Intranet access system and method, electronic equipment and storage medium

Abstract

The invention relates to an intranet access system and method, electronic equipment and a storage medium, and the system comprises a redirection service module which is used for receiving an intranet application access request sent by a client from an extranet, and controlling the client to send a first redirection request to an extranet access assistant service module; the extranet access assistant service module is used for converting the intranet address into a WebVPN access address, returning the WebVPN access address to the client, controlling the client to send a WebVPN login request to the WebVPN service module, and controlling the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; and the WebVPN service module is used for sending the intranet application access request to the intranet application system indicated by the WebVPN access request. Therefore, the user can automatically jump to access the intranet application system after logging in for one time, the user operation is simplified, and the user experience is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network communication technology, and in particular to an intranet access system and method, an electronic device and a storage medium. Background Art

[0002] The various administrative departments of colleges and universities have built different information systems to provide hundreds of campus application systems for campus management and service business requirements. Teachers and students access and use these systems through clients such as browsers. For security reasons, some of these campus application systems require that the user's IP (Internet Protocol) address must be the IP address of the internal network when the user accesses the information system, that is, the application system is restricted to be accessible only to the internal network. However, users have the need to access the intranet application system from the external network environment. How to allow users to conveniently use browsers and other clients to access the intranet application system from the external network has become an important issue.

[0003] At present, there are two main ways to access the intranet application system from the external network: the first way is to sign a contract with the network operator to pull a dedicated VPN (Virtual Private Network) network from the public network to the internal network, and then the user logs in to the campus network account on the network operation service to bind the network operator's account and the campus account. After binding, when the user uses the operator's external network to access the application system that restricts internal network access, the network traffic of the external network enters the campus through the previously laid dedicated VPN network. That is, when the user uses the network of the network operator, if the user has bound the campus account, the traffic to access all campus network application systems will go through the VPN network. However, this method has the problem of not being able to use the network that does not bind the mobile phone number when binding the campus account through the network operator. For example, when the user is connected to the Wi-Fi Internet in public places such as restaurants, this solution does not support accessing the application system that restricts internal network access from the external network. For example, it cannot be used when the user is abroad, and it cannot meet the needs of the university to frequently communicate with foreign personnel.

[0004] The second method is to use the WebVPN service (a web-based intranet application access control service system). When a user accesses the URL (Uniform Resource Locator) of an intranet application system from an external network, the user is redirected to a prompt page of the WebVPN service, which prompts the user that the external network cannot directly access the system and guides the user to log in to the WebVPN service. Next, the user needs to access the URL address of the WebVPN service and log in to the WebVPN service. After logging in to the WebVPN service, the user clicks or enters the URL address of a certain intranet application system in the WebVPN service to access the intranet application system. However, in this method, the WebVPN service does not automatically jump to the function of the intranet application system that the user wants to access, but requires the user to manually enter or click on a link to a certain application system from a pre-stored application system list, which makes the user operation cumbersome and the user experience poor. Summary of the invention

[0005] In view of this, the present disclosure proposes an intranet access system and method, an electronic device and a storage medium, which can enable users to automatically jump to access the intranet application system after logging in once, simplifying user operations and improving user experience.

[0006] According to one aspect of the present disclosure, an intranet access system is provided, comprising: a redirection service module, an extranet access assistant service module, and a web-based virtual private network WebVPN service module; the redirection service module is used to control the client to send a first redirection request to the extranet access assistant service module in response to receiving an intranet application access request sent by the client from the extranet, wherein the first redirection request carries the intranet address of the intranet application access request; the extranet access assistant service module is used to save the intranet address carried in the first redirection request in response to receiving the first redirection request, and, when a user account has logged into the extranet access assistant service module, convert the intranet address into an intranet application system indicated by the intranet address entered by the WebVPN service module The method further comprises: providing a WebVPN access address, returning the WebVPN access address to the client, controlling the client to send a WebVPN login request to the WebVPN service module so that the user account logs in to the WebVPN service module; and, if the user account has logged in to the WebVPN service module, controlling the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; the WebVPN service module is used to, in response to receiving the WebVPN access request, send an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0007] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; wherein the external network access assistant service module is further configured to detect, in response to receiving the first redirection request, whether the user account corresponding to the first redirection request is logged in to the external network access assistant service module, and, if the user account is not logged in to the external network access assistant service module, control the client to send a single sign-on request to the identity authentication service module; the identity authentication service module is configured to return a login page to the client in response to receiving the single sign-on request, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; and after the user account completes the single sign-on In the case of point login, it is recorded that the user account has logged in to the identity authentication service module, and the first service ticket and session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module is also used to verify the user account to the identity authentication service module based on the first service ticket in response to receiving the second redirection request, and in the case of successful user account verification, record that the user account has logged in to the external network access assistant service module.

[0008] In a possible implementation, the WebVPN service module is further configured to, in response to receiving the WebVPN login request, send a response to the WebVPN login request to the redirection service module; the redirection service module is further configured to add a cross-domain access attribute in a response header of the WebVPN login request, and return the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, the third redirection request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; the identity authentication service module is further configured to, in response to receiving the third redirection request and determining that the user account has logged in to the identity authentication service module based on the session identifier in the third redirection request, return a response to the third redirection request to the redirection service module, the response to the third redirection request including a second service ticket; the redirection service module is further configured to add a cross-domain access attribute in a response header of the third redirection request, and return the response of the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, the third redirection request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The response of the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, and the fourth redirection request carries the second service ticket; the WebVPN service module is also used to verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request in response to receiving the fourth redirection request, and if the user account verification is successful, record that the user account has logged in to the WebVPN service module, and return a response to the fourth redirection request to the redirection service module, and the response to the fourth redirection request includes a notification that the user account has logged in to the WebVPN service module; the redirection service module is also used to add a cross-domain access attribute to the response header of the fourth redirection request, and return the response of the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0009] In one possible implementation, the cross-domain access attribute is used to allow a login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate a domain name for which cross-domain access is allowed, a second attribute is used to indicate whether authentication credentials are allowed to be sent during cross-domain access, a third attribute is used to indicate an access method allowed for cross-domain access, and a fourth attribute is used to indicate a header information field allowed to be carried during cross-domain access.

[0010] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the redirection service module is also used to respond to receiving an intranet application access request sent by a client in the intranet, and forward the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0011] According to another aspect of the present disclosure, an intranet access method is provided, which is applied to an intranet access system, wherein the system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network WebVPN service module, wherein the method includes: in response to receiving an intranet application access request sent by a client from an extranet, the redirection service module controls the client to send a first redirection request to the extranet access assistant service module, wherein the first redirection request carries the intranet address of the intranet application access request; in response to receiving the first redirection request, the extranet access assistant service module saves the intranet address carried in the first redirection request, and, when a user account has logged in to the extranet access assistant service module, converts the intranet address into a URL indicated by the WebVPN service module when entering the intranet address. The method further comprises: determining a WebVPN access address of an intranet application system indicated by the WebVPN access address, returning the WebVPN access address to the client, and controlling the client to send a WebVPN login request to the WebVPN service module so that the user account logs in to the WebVPN service module; and, if the user account has logged in to the WebVPN service module, controlling the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; in response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0012] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; the method further includes: the external network access assistant service module, in response to receiving the first redirection request, detecting whether the user account corresponding to the first redirection request is logged into the external network access assistant service module, and, if the user account is not logged into the external network access assistant service module, controlling the client to send a single sign-on request to the identity authentication service module; the identity authentication service module, in response to receiving the single sign-on request, returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; after the user account is completed In the case of single sign-on, the user account is recorded to have logged in to the identity authentication service module, a first service ticket and a session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module responds to receiving the second redirection request, verifies the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged in to the external network access assistant service module.

[0013] In a possible implementation, the method further includes: in response to receiving the WebVPN login request, the WebVPN service module returns a response to the WebVPN login request to the redirect service module; the redirect service module adds a cross-domain access attribute in a response header of the WebVPN login request, and returns the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; in response to receiving the third redirect request and determining that the user account has logged in to the identity authentication service module based on the session identifier in the third redirect request, the identity authentication service module returns a response to the third redirect request to the redirect service module, the response to the third redirect request includes a second service ticket; the redirect service module adds a cross-domain access attribute in a response header of the third redirect request, and returns the response of the third redirect request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The response of the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, and the fourth redirection request carries the second service ticket; in response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, records that the user account has logged in to the WebVPN service module, and returns a response to the fourth redirection request to the redirection service module, and the response to the fourth redirection request includes a notification that the user account has logged in to the WebVPN service module; the redirection service module adds a cross-domain access attribute to the response header of the fourth redirection request, and returns the response of the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0014] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the method also includes: the redirection service module, in response to receiving an intranet application access request sent by a client in the intranet, forwards the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0015] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0016] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0018] According to various aspects of the present disclosure, by utilizing the redirection service module, the external network access assistant service module, the identity authentication service module, and the WebVPN service module, a user only needs to enter the intranet address of the intranet application system once when he wants to access the intranet application system from an external network. After logging into the external network access assistant service module, the user can automatically log into the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on a link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0019] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0021] Figure 1 A block diagram of an intranet access system according to an embodiment of the present disclosure is shown.

[0022] Figure 2 A block diagram of another intranet access system according to an embodiment of the present disclosure is shown.

[0023] Figure 3 A schematic diagram showing an intranet access process according to an embodiment of the present disclosure.

[0024] Figure 4 A schematic diagram showing another intranet access process according to an embodiment of the present disclosure.

[0025] Figure 5 A flow chart of an intranet access method according to an embodiment of the present disclosure is shown.

[0026] Figure 6 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0028] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0029] The term "and / or" herein is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent any one or more elements selected from the set consisting of A, B, and C. In the description of the present disclosure, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0030] It should be understood that the terms "first", "second", etc. in the claims, specifications and drawings of the present disclosure are used to distinguish different objects rather than to describe a specific order. The terms "include" and "comprise" used in the specifications and claims of the present disclosure indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections.

[0031] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0032] As described above, the existing method of using WebVPN service for intranet access makes the user operation cumbersome and the user experience is poor. In view of this, the embodiment of the present disclosure provides an intranet access system, which adds the functions of automatic login and conversion of intranet addresses on the basis of WebVPN service, but does not change the application of WebVPN service itself, so that users can conveniently access the intranet application system on the external network. Specifically, when the user uses a browser or other client to access the URL address of the intranet application system on the external network, the intranet application access request initiated by the client from the external network is first redirected to the external network access assistant service module, and the original intranet address (i.e., URL address) of the internal application system is attached. Then the user performs a single sign-on, and after the login is successful, the content of the intranet application system can be automatically accessed through the WebVPN service module.

[0033] The following Figures 1 to 4 The intranet access system provided by the embodiment of the present disclosure is introduced in detail.

[0034] Figure 1 FIG. 1 is a block diagram of an intranet access system according to an embodiment of the present disclosure. Figure 1 As shown, the intranet access system includes:

[0035] Redirection service module 101, external network access assistant service module 102 and web-based virtual private network WebVPN service module 103;

[0036] The redirection service module 101 is used to control the client to send a first redirection request to the external network access assistant service module 102 in response to receiving an internal network application access request sent by the client from the external network, where the first redirection request carries the internal network address of the internal network application access request;

[0037] The external network access assistant service module 102 is used to save the intranet address carried in the first redirection request in response to receiving the first redirection request, and, if the user account has logged in to the external network access assistant service module 102, convert the intranet address into a WebVPN access address of the intranet application system indicated by the WebVPN service module 103 entering the intranet address, return the WebVPN access address to the client, and control the client to send a WebVPN login request to the WebVPN service module 103 so that the user account logs in to the WebVPN service module 103; and, if the user account has logged in to the WebVPN service module 103, control the client to send a WebVPN access request to the WebVPN service module 103 based on the WebVPN access address;

[0038] The WebVPN service module 103 is used to send an intranet application access request to the intranet application system indicated by the WebVPN access request in response to receiving the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module 103.

[0039] In actual applications, the client can be an independent browser, an application with a built-in browser (such as an application using WebView), a plug-in, a component, etc. that can open a web page, and the embodiments of the present disclosure are not limited to this. It should be understood that when a user accesses an intranet system application, the intranet address (such as a URL address) of the intranet application system can be entered or selected in the client, and the client (such as a browser) will send an intranet application access request to the intranet based on the intranet address.

[0040] Since there are usually multiple application systems in the internal network that are not allowed to be accessed from the external network (i.e., multiple internal network application systems), a redirection service module 101 can be provided in the internal network. The redirection service module is used to uniformly receive internal network application access requests, and determine whether the internal network application access requests are sent from the external network or from the internal network, so as to redirect the internal network application access requests sent from the external network to the external network access assistant service module 102, and can also forward the internal network application access requests sent from the internal network to the corresponding internal network application system. That is, the above-mentioned redirection service module 101 is also used to respond to the receipt of the internal network application access request sent by the client in the internal network, and forward the internal network application access request to the internal network application system indicated by the internal network application access request, so that the internal network application system responds to the internal network application access request and returns the response result to the client. For example, if a user wants to access a score query system that restricts external network access in the intranet to query scores, the user can enter the URL address of the score query system in the browser, and the browser sends a corresponding intranet application access request to the intranet. The redirection service module 101 receives the intranet application access request and determines that the intranet application access request is a request sent in the intranet. It can then forward the intranet application access request to the score query system, and the score query system responds to the intranet application access request, for example, by returning to the login page of the score query system. After logging into the score query system, the user can perform score query operations in the score query system.

[0041] It should be understood that different intranet application systems have different functional services, and different intranet application access requests can be sent to any intranet application system. The embodiments of the present disclosure do not limit the specific content of the intranet application access request and the functional services of the intranet application system accessed by the intranet application access request.

[0042] In actual applications, the redirection service module 101 can adopt a load balancing service or a reverse proxy service. Those skilled in the art can adopt load balancing technology or reverse proxy technology known in the art to implement the above functions required for the redirection service module 101. The redirection service module can adopt a software module or a hardware module or a combination of software and hardware, and the embodiments of the present disclosure do not limit this.

[0043] Among them, the redirection service module 101 can determine whether the intranet application access request is sent from the external network or the intranet based on the IP address corresponding to the received intranet application access request. Among them, the redirection service module 101 can pre-store the intranet IP address segment that allows direct access. When the redirection service module 101 receives an intranet application access request sent by any client, it can determine whether the IP address of the user terminal where the client that initiates the intranet application access request is located is in the intranet IP address segment. If it is not in the intranet IP address segment, it is considered that the intranet application access request is sent from the external network. Otherwise, it is considered that the intranet application access request is sent from the intranet.

[0044] Among them, when it is determined that the intranet application access request is sent from the external network, it can be automatically redirected to the external network access assistant service module, and the original intranet address of the intranet application system accessed by the intranet application access request is also passed to the external network access assistant service module as a parameter. For example, assuming that the domain name of the intranet application system to be accessed by the intranet application access request is business.company.com, and the domain name of the external network access assistant service module is guide.company.com, when the intranet address of the intranet application access request sent by the client is https: / / business.company.com / path, and the redirection service module 101 detects that the intranet application access request is a request sent from the external network and the domain name is restricted for internal access, then the intranet application access request can be redirected to the external network access assistant service module, that is, the following redirection address can be returned to the client: https: / / guide.company.com / index? previous_url=https: / / business.company.com / path, the client can send a first redirection request to the external network access assistant service module 102 based on the above redirection address, and the first redirection request carries the intranet address "https: / / business.company.com / path" of the intranet application access request.

[0045] After receiving the above-mentioned first redirection request, the external network access assistant service module 102 can save the intranet address carried in the first redirection request, and detect whether the user account corresponding to the first redirection request has logged in to the external network access assistant service module 102. If the user account has not logged in to the external network access assistant service module 102, the login process of the external network access assistant service module 102 is executed to enable the user account to log in to the external network access assistant service module 102.

[0046] Therefore, in order to realize the user account login system, such as Figure 2 As shown, the system further includes an identity authentication service module 104 for single sign-on of a user account; it should be understood that when a user accesses an external network through a client, the access traffic first passes through the redirection service module 101, and then the traffic is forwarded to the external access assistant service module 102, the WebVPN service module 103, the identity authentication service module 104 and the intranet application system. Among them, the external access assistant service module 102, the WebVPN service module 103 and the identity authentication service module 104 are visible to the external network, and the intranet application system is only visible to the internal network.

[0047] Based on this, the external network access assistant service module 102 is also used to detect whether the user account corresponding to the first redirection request is logged in to the external network access assistant service module 102 in response to receiving the first redirection request, and control the client to send a single sign-on request to the identity authentication service module when the user account is not logged in to the external network access assistant service module;

[0048] The identity authentication service module 104 is used to return a login page to the client in response to receiving a single sign-on request, so that the user completes the single sign-on of the user account in the identity authentication service module 104 based on the login page; when the user account completes the single sign-on, it records that the user account has logged in to the identity authentication service module, returns the first service ticket and the session identifier to the client, and controls the client to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module 104;

[0049] The external network access assistant service module 102 is also used to verify the user account to the identity authentication service module based on the first service ticket in response to receiving the second redirection request, and if the user account verification is successful, record that the user account has logged in to the external network access assistant service module.

[0050] Among them, the external network access assistant service module 102 detects whether the user account corresponding to the first redirection request is logged in to the external network access assistant service module 102. It can be to detect whether the first redirection request carries the identity authentication credentials (in the form of browser cookies) assigned after the external network access assistant service module 102 verifies that the service ticket (Service Ticket, ST) generated by the identity authentication service module 104 is correct. If the user account corresponding to the first redirection request has logged in to the external network access assistant service module 102, the first redirection request will carry the identity authentication credentials (in the form of browser cookies) assigned after the external network access assistant service module 102 verifies that the service ticket (Service Ticket, ST) generated by the identity authentication service module 104 is correct. Otherwise, the above-mentioned identity authentication credentials will not be carried. The service ticket can be a unique, non-disguise ticket generated by the identity authentication service module 104 and used for identity authentication; therefore, when the external network access assistant service module 102 receives a first redirection request and the first redirection request does not carry identity authentication credentials (in the form of Cookies), it can be considered that the user account corresponding to the first redirection request has not logged in to the external network access assistant service module 102. At this time, the client can be controlled to send a single sign-on request to the identity authentication service module, that is, redirect to the identity authentication service module 104 for a single sign-on operation.

[0051] The identity authentication service module 104 may use an authentication service technology known in the art, for example, a Center Authentication Service (CAS) may be used to implement the single sign-on function of the identity authentication service module 104, which is not limited in the embodiments of the present disclosure. It can be known that single sign-on (SSO) enables users to log in to a single system in a multi-system environment and access related trusted systems without having to log in again.

[0052] Based on this, the identity authentication service module 104 can return a login page to the client upon receiving a single sign-on request. The user can enter identity information such as a user name and password on the login page. The client sends the identity information entered by the user to the identity authentication service module 104. The identity authentication service module 104 verifies whether the user account is correct based on the identity information (such as verifying whether the user name and password match correctly). If the user account is verified correctly (such as the user name and password match correctly), the user account is recorded in the identity authentication service module 104 to complete the single sign-on, that is, the user account has logged in to the identity authentication service module 104. When the user account has logged in to the identity authentication service module 104, the identity authentication service module 104 can generate a unique first service ticket and a session identifier (Session ID) for the user account and return them to the client. The first service ticket and the session identifier (Session ID) can be stored in the client's identity authentication credentials (in the form of Cookies) to facilitate subsequent requests to the identity authentication service module 104.

[0053] Among them, the identity authentication service module 104 controls the client to send a second redirection request carrying the first service ticket to the external network access assistant service module 102, that is, redirects the client to the external network access assistant service module 102, so that the external network access assistant service module 102 verifies the user account to the identity authentication service module 104 based on the first service ticket in the second redirection request. Therefore, the external network access assistant service module 102 can send a verification request carrying the first service ticket to the identity authentication service module 104 after receiving the second redirection request. The identity authentication service module 104 can verify whether the user account is logged in based on the first service ticket. If the user account is logged in in the identity authentication service module 104, a notification of successful user account verification is returned to the external network access assistant service module 102. When the external network access assistant service module 102 receives the notification of successful user account verification, it records that the user account has also logged in to the external network access assistant service module 102.

[0054] After the user account has logged in to the external network access assistant service module 102, the external network access assistant service module 102 can retrieve the pre-stored internal network address (URL address) of the internal network application system that the user originally wants to access, and convert the original internal network address of the internal network application system into a WebVPN access address corresponding to the WebVPN service module 103 (i.e., the URL address of accessing the internal network application system via the WebVPN service module 103) according to the URL mapping algorithm notified in advance by the manufacturer of the WebVPN service module 103, that is, according to the preset URL mapping algorithm, the internal network address can be converted into the WebVPN access address of the internal network application system indicated by the WebVPN service module entering the internal network address; for example, the original URL address of the internal network application system is https: / / business.company.com / path, and the WebVPN access address corresponding to the WebVPN service module 103 obtained after the URL address is converted by the URL mapping algorithm can be https: / / webvpn.company.com / https / xxxxxx / path, and the xxxxxx in the WebVPN access address is the result of converting the domain name business.company.com according to the URL mapping algorithm (i.e., the fixed mapping rule) provided by the manufacturer of the WebVPN service module. After obtaining the WebVPN access address, the external network access assistant service module 102 can return the WebVPN access address to the client, and control the client to send a WebVPN login request to the WebVPN service module based on the WebVPN access address. For example, the client can be controlled to initiate an asynchronous call (such as an AJAX call or any asynchronous call method such as an iframe src call) to the WebVPN login request of the WebVPN service module 103.

[0055] In summary, the external network access assistant service module 102 can store the original intranet address of the intranet application system carried by the first redirection request, and detect whether the user account is in a logged-in state in the external network access assistant service module 102. If the user account is not logged in to the external network access assistant service module 102, it will redirect to the identity authentication service module 104 to ask the user to log in. If the user account has been logged in to the external network access assistant service module 102, then a WebVPN login request of an asynchronous call (such as an AJAX call or any asynchronous call such as an iframe src call) can be initiated to the WebVPN service module 103 in the client, so that the user account is also in a logged-in state in the WebVPN service module 103, so as to achieve subsequent automatic access to the intranet access system via the WebVPN service module 103. Among them, the WebVPN service module 103 can adopt the WebVPN service technology known in the art, as long as it can achieve the functions it needs to achieve, and this is not limited to the embodiments of the present disclosure.

[0056] As described above, when the user account has logged in to the external network access assistant service module, the external network access assistant service module 102 controls the client to send a WebVPN login request to the WebVPN service module 103; based on this, the WebVPN service module 103 is also used to respond to receiving the WebVPN login request and return a response to the WebVPN login request to the redirection service module 101;

[0057] The redirection service module 101 is further used to add a cross-domain access attribute to the response header of the WebVPN login request, and return the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module 104, wherein the third redirection request carries the session identifier;

[0058] The identity authentication service module 104 is further configured to, in response to receiving the third redirection request and determining that the user account has logged into the identity authentication service module based on the session identifier in the third redirection request, return a response to the third redirection request to the redirection service module 101, wherein the response to the third redirection request includes the second service ticket;

[0059] The redirection service module 101 is further configured to add a cross-domain access attribute to a response header of the third redirection request, and return a response of the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, wherein the fourth redirection request carries the second service ticket;

[0060] The WebVPN service module 103 is further configured to, in response to receiving the fourth redirection request, verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, record that the user account has logged into the WebVPN service module, and return a response to the fourth redirection request to the redirection service module 101, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module 103;

[0061] The redirection service module 101 is also used to add a cross-domain access attribute in the response header of the fourth redirection request, and return the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module 103 after receiving the response of the fourth redirection request with the added cross-domain access attribute.

[0062] Among them, considering that the control of the client by the external network access assistant service module 102 to send a request to the WebVPN service module 103 and the identity authentication service module 104 is an operation of cross-domain calling the WebVPN service module 103 and the cross-domain calling the identity authentication service module 104, in order to achieve this cross-domain access operation, the redirection service module 101 can be used to add a cross-domain access attribute in the response header of the request when forwarding the response of the request to the client, so that the external network access assistant service module 102 can cross-domain access the WebVPN service module 103 and the identity authentication service module 104 through the client.

[0063] Among them, the cross-domain access attribute is used to allow the login request to perform cross-domain access, and the cross-domain access attribute includes: the first attribute is used to indicate the domain name allowed for cross-domain access, the second attribute is used to indicate whether to send authentication credentials (i.e. Cookies, such as service tickets and session identifiers recorded in the form of Cookies) when cross-domain access is allowed, the third attribute is used to indicate the access method allowed for cross-domain access, and the fourth attribute is used to indicate the header information field allowed to be carried during cross-domain access (i.e., the information field in the response header).

[0064] As described above, the first attribute can be expressed as the Access-Control-Allow-Origin attribute, the second attribute can be expressed as the Access-Control-Allow-Credentials attribute, the third attribute can be expressed as the Access-Control-Allow-Method attribute, and the fourth attribute can be expressed as the Access-Control-Allow-Header attribute; exemplarily, the above four attributes can be added to the response header of the original single sign-on request address, and Access-Control-Allow-Origin is set to the domain name of the external network access assistant service module (such as: https: / / guide.company.com), Access-Control-Allow-Credential is set to true (that is, cookies are allowed to be used during cross-domain access), Access-Control-Allow-Method is set according to actual conditions to set the access method (such as: GET, indicating that the access method allowed for cross-domain access is the GET access method), and Access-Control-Allow-Headers is customized according to actual conditions (such as: Content-Type, indicating that the header information field allowed to be carried during cross-domain access is the Content-Type field).

[0065] By utilizing the redirection service module 101 to add a cross-domain access attribute to the response header of the request address related to cross-domain access, the web page of the external network access assistant service module 102 can cross-domain call the WebVPN service module 103 and the identity authentication service module 104 on the client, thereby supporting the external network access assistant service module 102 to control the client to automatically complete identity authentication and single sign-on in the identity service authentication module 104, and control the client to automatically complete user account verification and login in the WebVPN service module 103.

[0066] The intranet access system of the disclosed embodiment is a system that adds an extranet access assistant service module in addition to the WebVPN service module, and the extranet access assistant service module provides automatic conversion services for extranet access. At the same time, the redirection service module is used to add the four cross-domain access attributes of Access-Control-Allow-Origin, Access-Control-Allow-Headers, Access-Control-Allow-Method and Access-Control-Allow-Credentials to the HTTP response return header of the URL related to the WebVPN service and identity authentication service login, so that the web page of the extranet access assistant service module 102 can call the WebVPN service module 103 across domains on the client, thereby supporting the extranet access assistant service module 102 to allow the user account to automatically log in to the WebVPN service module 103 and automatically jump to the URL address of the intranet application system accessed through the WebVPN service module 103.

[0067] As described above, the WebVPN service module 103 can control the client to send a third redirection request to the identity authentication service module 104, that is, the WebVPN service module 103 controls the client to redirect to the identity authentication service module 104. Since a session between the client and the identity authentication service module 104 has been established before, the session identifier carried in the third redirection request can indicate which client sent the request. After receiving the third redirection request, the identity authentication service module 104 can verify whether the user account corresponding to the client is logged in in the identity authentication service module 104 based on the session identifier in the third redirection request. If the user account is logged in in the identity authentication service module 104, the identity authentication service module 104 returns the second service ticket to the client and controls the client to send a fourth redirection request carrying the second service ticket to the WebVPN service module 103, so that the WebVPN service module 103 verifies the user account to the identity authentication service module 104 based on the second service ticket in the fourth redirection request, so as to realize automatic login to the WebVPN service module 103.

[0068] Among them, after receiving the fourth redirection request, the WebVPN service module 103 can send a verification request carrying the second service ticket to the identity authentication service module 104 based on the second service ticket in the fourth redirection request. In the verification request, the identity authentication service module 104 can verify whether the user account is logged in based on the second service ticket. If the user account is logged in in the identity authentication service module 104, a notification of successful user account verification is returned to the WebVPN service module 103. When the WebVPN service module 103 receives the notification of successful user account verification, it records that the user account has also logged in to the WebVPN service module 103, and returns a notification that the user account has logged in to the WebVPN service module 103 to the client. Specifically, the WebVPN service module 103 sends a response to the fourth redirection request to the redirection service module, and the response to the fourth redirection request includes a notification that the user account has logged in to the WebVPN service module. The redirection service module 101 adds a cross-domain access attribute in the response header of the fourth redirection request, and returns the response of the fourth redirection request with the added cross-domain access attribute to the client, so as to control the client to send a WebVPN access request to the WebVPN service module.

[0069] After receiving the response to the fourth redirection request with the added cross-domain access attribute, the client can send a WebVPN access request to the WebVPN service module based on the WebVPN access address of the intranet application system indicated by the intranet address entered by the WebVPN service module, that is, control the client to redirect to the WebVPN service module, or redirect the current page of the client to the URL address of the WebVPN service module 103 corresponding to the original URL address of the intranet application system, for example, redirect the current page of the browser to https: / / webvpn.company.com / https / xxxxxx / path.

[0070] Furthermore, after receiving the WebVPN access request, the WebVPN service module 103 can recover the intranet address of the intranet application system that the user originally wants to access from the WebVPN access request based on the corresponding reverse mapping algorithm. For example, https: / / business.company.com / path can be recovered from https: / / webvpn.company.com / https / xxxxxx / path. Then, based on the recovered intranet address, an intranet application access request can be sent to the corresponding intranet application system, that is, the intranet application access request is sent to the intranet application system indicated by the WebVPN access request. After receiving the intranet application access request, the intranet application system can respond to the intranet application access request and return the response result to the client through the WebVPN service module (for example, returning the grades that the user wants to query, etc.).

[0071] According to the system of the embodiment of the present disclosure, the redirection service module, the external network access assistant service module and the WebVPN service module can be used to enable the user to enter the intranet address of the intranet application system only once when the user wants to access the intranet application system from the external network, and after logging in to the external network access assistant service module, the user can automatically log in to the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on the link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0072] Based on the intranet access system provided by the above-mentioned embodiment of the present disclosure, the embodiment of the present disclosure also provides Figure 3 A schematic diagram of an intranet access process is shown in FIG. Figure 3As shown, the intranet access process includes: the user browser initiates an intranet application access request based on the access application system URL, the load balancing (or reverse proxy) service module determines whether the IP address of the user terminal where the client that initiates the intranet application access request is located is in the external network, if the IP address of the user terminal that initiates the intranet application access request is not in the external network, then the intranet application access request is forwarded to the intranet application system (i.e., the application system that restricts internal network access), the intranet application system processes the intranet application access request, and returns a response result to the user browser, the user browser can display the application system content, that is, display the response result returned by the intranet application system; if the IP address of the user terminal that initiates the intranet application access request is in the external network, then the intranet application access request is redirected to the external network access assistant service module; the external network access assistant service module detects whether the user is logged in (i.e., detects whether the user account is logged in), if not logged in, then redirects to the identity service authentication module to complete the single sign-on of the user account (including user operations in the browser, such as entering identity information such as user name and password); When the user account has logged in, a WebVPN login request (i.e., a WebVPN login request) is sent to the WebVPN service module. The WebVPN service module processes the login request to log the user account in to the WebVPN service module, wherein the WebVPN service module verifies the user account through the roaming service of the identity service authentication module (including automatic redirection of the user browser, for example, automatic redirection to the identity authentication service module). The roaming service is used to generate a service ticket and verify the service ticket. When the user account has logged in to the WebVPN service module, the external network access assistant service module converts the URL of the intranet application system into a new URL of the WebVPN service module (i.e., converts it into a WebVPN access address), and initiates a request to access the new URL (i.e., sends a WebVPN access request). The WebVPN service module forwards the WebVPN access request to the corresponding intranet application system. The intranet application system processes the WebVPN access request and returns the processed page content to the user browser through the WebVPN service module (i.e., returns a response result).

[0073] The present disclosure also provides Figure 4 Another schematic diagram of the intranet access process is shown in FIG. Figure 4 As shown in the figure, the intranet access process includes:

[0074] 1: The user uses a browser on the external network to request the URL of the internal application system (that is, to request the URL of the intranet application system);

[0075] 2: The load balancing (or reverse proxy) service module controls the browser to redirect and takes the internal application system URL (i.e., intranet address) as a parameter;

[0076] 3: The browser sends a redirection request (first redirection request) to the external network access service assistant module;

[0077] 4: The external network access assistant service module records the URL of the internal application system;

[0078] 5: If the user account is not logged in, jump to the authentication service (i.e., identity authentication service module), that is, redirect to the identity authentication service module;

[0079] 6: The browser sends a login page request to the identity authentication service module;

[0080] 7: The identity authentication service module returns to the login page;

[0081] 8: The user enters the account (user name) and password on the login page;

[0082] 9: The browser sends: username and password;

[0083] 10: The identity authentication service module determines that the user account has successfully logged in based on the user name and password, and records that the user has logged in;

[0084] 11: The identity authentication service module returns a successful login, controls the browser to redirect (i.e., the second redirection), and brings a roaming ST (Service Ticket) (i.e., the first service ticket);

[0085] 12: The browser sends a redirect request with the roaming ST parameter (i.e., the first service ticket);

[0086] 13: The external network access assistant service module verifies the roaming ST to the identity authentication service module;

[0087] 14: The identity authentication service module returns the result of ST verification success, which means that the user account verification is successful;

[0088] 15: The external network access assistant service module records that the user has logged in;

[0089] 16: The external network access assistant service module returns the address for accessing the URL of the internal application system from WebVPN (i.e., the WebVPN access address);

[0090] 17: The external network access assistant page (i.e., the page of the external network access assistant service module) automatically uses AJAX to send a request to the WebVPN service (i.e., sends a WebVPN login request) to automatically log in to the WebVPN service;

[0091] 18: When WebVPN is not logged in (that is, the user account is not logged in to the WebVPN service), jump to the authentication service;

[0092] 19: The load balancing (or reverse proxy) service module adds cross-domain access attributes to the HTTP return header (i.e. the response header of the WebVPN login request) to support cross-domain calls;

[0093] 20: When the browser is not logged into WebVPN (that is, the user account is not logged into the WebVPN service), it jumps to the authentication service;

[0094] 21: The browser sends a redirect request (i.e., the third redirect request) to the identity authentication service module;

[0095] 22: The identity authentication service module confirms that the user account is logged in based on the session identifier in the redirection request, returns logged in, and initiates a redirection request (i.e., the third redirection). The response to the redirection request carries a roaming ST parameter (i.e., the second service ticket);

[0096] 23: The load balancing (or reverse proxy) service module adds a cross-domain access attribute to the HTTP return header of the request (i.e. the response header of the third redirection request) to support cross-domain calls;

[0097] 24: When the browser is logged in (i.e. the user account is not logged in to the WebVPN service), the browser redirects with the roaming ST parameter (i.e. the second service ticket);

[0098] 25: The browser redirects to the WebVPN service module with roaming ST parameters (second service ticket);

[0099] 26: The WebVPN service module verifies the roaming ST to the identity authentication service module;

[0100] 27: The identity authentication service module returns the result of ST verification success;

[0101] 28: The WebVPN service module records that the user has logged in;

[0102] 29: WebVPN service module returns the page to the AJAX request;

[0103] 30: The load balancing (or reverse proxy) service module adds a cross-domain access attribute to the HTTP return header of the request (i.e., the response header of the fourth redirection request) to support cross-domain calls;

[0104] 31: The load balancing (or reverse proxy) service module returns the AJAX request with the cross-domain access attribute added to the browser;

[0105] 32: The external network access assistant page automatically jumps to the URL of the converted WebVPN corresponding to the URL of the internal application system (that is, sending a WebVPN access request);

[0106] 33: The WebVPN service module accesses the corresponding intranet application system (i.e., the application system (accessible only to the internal network));

[0107] 34: The application system returns the business system content to the WebVPN service module (i.e., returns the response result);

[0108] 35: The WebVPN service module returns the content of the business system to the browser.

[0109] The above-mentioned intranet access process realizes an intranet access method of using a browser to access an application system with restricted internal network access from an external network. When a user uses a browser to access the URL of an application system with restricted internal network access from an external network, the user first logs in once, and after a successful login, the user can access the content of the URL of the application system with restricted internal network access entered in the previous step. Specifically, the above-mentioned intranet access process involves the access process when a user uses a browser or other client to access an application system with restricted internal network access from an external network: 1) When the user accesses the original URL of the application system with restricted internal network access, the user is automatically redirected to the external network access assistant service. 2) The external network access assistant service records the original URL of the application system. 3) Then the user logs in to the external network access assistant service. 4) The external network access assistant service then automatically completes the user's login to the WebVPN service, and automatically jumps to the URL under the WebVPN domain name corresponding to the original URL of the application system. 5) Finally, the user sees the content of the original URL of the application system from the URL under the WebVPN domain name.

[0110] In the disclosed embodiment, when users access business applications that restrict internal network access from the external network, they only need to enter the target application system URL address once. After logging in, they can automatically jump to access the URL address of the internal network application system URL address corresponding to the URL address in the WebVPN service. The user does not need to enter the target URL in the WebVPN service again or click on the link with the target URL, which simplifies user operations and improves user experience. It can be implemented based on the WebVPN service, but the WebVPN service itself is not changed. Only the network device is changed to add an additional HTTP response header when forwarding the request for the partial path of the WebVPN domain name and the partial path of the authentication system domain name. Cross-site requests are sent through web pages between the page of the external network access assistant service and the WebVPN service, and between the page of the external network access assistant service and the identity authentication service. By changing the network device to add an additional HTTP response header when forwarding the request for the partial path of the WebVPN domain name and the authentication service domain name, the cross-site request of the web page of the external network access assistant service for the WebVPN service and the authentication service is supported. The load balancing (or reverse proxy) service is used to distinguish between users accessing the internal network and the external network. When a user accesses an application that restricts internal network access from the internal network, the application that restricts internal network access directly processes the return result. When a user restricts internal network access on an external network, the load balancing (or reverse proxy) service redirects the request to the external network access assistant service and passes the original URL of the application system as a parameter to the external network access assistant service.

[0111] The disclosed embodiment provides an intranet access system for accessing an application system with restricted internal network access from an external network using a browser and a browser compatible environment. By adding an external network access assistant function for logging in and converting a target URL based on a WebVPN service, but without changing the WebVPN service itself, a user only needs to log in once when using a client such as a browser to access the URL of an application system with restricted internal network access from an external network. After a successful login, the user can access the content of the application system URL with restricted internal network access entered in the previous step. The advantages of the intranet access system are as follows: the user only needs to enter the URL address of the target internal application system once, and the access can be automatically redirected after logging in. The user does not need to enter the URL of the target internal application system in WebVPN again or click on the URL link with the target internal application system, which simplifies user operations and improves user experience; it can be adapted to users accessing from any network to support users using Wi-Fi in public places and using it abroad; users can use browsers and browser compatible environments (i.e., applications that can open web pages), etc., and users do not need to install additional VPN clients or APP clients; the WebVPN service itself is not changed, only the network device is changed to add additional HTTP response headers when forwarding requests for partial paths of the WebVPN domain name and the authentication service domain name, and the added functions have little coupling with the WebVPN system, thereby making the intranet access system secure and stable.

[0112] Based on the above intranet access system, the present disclosure also provides Figure 5 An intranet access method is shown, which is applied to an intranet access system, wherein the system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network WebVPN service module, and the method includes:

[0113] Step S51, in response to receiving an intranet application access request sent by a client from an external network, the redirection service module controls the client to send a first redirection request to the external network access assistant service module, where the first redirection request carries the intranet address of the intranet application access request;

[0114] Step S52, in response to receiving the first redirection request, the external network access assistant service module saves the intranet address carried in the first redirection request, and, if the user account has logged into the external network access assistant service module, converts the intranet address into a WebVPN access address of the intranet application system indicated by the WebVPN service module for entering the intranet address, returns the WebVPN access address to the client, controls the client to send a WebVPN login request to the WebVPN service module, so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, controls the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address;

[0115] Step S53, in response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0116] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; the method further includes: the external network access assistant service module, in response to receiving the first redirection request, detecting whether the user account corresponding to the first redirection request is logged into the external network access assistant service module, and, if the user account is not logged into the external network access assistant service module, controlling the client to send a single sign-on request to the identity authentication service module; the identity authentication service module, in response to receiving the single sign-on request, returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; after the user account is completed In the case of single sign-on, the user account is recorded to have logged in to the identity authentication service module, a first service ticket and a session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module responds to receiving the second redirection request, verifies the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged in to the external network access assistant service module.

[0117] In a possible implementation, the method further includes: in response to receiving the WebVPN login request, the WebVPN service module returns a response to the WebVPN login request to the redirect service module; the redirect service module adds a cross-domain access attribute in a response header of the WebVPN login request, and returns the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; in response to receiving the third redirect request and determining that the user account has logged in to the identity authentication service module based on the session identifier in the third redirect request, the identity authentication service module returns a response to the third redirect request to the redirect service module, the response to the third redirect request includes a second service ticket; the redirect service module adds a cross-domain access attribute in a response header of the third redirect request, and returns the response of the third redirect request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The response of the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, and the fourth redirection request carries the second service ticket; in response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, records that the user account has logged in to the WebVPN service module, and returns a response to the fourth redirection request to the redirection service module, and the response to the fourth redirection request includes a notification that the user account has logged in to the WebVPN service module; the redirection service module adds a cross-domain access attribute to the response header of the fourth redirection request, and returns the response of the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0118] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the method also includes: the redirection service module, in response to receiving an intranet application access request sent by a client in the intranet, forwards the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0119] In one possible implementation, the cross-domain access attribute is used to allow a login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate a domain name for which cross-domain access is allowed, a second attribute is used to indicate whether to send authentication credentials (i.e., Cookies) during cross-domain access, a third attribute is used to indicate an access method allowed for cross-domain access, and a fourth attribute is used to indicate a header information field allowed to be carried during cross-domain access.

[0120] It should be understood that the specific implementation of each step in the intranet access method of the embodiment of the present disclosure can refer to the intranet access system provided by the above embodiment of the present disclosure and the above embodiment of the present disclosure. Figure 3 or Figure 4 The intranet access process shown is not repeated here.

[0121] According to the method of the embodiment of the present disclosure, when a user wants to access an intranet application system from an external network, he only needs to enter the intranet address of the intranet application system once, and after logging in to the external network access assistant service module, he can automatically log in to the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on the link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0122] The embodiment of the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium can be a volatile or non-volatile computer-readable storage medium.

[0123] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0124] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0125] Figure 6 FIG. 1 is a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 may be provided as a server. Figure 6, the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0126] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0127] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0128] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0129] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0130] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0131] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0132] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0133] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0134] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0135] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0136] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. An intranet access system, characterized in that: include: Redirection service module, external network access assistant service module and web-based virtual private network WebVPN service module; The redirection service module is used to control the client to send a first redirection request to the external network access assistant service module in response to receiving an internal network application access request sent by the client from the external network, wherein the first redirection request carries the internal network address of the internal network application access request; The external network access assistant service module is used to save the intranet address carried in the first redirection request in response to receiving the first redirection request, and, if the user account has logged into the external network access assistant service module, convert the intranet address into a WebVPN access address of the intranet application system indicated by the WebVPN service module for entering the intranet address, return the WebVPN access address to the client, control the client to send a WebVPN login request to the WebVPN service module, so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, control the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; The WebVPN service module is used to send an intranet application access request to the intranet application system indicated by the WebVPN access request in response to receiving the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

2. The system according to claim 1, characterized in that The system also includes an identity authentication service module for performing single sign-on of a user account; wherein, The external network access assistant service module is further used to detect, in response to receiving the first redirection request, whether the user account corresponding to the first redirection request is logged in to the external network access assistant service module, and control the client to send a single sign-on request to the identity authentication service module if the user account is not logged in to the external network access assistant service module; The identity authentication service module is configured to, in response to receiving the single sign-on request, return a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; in the case where the user account completes the single sign-on, record that the user account has logged in to the identity authentication service module, return a first service ticket and a session identifier to the client, and control the client to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; The external network access assistant service module is also used to verify the user account to the identity authentication service module based on the first service ticket in response to receiving the second redirection request, and if the user account verification is successful, record that the user account has logged in to the external network access assistant service module.

3. The system according to claim 2, characterized in that The WebVPN service module is further configured to return a response to the WebVPN login request to the redirection service module in response to receiving the WebVPN login request; The redirection service module is further used to add a cross-domain access attribute to the response header of the WebVPN login request, and return the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, and the third redirection request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The identity authentication service module is further configured to, in response to receiving the third redirection request and determining based on the session identifier in the third redirection request that the user account has logged in to the identity authentication service module, return a response to the third redirection request to the redirection service module, wherein the response to the third redirection request includes a second service ticket; The redirection service module is further configured to add a cross-domain access attribute to a response header of the third redirection request, and return a response of the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, wherein the fourth redirection request carries the second service ticket; The WebVPN service module is further configured to, in response to receiving the fourth redirection request, verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, record that the user account has logged into the WebVPN service module, and return a response to the fourth redirection request to the redirection service module, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module; The redirection service module is also used to add a cross-domain access attribute to the response header of the fourth redirection request, and return the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module after receiving the response of the fourth redirection request with the added cross-domain access attribute.

4. The system according to claim 3, characterized in that The cross-domain access attribute is used to allow a login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate a domain name allowed for cross-domain access, a second attribute is used to indicate whether to send authentication credentials when cross-domain access is allowed, a third attribute is used to indicate an access method allowed for cross-domain access, and a fourth attribute is used to indicate a header information field allowed to be carried during cross-domain access.

5. The system according to any one of claims 1 to 4, characterized in that: The redirection service module adopts load balancing service or reverse proxy service; The redirection service module is also used to, in response to receiving an intranet application access request sent by a client in the intranet, forward the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

6. An intranet access method, characterized in that: Applied to an intranet access system, the system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network WebVPN service module, and the method includes: In response to receiving an intranet application access request sent by a client from an external network, the redirection service module controls the client to send a first redirection request to the external network access assistant service module, where the first redirection request carries the intranet address of the intranet application access request; In response to receiving the first redirection request, the external network access assistant service module saves the intranet address carried in the first redirection request, and, if the user account has logged into the external network access assistant service module, converts the intranet address into a WebVPN access address of the intranet application system indicated by the WebVPN service module for entering the intranet address, returns the WebVPN access address to the client, controls the client to send a WebVPN login request to the WebVPN service module, so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, controls the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; In response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

7. The method according to claim 6, characterized in that The system also includes an identity authentication service module for performing single sign-on of a user account; the method also includes: In response to receiving the first redirection request, the external network access assistant service module detects whether the user account corresponding to the first redirection request is logged in to the external network access assistant service module, and controls the client to send a single sign-on request to the identity authentication service module if the user account is not logged in to the external network access assistant service module; In response to receiving the single sign-on request, the identity authentication service module returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; when the user account completes the single sign-on, it records that the user account has logged in to the identity authentication service module, returns a first service ticket and a session identifier to the client, and controls the client to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; In response to receiving the second redirection request, the external network access assistant service module verifies the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged in to the external network access assistant service module.

8. The method according to claim 7, characterized in that The method further comprises: The WebVPN service module returns a response to the WebVPN login request to the redirection service module in response to receiving the WebVPN login request; The redirection service module adds a cross-domain access attribute to the response header of the WebVPN login request, and returns the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, and the third redirection request carries the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The identity authentication service module, in response to receiving the third redirection request and determining based on the session identifier in the third redirection request that the user account has logged in to the identity authentication service module, returns a response to the third redirection request to the redirection service module, wherein the response to the third redirection request includes a second service ticket; The redirection service module adds a cross-domain access attribute to the response header of the third redirection request, and returns the response of the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, and the fourth redirection request carries the second service ticket; In response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, records that the user account has logged into the WebVPN service module, and returns a response to the fourth redirection request to the redirection service module, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module; The redirection service module adds a cross-domain access attribute to the response header of the fourth redirection request, and returns the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module after receiving the response of the fourth redirection request with the added cross-domain access attribute.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the method described in any one of claims 6 to 8 when executing the instructions stored in the memory.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 6 to 8 is implemented.

Images