache to determine whether there is a user token in the preset cache that is the same as the second user token.

[0170] S703: If the second matching result indicates that the preset cache includes the second user token, the target proxy service device provides the second user with a proxy access service corresponding to the proxy access request through the server.

[0171] In combination with the above example, the target proxy node compares the second user token with the user token in the preset cache, and may obtain a user token in the preset cache that is the same as the second user token. That is, the preset cache includes the second user token. In this case, the target proxy node can send corresponding feedback information to the server. The server can provide proxy access service for the second user based on the feedback information.

[0172] For example, if the second user is the first user, the first user token and the second user token are the same token. In combination with the above example, the preset cache includes the first user token of the first user. When the second user token is matched with the preset cache, it can be determined that the preset cache includes the second user token, and the target proxy service device provides the proxy access service corresponding to the proxy access request to the second user through the server.

[0173] Combined with the above analysis, it can be known that the target proxy service device is any proxy service device in the distributed system. Each proxy service device has its own corresponding cache, such as the target proxy service device has a preset cache. Among them, the distributed system has a total cache, which stores the user tokens stored in each cache.

[0174] Correspondingly, if the second matching result indicates that the preset cache does not include the second user token, the second user token is matched with the total cache to obtain a third matching result. If the third matching result indicates that the total cache includes the second user token, a proxy access service corresponding to the proxy access request is provided to the second user through the server.

[0175] Exemplary, combined Figure 6As shown, the target proxy node is proxy node 1, and the preset cache is the cache in proxy node 1. Proxy node 1 first matches the second user token with the cache in proxy node 1 to determine whether the second user token is included in the cache of proxy node 1. If not, proxy node 1 matches the second user token with the total cache of the distributed system to determine whether the second user token is included in the total cache.

[0176] In some embodiments, the proxy access request includes a target domain name. The target proxy node can verify the target domain name to obtain a second verification result. S702 includes: if the second verification result indicates that the target domain name passes the verification, the second user token is matched with the preset cache to obtain a second matching result.

[0177] Exemplarily, the proxy access request includes the domain name of the website that the second user wants to access (i.e., the target domain name). The target proxy node may store a list of domain names that the network proxy service supports access to. The target proxy node may compare the target domain name with the domain name list to verify the target domain name.

[0178] If the target domain name is included in the domain name list, the second verification result indicates that the target domain name has passed the verification, and the target proxy node performs an operation of matching the second user token with the preset cache. Conversely, if the target domain name is not included in the domain name list, the second verification result indicates that the target domain name has not passed the verification, that is, the target domain name is a domain name that the network proxy service does not support access to. The target proxy node can feedback an error prompt information to the desktop to prompt the second user that the URL corresponding to the target domain name cannot be accessed.

[0179] Combined with the analysis of the technical solution for the first phase, it can be known that a banned list can be stored in the target proxy service device. Accordingly, in the second phase, in some embodiments, when the target proxy service device performs a legitimacy check on the target domain name and the second check result indicates that the target domain name passes the check, the target proxy service device can perform a legitimacy check on the second user based on the banned list.

[0180] Exemplarily, the proxy access request includes a second user identifier of the second user. The target proxy service device compares the second user identifier with the user identifiers in the disabled list to determine whether the disabled list includes the second user identifier.

[0181] If the second user identifier is included in the banned list, it means that the second user has not passed the legality check based on the banned list. The target proxy node can feedback error prompt information to the desktop to prompt the second user that the website corresponding to the target domain name cannot be accessed.

[0182] On the contrary, if the banned list does not include the second user identifier, it means that the second user has passed the legality check based on the banned list. The target proxy node performs an operation of matching the second user token with the preset cache.

[0183] In some embodiments, if the second user fails any of the above-mentioned legitimacy checks in the second stage, the logic of the legitimacy check of the first user in the above-mentioned first stage may be executed, such as the target proxy node initiating a first query to the server, etc. The specific implementation principle can be found above and will not be repeated here.

[0184] It is worth noting that the above examples are only used to illustrate the possible implementation methods of the network proxy method of this specification, and cannot be understood as limiting the implementation methods of the network proxy method of this specification. For example, based on the above technical concept, some of the above technical features can be combined to obtain a new embodiment; new technical features can be added on the basis of the above examples to obtain a new embodiment; some technical features can be reduced on the basis of the above examples to obtain a new embodiment; some technical features in the above examples can be replaced with other technical features; some technical features and the order of the above examples can be adjusted to obtain a new embodiment, etc., which will not be listed here one by one.

[0185] It should be noted that the collection, storage, use, processing, transmission, provision and disclosure of relevant user information (such as account number, password, attribute information, etc.) involved in the technical solution of this specification are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0186] The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require a specific order or a continuous order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0187] In summary, after reading this detailed disclosure, those skilled in the art will appreciate that the foregoing detailed disclosure may be presented only by way of example and may not be limiting. Although not explicitly stated herein, those skilled in the art will appreciate that this specification requires various reasonable changes, improvements and modifications to the embodiments. These changes, improvements and modifications are intended to be proposed by this specification and are within the spirit and scope of the exemplary embodiments of this specification.

[0188] In addition, certain terms in this specification have been used to describe embodiments of this specification. For example, "one embodiment", "an embodiment" and / or "some embodiments" mean that a particular feature, structure or characteristic described in conjunction with the embodiment may be included in at least one embodiment of this specification. Therefore, it can be emphasized and should be understood that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various parts of this specification do not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics may be appropriately combined in one or more embodiments of this specification.

[0189] It should be understood that in the foregoing description of the embodiments of this specification, in order to help understand a feature and for the purpose of simplifying this specification, this specification combines various features in a single embodiment, figure or its description. However, this does not mean that the combination of these features is necessary. When reading this specification, it is entirely possible for a person skilled in the art to mark out some of the devices as separate embodiments. In other words, the embodiments in this specification can also be understood as the integration of multiple secondary embodiments. And the content of each secondary embodiment is also valid when it is less than all the features of a single aforementioned disclosed embodiment.

[0190] Each patent, patent application, publication of patent applications, and other materials, such as articles, books, specifications, publications, documents, articles, etc., cited herein, except to the extent that it is inconsistent or conflicting with this document or that has a limiting effect on the broadest scope of the claims, may be incorporated herein by reference and used for all purposes now or hereafter associated with this document. In addition, in the event of any inconsistency or conflict between the description, definition, and / or use of a term in any material and the description, definition, and / or use of a term in this document, the term in this document shall prevail.

[0191] Finally, it should be understood that the embodiments of the application disclosed herein are explanations of the principles of the embodiments of this specification. Other modified embodiments are also within the scope of this specification. Therefore, the embodiments disclosed in this specification are only used as examples and not as limitations. Those skilled in the art can adopt alternative configurations according to the embodiments in this specification to implement the applications in this specification. Therefore, the embodiments of this specification are not limited to the embodiments accurately described in the application.

Claims

1. A network proxy method, applied to a target proxy service device, comprising: Receiving a proxy start request initiated by a first user through a client, wherein the proxy start request includes a first user identifier and a first user token, and the first user token is obtained by the client from a server based on a login request; Initiating a first query request to the server for a user identifier corresponding to the first user token, and receiving a query identifier fed back by the server in response to the first query request; and If the first user identifier is the same as the query identifier, verification pass information is sent to the server so that the server provides a service of starting a network proxy based on the verification pass information.

2. The method according to claim 1, wherein: The proxy start request is encrypted by the client based on the initiation time when the proxy start request is initiated; the method further includes: Decrypting the proxy start request to obtain the initiation time; And, the first query request initiated to the server for querying the user identifier corresponding to the first user token includes: if the time difference between the initiation time and the current time is less than a preset time threshold, initiating the first query request to the server.

3. The method according to claim 1, wherein: The target proxy service device stores a banned list; The method further comprises: Matching the first user identifier with the banned list to obtain a first matching result; And, the initiating a first query request to the server for a user identifier corresponding to the first user token includes: if the first matching result indicates that the prohibited list does not include the first user identifier, initiating the first query request to the server.

4. The method according to claim 1, wherein: If the first user identifier is the same as the query identifier, the method further includes: Initiating a second query request to the server for querying the attribute information of the first user, and receiving target attribute information fed back by the server in response to the second query request, wherein the target attribute information includes at least one of target shift information, target role information, and target authority information; Verifying the first user based on the target attribute information to obtain a first verification result; And, sending verification pass information to the server includes: if the first verification result indicates that the first user has passed the verification, sending the verification pass information to the server.

5. The method according to claim 1, wherein: The target proxy service device includes a preset cache, and the preset cache stores a user token corresponding to a verified user identifier; the method further includes: If the first user identifier is the same as the query identifier, the first user token is added to the preset cache to update the preset cache.

6. The method according to claim 5, wherein: The method further comprises: Receiving a proxy access request initiated by a second user through the client, wherein the proxy access request includes a second user token; Matching the second user token with the preset cache to obtain a second matching result; If the second matching result indicates that the preset cache includes the second user token, a proxy access service corresponding to the proxy access request is provided to the second user through the server.

7. The method according to claim 6, wherein: The proxy access request carries a target domain name, and the method further includes: Verifying the target domain name to obtain a second verification result; And, matching the second user token with the preset cache to obtain a second matching result includes: if the second verification result indicates that the target domain name passes the verification, matching the second user token with the preset cache to obtain the second matching result.

8. The method according to claim 6, wherein: The target proxy service device is any proxy service device in a distributed system, wherein the distributed system includes a plurality of proxy service devices and a load balancing device in communication with the plurality of proxy service devices, and the start proxy request is allocated to the target proxy service device by the load balancing device; The target proxy service device includes an APISIX proxy server and a client gateway. The target proxy service device is deployed on the intranet server of the target enterprise to provide network proxy services to the target enterprise.

9. The method according to claim 8, wherein: Each proxy service device has its own corresponding cache, and the distributed system has a total cache, and the total cache includes the user token stored in each cache; the method also includes: If the second matching result indicates that the preset cache does not include the second user token, matching the second user token with the total cache to obtain a third matching result; And, providing the proxy access service corresponding to the proxy access request to the second user through the server includes: if the third matching result indicates that the total cache includes the second user token, providing the proxy access service corresponding to the proxy access request to the second user through the server.

10. A network proxy method, applied to a server, comprising: Verifying a login request initiated by the first user through the client; If the login request is verified successfully, the first user token is fed back to the client; Receiving a first query request initiated by a target proxy service device to query a user identifier corresponding to the first user token, wherein the first query request is initiated by the target proxy service device after receiving a proxy start request initiated by the first user through the client and based on the first user token in the proxy start request; Feedback a query identifier corresponding to the first query request to the target proxy service device; receiving verification pass information sent by the target proxy service device, wherein the verification pass information is determined by the target proxy service device comparing the query identifier with the first user identifier in the proxy start request, and the query identifier and the first user identifier are identical; and The network proxy activation service is provided to the first user according to the verification pass information.

11. The method according to claim 10, wherein: The method further comprises: receiving a second query request initiated by the target proxy service device to query the attribute information of the first user; Feedback target attribute information to the target proxy service device, wherein the target attribute information includes at least one of target shift information, target role information, and target authority information, and the target attribute information is used to verify the first user; The verification pass information is received by the first user through verification based on the target attribute information.

12. A network proxy method, applied to a client, comprising: Initiate a login request of the first user to the server; Receiving a first user token sent by the server when the login request is verified successfully; Initiating a proxy start request to a target proxy service device, wherein the proxy start request includes a first user identifier and a first user token, the first user token is used by the target proxy service device to query the server to obtain a query identifier corresponding to the first user token, and the query identifier is used to compare with the first user identifier; and A network proxy activation service provided by the server for the first user is received, wherein the network proxy activation service is determined when the query identifier and the first user identifier are identical.

13. The method according to claim 12, wherein: The initiating a proxy start request to the target proxy service device includes: Encrypting the first user token based on the current initiation time to obtain the initiation proxy request; Among them, when the proxy startup request is decrypted by the target proxy service device to obtain the initiation time, and the time difference between the initiation time and the decrypted current time is less than a preset time threshold, the target proxy service device obtains the query identifier by querying from the server based on the first user token.

14. An agent service device, comprising: at least one storage medium storing at least one instruction set to perform network proxying; At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, the at least one instruction set is read, and the method as described in any one of claims 1 to 9 is executed according to the instructions of the at least one instruction set.

15. A server, comprising: at least one storage medium storing at least one instruction set to perform network proxying; At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, the at least one instruction set is read and the method as claimed in claim 10 or 11 is executed according to the instructions of the at least one instruction set.

16. A client, comprising: at least one storage medium storing at least one instruction set to perform network proxying; At least one processor is communicatively connected to the at least one storage medium, wherein when the at least one processor is running, the at least one instruction set is read and the method as claimed in claim 12 or 13 is executed according to the instructions of the at least one instruction set.

17. A network proxy system, comprising: The proxy service device as claimed in claim 14; The server as claimed in claim 15; The client as claimed in claim 16.

Images