Intranet access system and method, electronic device and storage medium

Abstract

The present disclosure relates to an intranet access system and method, an electronic device, and a storage medium. The system includes: a redirection service module configured to receive an intranet application access request sent by a client from an external network and control the client to send a first redirection request to an external network access assistant service module; the external network access assistant service module configured to convert an intranet address into a WebVPN access address, return the WebVPN access address to the client, control the client to send a WebVPN login request to the WebVPN service module, and control the client to send the WebVPN access request to the WebVPN service module based on the WebVPN access address; and the WebVPN service module configured to send the intranet application access request to the intranet application system indicated by the WebVPN access request. This system allows users to automatically redirect to access the intranet application system after logging in once, simplifying user operations and improving user experience.

Description

Technical Field

[0001] The present disclosure relates to the field of network communication technology, and in particular to an intranet access system and method, an electronic device, and a storage medium. Background Art

[0002] To meet campus management and service requirements, various university administrative departments have built diverse information systems and provided hundreds of campus application systems. Faculty and students access and use these systems through clients such as browsers. For security reasons, some of these campus application systems require that users access the information system using an internal network IP address, restricting access to the application system to the internal network only. However, users also need to access internal network application systems from external networks. Enabling users to conveniently access internal network application systems from external networks using clients such as browsers has become a critical issue.

[0003] Currently, there are two main ways to access intranet applications from the external network. The first involves signing a contract with a network operator to establish a dedicated VPN (Virtual Private Network) connection from the public network to the internal network. Users then log in to the network operator's service and bind their campus network account to the network operator's account. Once bound, when users use the operator's external network to access applications restricted to the internal network, external network traffic enters the campus through the dedicated VPN network. In other words, if a user has bound a campus account to the network operator, all traffic to campus applications will flow through the VPN. However, this method, which uses a network operator's network to bind a campus account, cannot be used when using a network that does not have a bound mobile phone number. For example, this solution cannot access applications restricted to the internal network from the external network when connected to Wi-Fi in public places such as restaurants. It also cannot be used when users are abroad, making it unsuitable for universities' frequent exchanges with international personnel.

[0004] The second method is to use the WebVPN service (a web-based intranet application access control service system). When a user accesses the URL (Uniform Resource Locator) of an intranet application system from an external network, they are redirected to a prompt page of the WebVPN service, which informs the user that the system cannot be directly accessed from the external network and guides the user to log in to the WebVPN service. Next, the user needs to access the URL address of the WebVPN service and log in to the WebVPN service. After logging in to the WebVPN service, they can click or enter the URL address of a certain intranet application system in the WebVPN service to access the intranet application system. However, in this method, the WebVPN service does not automatically jump to the intranet application system that the user wants to access. Instead, the user needs to manually enter the URL or click a link to a certain application system from a pre-stored application system list, which makes the user operation cumbersome and the user experience poor. Summary of the Invention

[0005] In view of this, the present disclosure proposes an intranet access system and method, an electronic device and a storage medium, which can enable users to automatically jump to access the intranet application system after logging in once, simplifying user operations and improving user experience.

[0006] According to one aspect of the present disclosure, an intranet access system is provided, comprising: a redirection service module, an extranet access assistant service module, and a web-based virtual private network (WebVPN) service module; the redirection service module is configured to, in response to receiving an intranet application access request sent by a client from an extranet, control the client to send a first redirection request to the extranet access assistant service module, wherein the first redirection request carries the intranet address of the intranet application access request; the extranet access assistant service module is configured to, in response to receiving the first redirection request, save the intranet address carried in the first redirection request, and, if a user account has logged into the extranet access assistant service module, convert the intranet address into the intranet application system indicated by the intranet address entered by the WebVPN service module. The method further comprises: receiving a WebVPN access address, returning the WebVPN access address to the client, controlling the client to send a WebVPN login request to the WebVPN service module so that the user account logs into the WebVPN service module; and, if the user account has already logged into the WebVPN service module, controlling the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; the WebVPN service module is configured to, in response to receiving the WebVPN access request, send an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0007] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; wherein the extranet access assistant service module is further configured to, in response to receiving the first redirection request, detect whether the user account corresponding to the first redirection request is logged into the extranet access assistant service module, and, if the user account is not logged into the extranet access assistant service module, control the client to send a single sign-on request to the identity authentication service module; the identity authentication service module is configured to, in response to receiving the single sign-on request, return a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; after the user account completes the single sign-on In the case of point login, it is recorded that the user account has logged into the identity authentication service module, and the first service ticket and session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, wherein the second redirection request carries the first service ticket, and the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module is also used to verify the user account to the identity authentication service module based on the first service ticket in response to receiving the second redirection request, and if the user account verification is successful, record that the user account has logged into the external network access assistant service module.

[0008] In one possible implementation, the WebVPN service module is further configured to, in response to receiving the WebVPN login request, send a response to the WebVPN login request to the redirect service module; the redirect service module is further configured to add a cross-domain access attribute to a response header of the WebVPN login request, and return the response to the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response to the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carrying the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; the identity authentication service module is further configured to, in response to receiving the third redirect request and determining based on the session identifier in the third redirect request that the user account has logged in to the identity authentication service module, return a response to the third redirect request to the redirect service module, the response to the third redirect request including a second service ticket; the redirect service module is further configured to add a cross-domain access attribute to a response header of the third redirect request, and return the response to the third redirect request including a second service ticket. The response to the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response to the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, where the fourth redirection request carries the second service ticket. The WebVPN service module is further configured to, in response to receiving the fourth redirection request, verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, record that the user account has logged into the WebVPN service module, and return a response to the fourth redirection request to the redirection service module, where the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module. The redirection service module is further configured to add the cross-domain access attribute to the response header of the fourth redirection request, and return the response to the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response to the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0009] In one possible implementation, the cross-domain access attribute is used to allow a login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate a domain name for which cross-domain access is allowed, a second attribute is used to indicate whether authentication credentials are allowed to be sent during cross-domain access, a third attribute is used to indicate an access method allowed to be used during cross-domain access, and a fourth attribute is used to indicate a header information field allowed to be carried during cross-domain access.

[0010] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the redirection service module is also used to respond to receiving an intranet application access request sent by a client in the intranet, and forward the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0011] According to another aspect of the present disclosure, an intranet access method is provided, which is applied to an intranet access system, wherein the system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network WebVPN service module, wherein the method includes: in response to receiving an intranet application access request sent by a client from an extranet, the redirection service module controls the client to send a first redirection request to the extranet access assistant service module, wherein the first redirection request carries the intranet address of the intranet application access request; in response to receiving the first redirection request, the extranet access assistant service module saves the intranet address carried in the first redirection request, and, if a user account has logged in to the extranet access assistant service module, converts the intranet address into a URL indicated by the WebVPN service module when entering the intranet address. The method further comprises: determining a WebVPN access address of the intranet application system indicated by the WebVPN access address, returning the WebVPN access address to the client, controlling the client to send a WebVPN login request to the WebVPN service module so that the user account logs in to the WebVPN service module; and, if the user account has logged in to the WebVPN service module, controlling the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address; in response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0012] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; the method further includes: the extranet access assistant service module, in response to receiving the first redirection request, detecting whether the user account corresponding to the first redirection request is logged into the extranet access assistant service module, and, if the user account is not logged into the extranet access assistant service module, controlling the client to send a single sign-on request to the identity authentication service module; the identity authentication service module, in response to receiving the single sign-on request, returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; after the user account is completed In the case of single sign-on, the user account is recorded as having logged into the identity authentication service module, a first service ticket and a session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module responds to receiving the second redirection request, verifies the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged into the external network access assistant service module.

[0013] In a possible implementation, the method further includes: the WebVPN service module, in response to receiving the WebVPN login request, returning a response to the WebVPN login request to the redirect service module; the redirect service module adding a cross-domain access attribute to a response header of the WebVPN login request, and returning the response to the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response to the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carrying the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; the identity authentication service module, in response to receiving the third redirect request and determining based on the session identifier in the third redirect request that the user account has logged in to the identity authentication service module, returns a response to the third redirect request to the redirect service module, the response to the third redirect request including a second service ticket; the redirect service module adding a cross-domain access attribute to a response header of the third redirect request, and returning the response to the third redirect request including a second service ticket; The response to the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response to the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, where the fourth redirection request carries the second service ticket. In response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request. If the user account verification is successful, the WebVPN service module records that the user account has logged into the WebVPN service module and returns a response to the fourth redirection request to the redirection service module, where the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module. The redirection service module adds the cross-domain access attribute to the response header of the fourth redirection request and returns the response to the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response to the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0014] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the method also includes: the redirection service module, in response to receiving an intranet application access request sent by a client in the intranet, forwards the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0015] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0016] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0018] According to various aspects of the present disclosure, the use of the redirection service module, the external network access assistant service module, the identity authentication service module and the WebVPN service module enables a user to enter the intranet address of the intranet application system only once when he wants to access the intranet application system from an external network. After logging into the external network access assistant service module, he can automatically log into the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on the link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0019] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0021] Figure 1 A block diagram of an intranet access system according to an embodiment of the present disclosure is shown.

[0022] Figure 2 A block diagram of another intranet access system according to an embodiment of the present disclosure is shown.

[0023] Figure 3 A schematic diagram illustrating an intranet access process according to an embodiment of the present disclosure is shown.

[0024] Figure 4 A schematic diagram illustrating another intranet access process according to an embodiment of the present disclosure.

[0025] Figure 5 A flowchart of an intranet access method according to an embodiment of the present disclosure is shown.

[0026] Figure 6 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0028] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0029] The term "and / or" herein simply describes an association relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. Furthermore, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of items. For example, "at least one of A, B, and C" can represent any one or more elements selected from the set consisting of A, B, and C. In the description of this disclosure, "plurality" means two or more, unless otherwise specifically defined.

[0030] It should be understood that the terms "first," "second," and the like in the claims, specification, and drawings of the present disclosure are used to distinguish between different objects, rather than to describe a specific order. The terms "include" and "comprising" used in the specification and claims of the present disclosure indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or combinations thereof.

[0031] In addition, numerous specific details are provided in the following detailed description to better illustrate the present disclosure. Those skilled in the art will appreciate that the present disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main points of the present disclosure.

[0032] As mentioned above, the existing method of using WebVPN service for intranet access makes user operations cumbersome and the user experience poor. In view of this, the embodiment of the present disclosure provides an intranet access system. The system adds the functions of automatic login and conversion of intranet addresses on the basis of WebVPN service, but does not change the application of WebVPN service itself, which allows users to conveniently access the intranet application system on the external network. Specifically, when a user uses a browser or other client to access the URL address of the intranet application system on the external network, the intranet application access request initiated by the client from the external network is first redirected to the external network access assistant service module, and the original intranet address (i.e., URL address) of the internal application system is attached. The user then performs a single sign-on, and after a successful login, the content of the intranet application system can be automatically accessed through the WebVPN service module.

[0033] The following Figures 1 to 4 The intranet access system provided by the embodiment of the present disclosure is introduced in detail.

[0034] Figure 1 FIG. 1 shows a block diagram of an intranet access system according to an embodiment of the present disclosure. Figure 1 As shown, the intranet access system includes:

[0035] Redirection service module 101, external network access assistant service module 102 and web-based virtual private network WebVPN service module 103;

[0036] The redirection service module 101 is configured to, in response to receiving an intranet application access request sent by a client from an external network, control the client to send a first redirection request to the external network access assistant service module 102, where the first redirection request carries the intranet address of the intranet application access request;

[0037] The external network access assistant service module 102 is configured to, in response to receiving the first redirection request, store the intranet address carried in the first redirection request, and, if the user account is logged into the external network access assistant service module 102, convert the intranet address into a WebVPN access address of the intranet application system indicated by the intranet address accessed by the WebVPN service module 103, return the WebVPN access address to the client, and control the client to send a WebVPN login request to the WebVPN service module 103 so that the user account is logged into the WebVPN service module 103; and, if the user account is logged into the WebVPN service module 103, control the client to send a WebVPN access request to the WebVPN service module 103 based on the WebVPN access address;

[0038] The WebVPN service module 103 is configured to, in response to receiving the WebVPN access request, send an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module 103.

[0039] In actual applications, the client can be an independent browser, an application with a built-in browser (such as an application using WebView), a plug-in, a component, or other client that can open a web page, and the embodiments of the present disclosure are not limited to this. It should be understood that when a user accesses an intranet system application, the intranet address (such as a URL address) of the intranet application system can be entered or selected in the client. At this time, the client (such as a browser) will send an intranet application access request to the intranet based on the intranet address.

[0040] Since there are usually multiple application systems in the internal network that are not allowed to be accessed from the external network (i.e., multiple intranet application systems), a redirection service module 101 can be provided in the internal network. The redirection service module is used to uniformly receive intranet application access requests and determine whether the intranet application access requests are sent from the external network or the internal network, so as to redirect the intranet application access requests sent from the external network to the external network access assistant service module 102, and can also forward the intranet application access requests sent from the intranet to the corresponding intranet application system. That is, the above-mentioned redirection service module 101 is also used to respond to the intranet application access request sent by the client in the intranet, and forward the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns the response result to the client. For example, if a user wants to access a score query system that restricts external network access to query scores in the intranet, the user can enter the URL address of the score query system in the browser, and the browser sends a corresponding intranet application access request to the intranet. The redirection service module 101 receives the intranet application access request and determines that the intranet application access request is a request sent in the intranet, and then the intranet application access request can be forwarded to the score query system. The score query system responds to the intranet application access request, for example, returns to the login page of the score query system. After logging in to the score query system, the user can perform score query operations in the score query system.

[0041] It should be understood that different intranet application systems have different functional services, and different intranet application access requests can be sent to any intranet application system. The embodiments of the present disclosure do not limit the specific content of the intranet application access request and the functional services of the intranet application system accessed by the intranet application access request.

[0042] In actual applications, the redirection service module 101 can adopt a load balancing service or a reverse proxy service. Those skilled in the art can adopt the load balancing technology or reverse proxy technology known in the art to implement the above functions required by the redirection service module 101. The redirection service module can adopt a software module or a hardware module or a combination of software and hardware, and this is not limited to the embodiments of the present disclosure.

[0043] Among them, the redirection service module 101 can determine whether the intranet application access request is sent from the external network or the intranet based on the IP address corresponding to the received intranet application access request. Among them, the redirection service module 101 can pre-store the intranet IP address segment that allows direct access. When the redirection service module 101 receives the intranet application access request sent by any client, it can determine whether the IP address of the user terminal where the client initiating the intranet application access request is located is in the intranet IP address segment. If it is not in the intranet IP address segment, it is considered that the intranet application access request is sent from the external network. Otherwise, it is considered that the intranet application access request is sent from the intranet.

[0044] Among them, when it is determined that the intranet application access request is sent from the external network, it can be automatically redirected to the external network access assistant service module, and the original intranet address of the intranet application system accessed by the intranet application access request is also passed to the external network access assistant service module as a parameter. For example, assuming that the domain name of the intranet application system to be accessed by the intranet application access request is business.company.com, and the domain name of the external network access assistant service module is guide.company.com, when the intranet address of the intranet application access request sent by the client is https: / / business.company.com / path, and the redirection service module 101 detects that the intranet application access request is a request sent from the external network and the domain name is restricted for internal access, then the intranet application access request can be redirected to the external network access assistant service module, that is, the following redirection address can be returned to the client: https: / / guide.company.com / index? previous_url=https: / / business.company.com / path, the client can send a first redirection request to the external network access assistant service module 102 based on the above redirection address, and the first redirection request carries the intranet address "https: / / business.company.com / path" of the intranet application access request.

[0045] After receiving the above-mentioned first redirection request, the external network access assistant service module 102 can save the intranet address carried in the first redirection request, and detect whether the user account corresponding to the first redirection request has logged in to the external network access assistant service module 102. If the user account has not logged in to the external network access assistant service module 102, the login process of the external network access assistant service module 102 is executed to enable the user account to log in to the external network access assistant service module 102.

[0046] Therefore, in order to realize the user account login system, such as Figure 2 As shown, the system also includes an identity authentication service module 104 for single sign-on of user accounts. It should be understood that when a user accesses the external network through a client, the access traffic first passes through the redirection service module 101 before being forwarded to the external access assistant service module 102, the WebVPN service module 103, the identity authentication service module 104, and the intranet application system. Specifically, the external access assistant service module 102, the WebVPN service module 103, and the identity authentication service module 104 are visible to the external network, while the intranet application system is only visible to the internal network.

[0047] Based on this, the extranet access assistant service module 102 is further configured to, in response to receiving the first redirection request, detect whether the user account corresponding to the first redirection request is logged into the extranet access assistant service module 102, and, if the user account is not logged into the extranet access assistant service module, control the client to send a single sign-on request to the identity authentication service module;

[0048] The identity authentication service module 104 is configured to, in response to receiving a single sign-on request, return a login page to the client, so that the user completes single sign-on of the user account in the identity authentication service module 104 based on the login page; when the user account completes single sign-on, record that the user account has logged into the identity authentication service module, return a first service ticket and a session identifier to the client, and control the client to send a second redirect request to the external network access assistant service module, the second redirect request carrying the first service ticket, the first service ticket being used to verify the user account, and the session identifier being used to maintain the session between the client and the identity authentication service module 104;

[0049] The extranet access assistant service module 102 is further configured to, in response to receiving the second redirection request, verify the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, record that the user account has logged in to the extranet access assistant service module.

[0050] Among them, the external network access assistant service module 102 detects whether the user account corresponding to the first redirect request is logged in to the external network access assistant service module 102. It can be to detect whether the first redirect request carries the identity authentication credentials (in the form of browser cookies) assigned after the external network access assistant service module 102 verifies that the service ticket (Service Ticket, ST) generated by the identity authentication service module 104 is correct. If the user account corresponding to the first redirect request has logged in to the external network access assistant service module 102, the first redirect request will carry the identity authentication credentials (in the form of browser cookies) assigned after the external network access assistant service module 102 verifies that the service ticket (Service Ticket, ST) generated by the identity authentication service module 104 is correct. Otherwise, the above-mentioned identity authentication credentials will not be carried. The service ticket can be a unique, non-disguise ticket generated by the identity authentication service module 104 and used for identity authentication; therefore, when the external network access assistant service module 102 receives a first redirection request and the first redirection request does not carry identity authentication credentials (in the form of cookies), it can be considered that the user account corresponding to the first redirection request has not logged in to the external network access assistant service module 102. At this time, the client can be controlled to send a single sign-on request to the identity authentication service module, that is, redirect to the identity authentication service module 104 for a single sign-on operation.

[0051] The identity authentication service module 104 may utilize authentication service technologies known in the art. For example, a Center Authentication Service (CAS) may be utilized to implement the single sign-on function of the identity authentication service module 104, which is not limited in the present embodiment. It is understood that single sign-on (SSO) enables users to log into a single system in a multi-system environment and access related trusted systems without having to log in again.

[0052] Based on this, upon receiving a single sign-on request, the identity authentication service module 104 can return a login page to the client. The user can enter identity information such as a username and password on the login page. The client sends the identity information entered by the user to the identity authentication service module 104. The identity authentication service module 104 verifies whether the user account is correct based on the identity information (such as verifying whether the username and password match correctly). If the user account is verified correctly (such as the username and password match correctly), the user account is recorded in the identity authentication service module 104 to complete the single sign-on, that is, the user account has logged in to the identity authentication service module 104. When the user account has logged in to the identity authentication service module 104, the identity authentication service module 104 can generate a unique first service ticket and a session identifier (Session ID) for the user account and return them to the client. The first service ticket and session identifier (Session ID) can be stored in the client's authentication credentials (in the form of cookies) to facilitate subsequent requests to the identity authentication service module 104.

[0053] Among them, the identity authentication service module 104 controls the client to send a second redirection request carrying the first service ticket to the external network access assistant service module 102, that is, redirects the client to the external network access assistant service module 102, so that the external network access assistant service module 102 verifies the user account to the identity authentication service module 104 based on the first service ticket in the second redirection request. Therefore, the external network access assistant service module 102 can send a verification request carrying the first service ticket to the identity authentication service module 104 after receiving the second redirection request. The identity authentication service module 104 can verify whether the user account is logged in based on the first service ticket. If the user account is logged in in the identity authentication service module 104, a notification of successful user account verification is returned to the external network access assistant service module 102. When the external network access assistant service module 102 receives the notification of successful user account verification, it records that the user account has also logged in to the external network access assistant service module 102.

[0054] After the user account has logged into the external network access assistant service module 102, the external network access assistant service module 102 can retrieve the pre-stored intranet address (URL address) of the intranet application system that the user originally wanted to access, and convert the original intranet address of the intranet application system into a WebVPN access address corresponding to the WebVPN service module 103 (i.e., the URL address for accessing the intranet application system via the WebVPN service module 103) according to the URL mapping algorithm provided in advance by the manufacturer of the WebVPN service module 103. In other words, the preset URL mapping algorithm can be used to convert the intranet address into the WebVPN access address of the intranet application system indicated by the intranet address entered by the WebVPN service module. For example, if the original URL address of the intranet application system is https: / / business.company.com / path, the WebVPN access address corresponding to the WebVPN service module 103 after conversion by the URL mapping algorithm may be https: / / webvpn.company.com / https / xxxxxx / path, where xxxxxx in the WebVPN access address is the domain name business.company.com converted according to the URL mapping algorithm (i.e., the fixed mapping rule) provided by the manufacturer of the WebVPN service module. After obtaining the WebVPN access address, the extranet access assistant service module 102 can return the WebVPN access address to the client and control the client to send a WebVPN login request to the WebVPN service module based on the WebVPN access address. For example, the client can be controlled to initiate an asynchronous call (such as an AJAX call or an iframe src call or any other asynchronous call method) to the WebVPN service module 103. WebVPN login request.

[0055] In summary, the extranet access assistant service module 102 can store the original intranet address of the intranet application system carried by the first redirect request, and detect whether the user account is in a logged-in state in the extranet access assistant service module 102. If the user account is not logged in to the extranet access assistant service module 102, it redirects to the identity authentication service module 104 to ask the user to log in. If the user account has already logged in to the extranet access assistant service module 102, then a WebVPN login request can be initiated in the client to the WebVPN service module 103 through an asynchronous call (such as an AJAX call or an iframe src call or any other asynchronous call method), so that the user account is also logged in in the WebVPN service module 103, so as to achieve subsequent automatic access to the intranet access system via the WebVPN service module 103. Among them, the WebVPN service module 103 can adopt the WebVPN service technology known in the art, as long as it can achieve the functions it needs to achieve, and this is not limited in the embodiment of the present disclosure.

[0056] As described above, when the user account has logged into the extranet access assistant service module, the extranet access assistant service module 102 controls the client to send a WebVPN login request to the WebVPN service module 103. Based on this, the WebVPN service module 103 is further configured to return a response to the WebVPN login request to the redirection service module 101 in response to receiving the WebVPN login request.

[0057] The redirection service module 101 is further configured to add a cross-domain access attribute to a response header of the WebVPN login request, and return the response to the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response to the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module 104, wherein the third redirection request carries the session identifier;

[0058] The identity authentication service module 104 is further configured to, in response to receiving the third redirection request and determining based on the session identifier in the third redirection request that the user account has logged into the identity authentication service module, return a response to the third redirection request to the redirection service module 101, wherein the response to the third redirection request includes the second service ticket;

[0059] The redirection service module 101 is further configured to add a cross-domain access attribute to a response header of the third redirection request, and return the response to the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response to the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, wherein the fourth redirection request carries the second service ticket;

[0060] The WebVPN service module 103 is further configured to, in response to receiving the fourth redirection request, verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, record that the user account has logged into the WebVPN service module, and return a response to the fourth redirection request to the redirection service module 101, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module 103;

[0061] The redirection service module 101 is also used to add a cross-domain access attribute in the response header of the fourth redirection request, and return the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module 103 after receiving the response of the fourth redirection request with the added cross-domain access attribute.

[0062] Among them, considering that the control of the client by the external network access assistant service module 102 to send a request to the WebVPN service module 103 and the identity authentication service module 104 is an operation of cross-domain calling the WebVPN service module 103 and cross-domain calling the identity authentication service module 104, in order to realize this cross-domain access operation, the redirection service module 101 can be used to add a cross-domain access attribute in the response header of the request when forwarding the response of the request to the client, so that the external network access assistant service module 102 can cross-domain access the WebVPN service module 103 and the identity authentication service module 104 through the client.

[0063] Among them, the cross-domain access attribute is used to allow login requests to perform cross-domain access. The cross-domain access attribute includes: a first attribute is used to indicate the domain name allowed for cross-domain access, a second attribute is used to indicate whether to send authentication credentials (i.e., Cookies, such as service tickets and session identifiers recorded in the form of Cookies) when cross-domain access is allowed, a third attribute is used to indicate the access method allowed for cross-domain access, and a fourth attribute is used to indicate the header information field allowed to be carried during cross-domain access (i.e., the information field in the response header).

[0064] As mentioned above, the first attribute can be expressed as the Access-Control-Allow-Origin attribute, the second attribute can be expressed as the Access-Control-Allow-Credentials attribute, the third attribute can be expressed as the Access-Control-Allow-Method attribute, and the fourth attribute can be expressed as the Access-Control-Allow-Header attribute; exemplarily, the above four attributes can be added to the response header of the original single sign-on request address, and the Access-Control-Allow-Origin is set to the domain name of the external network access assistant service module (such as: https: / / guide.company.com), the Access-Control-Allow-Credential is set to true (that is, cookies are allowed for cross-domain access), the Access-Control-Allow-Method is set to the access method according to the actual situation (such as set to: GET, indicating that the access method allowed for cross-domain access is the GET access method), and the Access-Control-Allow-Headers is customized according to the actual situation (such as set to: Content-Type, indicating that the header information field allowed to be carried during cross-domain access is the Content-Type field).

[0065] By using the redirection service module 101 to add a cross-domain access attribute to the response header of the request address related to cross-domain access, the web page of the external network access assistant service module 102 can cross-domain call the WebVPN service module 103 and the identity authentication service module 104 on the client, thereby supporting the external network access assistant service module 102 to control the client to automatically complete identity authentication and single sign-on in the identity service authentication module 104, and control the client to automatically complete user account verification and login in the WebVPN service module 103.

[0066] The intranet access system of the disclosed embodiment adds an extranet access assistant service module in addition to the WebVPN service module. The extranet access assistant service module provides automatic conversion services for extranet access. Simultaneously, the redirection service module adds four cross-domain access attributes, namely, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Access-Control-Allow-Method, and Access-Control-Allow-Credentials, to the HTTP response return header of the URL associated with the WebVPN service and identity authentication service login. This enables the web page of the extranet access assistant service module 102 to call the WebVPN service module 103 across domains on the client side, thereby enabling the extranet access assistant service module 102 to automatically log in the user account to the WebVPN service module 103 and automatically jump to the URL address of the intranet application system accessed through the WebVPN service module 103.

[0067] As described above, WebVPN service module 103 can control the client to send a third redirect request to identity authentication service module 104. That is, WebVPN service module 103 controls the client to redirect to identity authentication service module 104. Since a session has been established between the client and identity authentication service module 104, the session identifier carried in the third redirect request can indicate which client sent the request. After receiving the third redirect request, identity authentication service module 104 can verify whether the user account corresponding to the client is logged in in identity authentication service module 104 based on the session identifier in the third redirect request. If the user account is logged in in identity authentication service module 104, identity authentication service module 104 returns the second service ticket to the client and controls the client to send a fourth redirect request carrying the second service ticket to WebVPN service module 103. WebVPN service module 103 verifies the user account with identity authentication service module 104 based on the second service ticket in the fourth redirect request, thereby automatically logging in to WebVPN service module 103.

[0068] After receiving the fourth redirection request, WebVPN service module 103 may send a verification request carrying the second service ticket to identity authentication service module 104 based on the second service ticket in the fourth redirection request. In the verification request, identity authentication service module 104 may verify whether the user account is logged in based on the second service ticket. If the user account is logged in to identity authentication service module 104, a notification of successful user account verification is returned to WebVPN service module 103. When WebVPN service module 103 receives the notification of successful user account verification, it records that the user account has also logged in to WebVPN service module 103 and returns a notification to the client indicating that the user account has logged in to WebVPN service module 103. Specifically, WebVPN service module 103 sends a response to the fourth redirection request to the redirection service module. The response to the fourth redirection request includes a notification indicating that the user account has logged in to the WebVPN service module. Redirection service module 101 adds a cross-domain access attribute to the response header of the fourth redirection request and returns the response to the fourth redirection request with the added cross-domain access attribute to the client, thereby controlling the client to send a WebVPN access request to the WebVPN service module.

[0069] After receiving the response to the fourth redirection request with the added cross-domain access attribute, the client can send a WebVPN access request to the WebVPN service module based on the WebVPN access address of the intranet application system indicated by the intranet address entered by the WebVPN service module, that is, control the client to be redirected to the WebVPN service module, or in other words, redirect the current page of the client to the URL address of the original URL address of the intranet application system corresponding to the URL address of the WebVPN service module 103, for example, redirect the current page of the browser to https: / / webvpn.company.com / https / xxxxxx / path.

[0070] Furthermore, after receiving the WebVPN access request, the WebVPN service module 103 can recover the intranet address of the intranet application system that the user originally wants to access from the WebVPN access request based on the corresponding reverse mapping algorithm. For example, https: / / business.company.com / path can be recovered from https: / / webvpn.company.com / https / xxxxxx / path. Then, based on the recovered intranet address, the intranet application access request can be sent to the corresponding intranet application system, that is, the intranet application access request is sent to the intranet application system indicated by the WebVPN access request. After receiving the intranet application access request, the intranet application system can respond to the intranet application access request and return a response result to the client through the WebVPN service module (for example, returning the grades that the user wants to query, etc.).

[0071] According to the system of the embodiment of the present disclosure, the redirection service module, the external network access assistant service module and the WebVPN service module are used to enable a user to enter the intranet address of the intranet application system only once when he wants to access the intranet application system from an external network. After logging into the external network access assistant service module, the user can automatically log into the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on a link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0072] Based on the intranet access system provided by the above embodiment of the present disclosure, the present embodiment also provides Figure 3 A schematic diagram of an intranet access process is shown in FIG. Figure 3As shown, the intranet access process includes: the user browser initiates an intranet application access request based on the access application system URL, the load balancing (or reverse proxy) service module determines whether the IP address of the user terminal where the client that initiates the intranet application access request is located is in the external network, if the IP address of the user terminal that initiates the intranet application access request is not in the external network, the intranet application access request is forwarded to the intranet application system (i.e., the application system that restricts internal network access), the intranet application system processes the intranet application access request, and returns a response result to the user browser, the user browser can display the application system content, that is, display the response result returned by the intranet application system; if the IP address of the user terminal that initiates the intranet application access request is in the external network, the intranet application access request is redirected to the external network access assistant service module; the external network access assistant service module detects whether the user is logged in (i.e., detects whether the user account is logged in), if not logged in, redirects to the identity service authentication module to complete the single sign-on of the user account (including user operations in the browser, such as entering identity information such as user name and password); When the user account has logged in, a WebVPN login request (also known as a WebVPN login request) is sent to the WebVPN service module. The WebVPN service module processes the login request to log the user account in to the WebVPN service module, wherein the WebVPN service module verifies the user account through the roaming service of the identity service authentication module (including automatic redirection of the user browser, for example, automatic redirection to the identity authentication service module). The roaming service is used to generate a service ticket and verify the service ticket. When the user account has logged in to the WebVPN service module, the external network access assistant service module converts the URL of the intranet application system into a new URL of the WebVPN service module (that is, converts it into a WebVPN access address) and initiates a request to access the new URL (that is, sends a WebVPN access request). The WebVPN service module forwards the WebVPN access request to the corresponding intranet application system. The intranet application system processes the WebVPN access request and returns the processed page content (that is, returns a response result) to the user browser through the WebVPN service module.

[0073] The present disclosure also provides Figure 4 Another schematic diagram of the intranet access process is shown in FIG. Figure 4 As shown in the figure, the intranet access process includes:

[0074] 1: The user uses a browser on the external network to request the URL of the internal application system (that is, to request the URL of the intranet application system);

[0075] 2: The load balancing (or reverse proxy) service module controls the browser to redirect and takes the internal application system URL (i.e., intranet address) as a parameter;

[0076] 3: The browser sends a redirect request (first redirect request) to the external network access service assistant module;

[0077] 4: The external network access assistant service module records the URL of the internal application system;

[0078] 5: If the user account is not logged in, jump to the authentication service (i.e., identity authentication service module), that is, redirect to the identity authentication service module;

[0079] 6: The browser sends a login page request to the identity authentication service module;

[0080] 7: The identity authentication service module returns to the login page;

[0081] 8: The user enters the account (user name) and password on the login page;

[0082] 9: The browser sends: username and password;

[0083] 10: The identity authentication service module determines that the user account login is successful based on the user name and password, and records that the user has logged in;

[0084] 11: The identity authentication service module returns a successful login and controls the browser to redirect (i.e., the second redirection) with a roaming Service Ticket (i.e., the first service ticket).

[0085] 12: The browser sends a redirect request with the roaming ST parameter (i.e., the first service ticket);

[0086] 13: The extranet access assistant service module verifies the roaming ST to the identity authentication service module;

[0087] 14: The identity authentication service module returns a message indicating that the user account has been successfully authenticated.

[0088] 15: The extranet access assistant service module records that the user has logged in;

[0089] 16: The external network access assistant service module returns the address for accessing the internal application system URL from WebVPN (i.e., the WebVPN access address);

[0090] 17: The extranet access assistant page (i.e., the page of the extranet access assistant service module) automatically uses AJAX to send a request to the WebVPN service (i.e., sends a WebVPN login request) to automatically log in to the WebVPN service;

[0091] 18: When WebVPN is not logged in (that is, the user account is not logged in to the WebVPN service), jump to the authentication service;

[0092] 19: The load balancing (or reverse proxy) service module adds cross-domain access attributes to the HTTP request return header (i.e., the response header of the WebVPN login request) to support cross-domain calls;

[0093] 20: When the browser is not logged into WebVPN (that is, the user account is not logged into the WebVPN service), it jumps to the authentication service;

[0094] 21: The browser sends a redirect request to the identity authentication service module (i.e., the third redirect request);

[0095] 22: The identity authentication service module confirms that the user account is logged in based on the session identifier in the redirect request, returns a logged in status, and initiates a redirect request (i.e., the third redirect). The response to the redirect request carries the roaming ST parameter (i.e., the second service ticket).

[0096] 23: The load balancing (or reverse proxy) service module adds a cross-domain access attribute to the HTTP return header of the request (i.e., the response header of the third redirect request) to support cross-domain calls;

[0097] 24: When the browser is logged in (i.e., the user account is not logged in to the WebVPN service), it redirects with the roaming ST parameter (i.e., the second service ticket);

[0098] 25: The browser redirects to the WebVPN service module with roaming ST parameters (second service ticket);

[0099] 26: The WebVPN service module verifies the roaming ST to the identity authentication service module;

[0100] 27: The identity authentication service module returns the ST verification success;

[0101] 28: The WebVPN service module records that the user has logged in;

[0102] 29: The WebVPN service module returns the page to the AJAX request;

[0103] 30: The load balancing (or reverse proxy) service module adds a cross-domain access attribute to the HTTP return header of the request (i.e., the response header of the fourth redirect request) to support cross-domain calls;

[0104] 31: The load balancing (or reverse proxy) service module returns the AJAX request with the cross-domain access attribute added to the browser;

[0105] 32: The external network access assistant page automatically jumps to the URL of the internal application system URL after conversion to the WebVPN URL (that is, sends a WebVPN access request);

[0106] 33: WebVPN service module accesses the corresponding intranet application system (i.e., application system (accessible only to the internal network));

[0107] 34: The application system returns the business system content to the WebVPN service module (i.e., returns the response result);

[0108] 35: The WebVPN service module returns the content of the service system to the browser.

[0109] The above-mentioned intranet access process implements an intranet access method for using a browser to access an application system that restricts internal network access from an external network. When a user uses a browser to access the URL of an application system that restricts internal network access from an external network, he or she will first log in once. After a successful login, he or she can access the content of the URL of the application system that restricts internal network access entered in the previous step. Specifically, the above-mentioned intranet access process involves the following access process when a user uses a browser or other client to access an application system that restricts internal network access from an external network: 1) When the user accesses the original URL of the application system that restricts internal network access, it will automatically jump to the external network access assistant service. 2) The external network access assistant service records the original URL of the application system. 3) Then the user logs in to the external network access assistant service. 4) The external network access assistant service then automatically completes the user's login to the WebVPN service and automatically jumps to the URL under the WebVPN domain name corresponding to the original URL of the application system. 5) Finally, the user sees the content of the original URL of the application system from the URL under the WebVPN domain name.

[0110] In the disclosed embodiments, users only need to enter the target application URL once when accessing a business application restricted from the internal network. After logging in, they are automatically redirected to the URL corresponding to the internal application URL in the WebVPN service. Users no longer need to enter the target URL or click a link with the target URL in the WebVPN service, simplifying user operations and improving the user experience. This can be implemented based on the WebVPN service without modifying the WebVPN service itself. Instead, the network device is modified to add an additional HTTP response header when forwarding requests for a portion of the WebVPN domain name and the authentication system domain name. Cross-site web page requests are then sent between the external network access assistant service page and the WebVPN service, and between the external network access assistant service page and the authentication service. By modifying the network device to add an additional HTTP response header when forwarding requests for a portion of the WebVPN domain name and the authentication service domain name, cross-site web page requests from the external network access assistant service are supported for the WebVPN service and the authentication service. A load balancing (or reverse proxy) service is used to differentiate between users accessing the internal network and the external network. When a user accesses an application restricted from the internal network from the internal network, the application that is restricted from the internal network directly processes the returned result. When a user accesses an external network that restricts internal network access, the load balancing (or reverse proxy) service redirects the request to the external network access assistant service and passes the original URL of the application system as a parameter to the external network access assistant service.

[0111] The disclosed embodiments provide an intranet access system that enables use of a browser and a browser-compatible environment to access an application system with restricted intranet access from an external network. By adding an external network access assistant function for logging in and converting a target URL based on a WebVPN service, without modifying the WebVPN service itself, a user using a browser or other client to access the URL of an application system with restricted intranet access from an external network only needs to log in once. After a successful login, the user can access the content of the application system URL with restricted intranet access entered in the previous step. The advantages of this intranet access system are: the user only needs to enter the URL address of the target internal application system once, and the system will automatically jump to the access after logging in. The user does not need to enter the URL of the target internal application system in WebVPN again or click on the URL link with the target internal application system, which simplifies user operations and improves user experience; it can be adapted to users accessing from any network to support scenarios such as users using Wi-Fi in public places and using it abroad; users can use browsers and browser-compatible environments (i.e., applications that can open web pages), etc., and users do not need to install additional VPN clients or APP clients; the WebVPN service itself does not change, only the network device is modified to add additional HTTP response headers when forwarding requests for part of the path of the WebVPN domain name and the authentication service domain name. The added functions are less coupled with the WebVPN system, thus making the intranet access system secure and stable.

[0112] Based on the above intranet access system, the present disclosure also provides Figure 5 An intranet access method is shown, which is applied to an intranet access system. The system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network (WebVPN) service module. The method includes:

[0113] Step S51: In response to receiving an intranet application access request sent by a client from an external network, the redirection service module controls the client to send a first redirection request to the external network access assistant service module, where the first redirection request carries the intranet address of the intranet application access request;

[0114] In step S52, in response to receiving the first redirection request, the external network access assistant service module saves the intranet address carried in the first redirection request, and, if the user account has logged into the external network access assistant service module, converts the intranet address into a WebVPN access address for the intranet application system indicated by the intranet address used by the WebVPN service module to access the intranet address, returns the WebVPN access address to the client, and controls the client to send a WebVPN login request to the WebVPN service module so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, controls the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address.

[0115] In step S53, in response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module.

[0116] In a possible implementation, the system further includes an identity authentication service module for performing single sign-on of a user account; the method further includes: the extranet access assistant service module, in response to receiving the first redirection request, detecting whether the user account corresponding to the first redirection request is logged into the extranet access assistant service module, and, if the user account is not logged into the extranet access assistant service module, controlling the client to send a single sign-on request to the identity authentication service module; the identity authentication service module, in response to receiving the single sign-on request, returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; after the user account is completed In the case of single sign-on, the user account is recorded as having logged into the identity authentication service module, a first service ticket and a session identifier are returned to the client, and the client is controlled to send a second redirection request to the external network access assistant service module, the second redirection request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; the external network access assistant service module responds to receiving the second redirection request, verifies the user account to the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged into the external network access assistant service module.

[0117] In a possible implementation, the method further includes: the WebVPN service module, in response to receiving the WebVPN login request, returning a response to the WebVPN login request to the redirect service module; the redirect service module adding a cross-domain access attribute to a response header of the WebVPN login request, and returning the response to the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response to the WebVPN login request with the added cross-domain access attribute, the client sends a third redirect request to the identity authentication service module, the third redirect request carrying the session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; the identity authentication service module, in response to receiving the third redirect request and determining based on the session identifier in the third redirect request that the user account has logged in to the identity authentication service module, returns a response to the third redirect request to the redirect service module, the response to the third redirect request including a second service ticket; the redirect service module adding a cross-domain access attribute to a response header of the third redirect request, and returning the response to the third redirect request including a second service ticket; The response to the third redirection request with the added cross-domain access attribute is returned to the client, so that after receiving the response to the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, where the fourth redirection request carries the second service ticket. In response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request. If the user account verification is successful, the WebVPN service module records that the user account has logged into the WebVPN service module and returns a response to the fourth redirection request to the redirection service module, where the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module. The redirection service module adds the cross-domain access attribute to the response header of the fourth redirection request and returns the response to the fourth redirection request with the added cross-domain access attribute to the client, so that after receiving the response to the fourth redirection request with the added cross-domain access attribute, the client sends a WebVPN access request to the WebVPN service module.

[0118] In one possible implementation, the redirection service module adopts a load balancing service or a reverse proxy service; the method also includes: the redirection service module, in response to receiving an intranet application access request sent by a client in the intranet, forwards the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

[0119] In one possible implementation, the cross-domain access attribute is used to allow a login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate a domain name for which cross-domain access is allowed, a second attribute is used to indicate whether authentication credentials (i.e., Cookies) are allowed to be sent during cross-domain access, a third attribute is used to indicate an access method allowed for cross-domain access, and a fourth attribute is used to indicate a header information field allowed to be carried during cross-domain access.

[0120] It should be understood that the specific implementation of each step in the intranet access method of the embodiment of the present disclosure can refer to the intranet access system provided by the above embodiment of the present disclosure and the above embodiment of the present disclosure. Figure 3 or Figure 4 The intranet access process shown is not described in detail here.

[0121] According to the method of the embodiment of the present disclosure, when a user wants to access an intranet application system from an external network, he only needs to enter the intranet address of the intranet application system once. After logging into the external network access assistant service module, he can automatically log into the WebVPN service module and automatically jump to the intranet address corresponding to the WebVPN access address in the WebVPN service module. The user does not need to enter the intranet address in the WebVPN service module again or click on the link with the intranet address to jump to the intranet application system to be accessed, which can simplify user operations and improve user experience.

[0122] The present disclosure also provides a computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0123] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0124] An embodiment of the present disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0125] Figure 6 FIG1 shows a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 can be provided as a server. Figure 6The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described method.

[0126] The electronic device 1900 may further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0127] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0128] The present disclosure may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0129] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0130] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0131] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions. The electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0132] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0133] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0134] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0135] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and the part of the module, program segment or instruction contains one or more executable instructions for realizing the prescribed logical function. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0136] While various embodiments of the present disclosure have been described above, the foregoing description is intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. An intranet access system, characterized in that: include: Redirection service module, extranet access assistant service module and web-based virtual private network WebVPN service module; The redirection service module is configured to, in response to receiving an intranet application access request sent by a client from an external network, control the client to send a first redirection request to the external network access assistant service module, where the first redirection request carries the intranet address of the intranet application access request; The external network access assistant service module is configured to, in response to receiving the first redirection request, save the intranet address carried in the first redirection request, and, if the user account has logged into the external network access assistant service module, convert the intranet address into a WebVPN access address for the intranet application system indicated by the intranet address used by the WebVPN service module to access the intranet, return the WebVPN access address to the client, and control the client to send a WebVPN login request to the WebVPN service module so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, control the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address. The WebVPN service module is configured to, in response to receiving the WebVPN access request, send an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module; The system also includes an identity authentication service module for performing single sign-on of user accounts; The WebVPN service module is further configured to, in response to receiving the WebVPN login request, return a response to the WebVPN login request to the redirection service module; The redirection service module is further configured to add a cross-domain access attribute to a response header of the WebVPN login request, and return the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, wherein the third redirection request carries a session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; The identity authentication service module is further configured to, in response to receiving the third redirection request and determining based on the session identifier in the third redirection request that the user account has logged into the identity authentication service module, return a response to the third redirection request to the redirection service module, wherein the response to the third redirection request includes the second service ticket; The redirection service module is further configured to add a cross-domain access attribute to a response header of the third redirection request, and return the response of the third redirection request with the added cross-domain access attribute to the client, so that after receiving the response of the third redirection request with the added cross-domain access attribute, the client sends a fourth redirection request to the WebVPN service module, wherein the fourth redirection request carries the second service ticket; The WebVPN service module is further configured to, in response to receiving the fourth redirection request, verify the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, record that the user account has logged into the WebVPN service module, and return a response to the fourth redirection request to the redirection service module, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module; The redirection service module is further configured to add a cross-domain access attribute to a response header of the fourth redirection request, and return the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module after receiving the response of the fourth redirection request with the added cross-domain access attribute; Among them, the cross-domain access attribute is used to allow the login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate the domain name allowed for cross-domain access, a second attribute is used to indicate whether to send authentication credentials when cross-domain access is allowed, a third attribute is used to indicate the access method allowed for cross-domain access, and a fourth attribute is used to indicate the header information field allowed to be carried during cross-domain access.

2. The system according to claim 1, wherein: The external network access assistant service module is further configured to, in response to receiving the first redirection request, detect whether the user account corresponding to the first redirection request is logged into the external network access assistant service module, and, if the user account is not logged into the external network access assistant service module, control the client to send a single sign-on request to the identity authentication service module; The identity authentication service module is configured to return a login page to the client in response to receiving the single sign-on request, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; When the user account completes single sign-on, the authentication service module records that the user account has logged in, returns a first service ticket and a session identifier to the client, and controls the client to send a second redirect request to the external network access assistant service module, where the second redirect request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the authentication service module; The external network access assistant service module is also used to verify the user account to the identity authentication service module based on the first service ticket in response to receiving the second redirection request, and if the user account verification is successful, record that the user account has logged in to the external network access assistant service module.

3. The system according to claim 1 or 2, characterized in that The redirection service module adopts load balancing service or reverse proxy service; The redirection service module is also used to, in response to receiving an intranet application access request sent by a client in the intranet, forward the intranet application access request to the intranet application system indicated by the intranet application access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client.

4. A method for accessing an intranet, characterized in that: Applied to an intranet access system, the system includes a redirection service module, an extranet access assistant service module, and a web-based virtual private network (WebVPN) service module. The method includes: In response to receiving an intranet application access request sent by a client from an external network, the redirection service module controls the client to send a first redirection request to the external network access assistant service module, where the first redirection request carries the intranet address of the intranet application access request; In response to receiving the first redirection request, the external network access assistant service module saves the intranet address carried in the first redirection request, and, if the user account has logged into the external network access assistant service module, converts the intranet address into a WebVPN access address for the intranet application system indicated by the intranet address used by the WebVPN service module to access the intranet, returns the WebVPN access address to the client, controls the client to send a WebVPN login request to the WebVPN service module, so that the user account logs into the WebVPN service module; and, if the user account has logged into the WebVPN service module, controls the client to send a WebVPN access request to the WebVPN service module based on the WebVPN access address. In response to receiving the WebVPN access request, the WebVPN service module sends an intranet application access request to the intranet application system indicated by the WebVPN access request, so that the intranet application system responds to the intranet application access request and returns a response result to the client through the WebVPN service module; The system further includes an identity authentication service module for performing single sign-on of a user account; the method further includes: The WebVPN service module returns a response to the WebVPN login request to the redirect service module in response to receiving the WebVPN login request; The redirection service module adds a cross-domain access attribute to a response header of the WebVPN login request, and returns the response of the WebVPN login request with the added cross-domain access attribute to the client, so that after receiving the response of the WebVPN login request with the added cross-domain access attribute, the client sends a third redirection request to the identity authentication service module, wherein the third redirection request carries a session identifier; the cross-domain access attribute is used to allow the request to perform cross-domain access; In response to receiving the third redirection request and determining, based on the session identifier in the third redirection request, that the user account has logged into the identity authentication service module, the identity authentication service module returns a response to the third redirection request to the redirection service module, wherein the response to the third redirection request includes the second service ticket; The redirection service module adds a cross-domain access attribute to a response header of the third redirection request, and returns the response of the third redirection request with the added cross-domain access attribute to the client, so that the client, after receiving the response of the third redirection request with the added cross-domain access attribute, sends a fourth redirection request to the WebVPN service module, wherein the fourth redirection request carries the second service ticket; In response to receiving the fourth redirection request, the WebVPN service module verifies the user account with the identity authentication service module based on the second service ticket in the fourth redirection request, and if the user account verification is successful, records that the user account has logged into the WebVPN service module, and returns a response to the fourth redirection request to the redirection service module, wherein the response to the fourth redirection request includes a notification that the user account has logged into the WebVPN service module; The redirection service module adds a cross-domain access attribute to a response header of the fourth redirection request, and returns the response of the fourth redirection request with the added cross-domain access attribute to the client, so that the client sends a WebVPN access request to the WebVPN service module after receiving the response of the fourth redirection request with the added cross-domain access attribute; Among them, the cross-domain access attribute is used to allow the login request to perform cross-domain access, and the cross-domain access attribute includes: a first attribute is used to indicate the domain name allowed for cross-domain access, a second attribute is used to indicate whether to send authentication credentials when cross-domain access is allowed, a third attribute is used to indicate the access method allowed for cross-domain access, and a fourth attribute is used to indicate the header information field allowed to be carried during cross-domain access.

5. The method according to claim 4, characterized in that The method further comprises: In response to receiving the first redirection request, the external network access assistant service module detects whether the user account corresponding to the first redirection request is logged into the external network access assistant service module, and if the user account is not logged into the external network access assistant service module, controls the client to send a single sign-on request to the identity authentication service module; In response to receiving the single sign-on request, the identity authentication service module returns a login page to the client, so that the user completes the single sign-on of the user account in the identity authentication service module based on the login page; when the user account completes the single sign-on, the identity authentication service module records that the user account has logged into the identity authentication service module, returns a first service ticket and a session identifier to the client, and controls the client to send a second redirect request to the extranet access assistant service module, wherein the second redirect request carries the first service ticket, the first service ticket is used to verify the user account, and the session identifier is used to maintain the session between the client and the identity authentication service module; In response to receiving the second redirection request, the extranet access assistant service module verifies the user account with the identity authentication service module based on the first service ticket, and if the user account verification is successful, records that the user account has logged in to the extranet access assistant service module.

6. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method of claim 4 or 5 when executing the instructions stored in the memory.

7. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to claim 4 or 5 is implemented.

Images