Intranet service data access method and related equipment

Abstract

The invention discloses an intranet service data access method and related equipment, and belongs to the technical field of network security. The method is applied to an intranet access control platform, and comprises the following steps: in response to an intranet service access request initiated by a target terminal, analyzing a target address link corresponding to the intranet service access request into an encrypted public network address link; decrypting the encrypted information in the encrypted public network address link to obtain a user unique identifier of the target terminal; the identity authentication page is sent to a target terminal corresponding to the user unique identifier, and user identity information returned by the target terminal based on the identity authentication page is obtained; and forwarding the intranet service access request to an intranet service system under the condition of determining that the user identity information has the intranet service data access permission. By means of the mode, it can be ensured that only the user with the corresponding access permission can access the intranet service, unauthorized access caused by improper equipment configuration is prevented, and the risk of information leakage is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intranet business data access method and related equipment. Background Art

[0002] With the continuous evolution of mobile communication technology and the deepening of enterprise informatization, mobile terminals have become an important tool for employees to access the enterprise intranet and conduct business activities anytime and anywhere. In order to ensure that mobile devices can access internal enterprise resources safely and efficiently in the public Internet environment, the industry has widely adopted Virtual Private Network (VPN) technology as a solution.

[0003] Traditional VPN technology establishes a secure tunnel across the public Internet by installing dedicated client software on mobile terminals, allowing remote users to interact with data as if they were in the corporate intranet. This process usually includes the following steps: First, users install and configure VPN client applications on their mobile devices such as mobile phones according to the guidance provided by the enterprise; second, users need to provide the user name and complex password assigned by the enterprise for identity authentication when logging in; after successful authentication, the client software will encapsulate the user's network traffic and forward it to the corporate intranet through encrypted communication protocols to achieve secure access to internal resources.

[0004] Although VPN technology provides basic security protection for mobile terminals to access the corporate intranet, if the user's device itself has security vulnerabilities or is improperly configured, there is still a risk of sensitive corporate information leakage even if VPN technology is used. Summary of the invention

[0005] The embodiments of the present application provide a method for accessing intranet business data and related devices to at least solve the problem of high risk of intranet information leakage when user devices have security vulnerabilities or are improperly configured.

[0006] In order to solve the above technical problems, this application is implemented as follows: In the first aspect, an embodiment of the present application provides an intranet business data access method, which is applied to an intranet access control platform, including: in response to an intranet business access request initiated by a target terminal, resolving a target address link corresponding to the intranet business access request into an encrypted public network address link; decrypting the encrypted information in the encrypted public network address link to obtain a user unique identifier of the target terminal; obtaining user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user unique identifier; forwarding the intranet business access request to the intranet business system when it is determined that the user identity information has access rights to intranet business data; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request.

[0007] In the second aspect, an embodiment of the present application provides an intranet business data access method, which is applied to a target terminal, including: sending an intranet business access request to an intranet access control platform; obtaining an identity authentication page sent by the intranet access control platform based on the intranet business access request, and returning user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has the access right to the intranet business data; and receiving the business processing page returned by the intranet business system based on the intranet business access request.

[0008] In the third aspect, an embodiment of the present application provides an intranet access control platform, including: a link resolution module, used to respond to an intranet service access request initiated by a target terminal, and resolve the target address link corresponding to the intranet service access request into an encrypted public network address link; an information decryption module, used to decrypt the encrypted information in the encrypted public network address link to obtain the user unique identifier of the target terminal; an information acquisition module, used to obtain the user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user unique identifier; a request forwarding module, used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has the access right to intranet service data; the intranet service system is used to return the service processing page to the target terminal according to the intranet service access request.

[0009] In a fourth aspect, an embodiment of the present application provides a terminal, comprising: an access request module, used to send an intranet business access request to an intranet access control platform; an information sending module, used to obtain an identity authentication page sent by the intranet access control platform based on the intranet business access request, and return user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has access rights to intranet business data; a page receiving module, used to receive a business processing page returned by the intranet business system based on the intranet business access request.

[0010] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0011] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0012] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first or second aspect above.

[0013] In an embodiment of the present application, the intranet access control platform responds to the intranet service access request initiated by the target terminal, resolves the target address link corresponding to the intranet service access request into an encrypted public network address link; decrypts the encrypted information in the encrypted public network address link to obtain the user unique identifier of the target terminal; obtains the user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user unique identifier; forwards the intranet service access request to the intranet service system when it is determined that the user identity information has the access rights to the intranet service data; the intranet service system is used to return the service processing page to the target terminal according to the intranet service access request. In this way, by resolving the target address link corresponding to the intranet service access request initiated by the target terminal to obtain the user unique identifier, and verifying the user identity and access rights according to the user unique identifier, it can ensure that only users with corresponding access rights can access the intranet service, prevent unauthorized access due to improper device configuration, and reduce the risk of information leakage.

[0014] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0016] Figure 1 A schematic diagram of a process flow of an intranet service data access method provided by an embodiment of the present application is shown; Figure 2 An example diagram showing the conversion of business processing messages between internal and external networks provided by an embodiment of the present application is shown; Figure 3 Another schematic diagram of the process of accessing intranet service data provided by an embodiment of the present application is shown; Figure 4 An example diagram of an identity authentication page provided in an embodiment of the present application is shown; Figure 5 The business sequence diagram of the intranet business data access method provided by the embodiment of the present application is shown Figure 6 One of the structural schematic diagrams of the intranet service data access device provided in an embodiment of the present application is shown; Figure 7 The second structural diagram of the intranet service data access device provided in the embodiment of the present application is shown; Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0017] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0018] Figure 1A flow chart of the intranet service data access method provided in an embodiment of the present application is shown. The execution subject of the method may be a terminal device or a server, wherein the terminal device may be a device such as a personal computer, or a mobile terminal device such as a mobile phone or a tablet computer, and the terminal device may be a terminal device used by a user. The server may be an independent server, or a server cluster composed of multiple servers, and the server may be a background server of a certain service, or a background server of a certain platform or application (for example, an intranet access control platform, a super SIM intranet communication platform, a proxy gateway, etc.). In the embodiment of the present application, the execution subject is an intranet access control platform as an example for explanation. For the case of the terminal device, it can be processed according to the following related content, which will not be repeated here. As shown in the figure, the intranet service data access method 100 may include the following steps: Step 101: In response to an intranet service access request initiated by a target terminal, a target address link corresponding to the intranet service access request is resolved into an encrypted public network address link.

[0019] In a specific implementation, a user initiates an intranet service access request through a target terminal. Specifically, the user can initiate an intranet service access request by clicking on a target address link. In response to the intranet service access request, the intranet access control platform resolves the target address link corresponding to the intranet service access request into an encrypted public network address link. Specifically, the intranet access control platform can store the mapping relationship between the unique identifier in the target address link and the encrypted public network address link in a database in advance. After receiving the intranet access request, the unique identifier in the target address chain is extracted, and the corresponding encrypted public key address link is searched in the database according to the unique identifier.

[0020] Step 102: decrypt the encrypted information in the encrypted public network address link to obtain a unique user identifier of the target terminal.

[0021] In a specific implementation, the intranet access control platform may use a decryption method corresponding to the encryption method of the encrypted public network address link to decrypt the encrypted information in the encrypted public network address link obtained in the above step 101 to obtain a user unique identifier of the target terminal, wherein the encryption method may include a symmetric encryption algorithm and an asymmetric encryption algorithm; the user unique identifier may include a device serial number, a user ID, etc.

[0022] Step 103: sending an identity authentication page to a target terminal corresponding to the user unique identifier, and obtaining user identity information returned by the target terminal based on the identity authentication page.

[0023] In the specific implementation, the intranet access control platform generates a Uniform Resource Locator (URL) of the identity authentication page based on the user's unique identifier and sends it to the target terminal, and obtains the user identity information such as the user name and mobile phone number returned by the target terminal based on the identity authentication page.

[0024] Step 104: When it is determined that the user identity information has access rights to intranet business data, forward the intranet business access request to the intranet business system; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request.

[0025] In the specific implementation, the intranet access control platform detects whether the user corresponding to the user identity information has the access rights to the intranet business data based on the user identity information returned by the target terminal. If it is determined that the user identity information has the access rights to the intranet business data, the intranet business access request is forwarded to the intranet business system. The intranet business system processes the intranet business access request and returns the business processing page. The intranet access control platform sends the business processing page returned by the intranet business system to the target terminal.

[0026] In this way, by parsing the target address link corresponding to the intranet service access request initiated by the target terminal to obtain the user's unique identifier, and verifying the user's identity and access rights based on the user's unique identifier, it can be ensured that only users with corresponding access rights can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0027] In a possible implementation, in the above step 101, in response to the intranet service access request initiated by the target terminal, before resolving the target address link corresponding to the intranet service access request into an encrypted public network address link, the method further includes: Step 105: Obtain a first business processing message sent by the intranet business system. The first business processing message is sent by the intranet business system when a to-do item corresponding to a target user is detected. The first business processing message includes an intranet address link, to-do content and the target user.

[0028] In the embodiment of the present application, the intranet business system detects the to-do items corresponding to the target user. The to-do items may be to-do items assigned by the management personnel, or when the applicant submits an application such as a business trip, leave, or reimbursement, the intranet business system generates corresponding to-do items for the target user to approve. If it is detected that there are to-do items corresponding to the target user in the intranet business system, a first business processing message is generated. The first business processing message may be a text message, a 5G message, etc. Figure 2As shown in , the first business processing message 210 includes an intranet address link 211, to-do content 212 and a target user.

[0029] Step 106: securely encapsulate the intranet address link to obtain a target address link.

[0030] Continuing with the above embodiment, the intranet address link 211 is securely encapsulated to obtain the target address link 221. This can avoid data leakage or unauthorized access, which is beneficial to protecting sensitive information and enhancing information security.

[0031] Step 107: Generate a second business processing message according to the target address link and the to-do content.

[0032] Continuing with the above embodiment, a second business processing message 220 is generated according to the target address link 221 and the to-do content 212. The sensitive information in the to-do content 212 may be hidden to obtain the to-do content 222.

[0033] Step 108: Send the second service processing message to the target terminal corresponding to the target user.

[0034] Continuing with the above embodiment, the second service processing message 220 is sent to the target terminal corresponding to the target user. In this way, the target terminal can receive clear and secure service processing messages, which is conducive to improving user experience. At the same time, by converting the service processing messages into internal and external networks, information leakage or unauthorized access can be avoided.

[0035] In a possible implementation, in the above step 106, the intranet address link is securely encapsulated to obtain the target address link, including: The intranet address link is converted into a public network address link; the public network address link is encrypted by the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, wherein the encrypted public network address link includes a user unique identifier corresponding to the target user; the encrypted public network address link is converted into a target address link with a specific domain name.

[0036] In an embodiment of the present application, Network Address Translation (NAT) technology can be used to convert an intranet address link into a public network address link so that external users can access the address link; and a link containing a user unique identifier is generated, and the information is encrypted using a target public key in a SIM card on a target terminal, and the public network address link is securely encapsulated into an encrypted public network address link to achieve enhanced security encapsulation of the public network address link, wherein the encrypted public network address link includes a user unique identifier corresponding to the target user; and further, the encrypted public network address link is converted into a target address link with a specific domain name, such as hfx.net, so that the user's recognition and trust in the link can be improved through the specific domain name.

[0037] In this way, by performing multi-level, progressive security encapsulation of intranet address links, the ability of intranet resources to resist attacks can be improved, effectively preventing illegal users from intercepting, tampering with or forging access links.

[0038] In a possible implementation, in the above step 102, decrypting the encrypted information in the encrypted public network address link to obtain the user unique identifier of the target terminal includes: Obtain a target private key in the SIM card on the target terminal; decrypt the encrypted information in the encrypted public network address link using the target private key to obtain a unique user identifier of the target terminal.

[0039] In an embodiment of the present application, a target private key in the SIM card on the target terminal is obtained, and the encrypted information in the encrypted public network address link is decrypted using the target private key to obtain a unique user identifier for the target terminal. The hardware security features of the SIM card are used to sink user identity authentication to the chip level, thereby achieving physical isolation and greatly improving the ability to resist advanced threats such as side channel attacks and physical tampering.

[0040] In a possible implementation, in the above step 104, determining that the user identity information has intranet service data access rights includes: When it is determined, according to the network access control list and the role-based access control model, that the user corresponding to the user identity information is in a user group having access rights, it is determined that the user identity information has access rights to the intranet business data.

[0041] In an embodiment of the present application, it is possible to identify whether the user corresponding to the user identity information is in the user group with access rights based on the network access control list (ACL) and the role-based access control (RBAC) model, and if the authentication is passed and the user has the rights, it is determined that the user identity information has access rights to the intranet business data.

[0042] In a possible implementation, in the above step 104, forwarding the intranet service access request to the intranet service system includes: Establishing a network security tunnel with the target terminal; forwarding the intranet service access request to the intranet service system, and returning the service processing page of the intranet service system to the target terminal through the network security tunnel.

[0043] In an embodiment of the present application, when it is determined that the user identity information has access rights to the intranet business data, a network security tunnel is established with the target terminal. For example, the target terminal can access it under WIFI, or under data traffic, etc.; the intranet business access request is forwarded to the intranet business system, and the business processing page of the intranet business system is returned to the target terminal through the network security tunnel to ensure the security of information transmission.

[0044] The embodiment of the present application provides a method for accessing intranet business data. The method is applied to an intranet access control platform. In response to an intranet business access request initiated by a target terminal, the target address link corresponding to the intranet business access request is resolved into an encrypted public network address link; the encrypted information in the encrypted public network address link is decrypted to obtain the user unique identifier of the target terminal; by sending an identity authentication page to the target terminal corresponding to the user unique identifier, the user identity information returned by the target terminal based on the identity authentication page is obtained; when it is determined that the user identity information has the access right to the intranet business data, the intranet business access request is forwarded to the intranet business system. In this way, it can be ensured that only users with corresponding access rights can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0045] In addition, through network address translation, role-based access control, network access control list, strong encryption algorithm and SIM card built-in private key dual authentication system, the ability of intranet resources to resist attacks can be improved, effectively preventing illegal users from intercepting, tampering or forging access links.

[0046] Figure 3Another flow chart of the intranet service data access method provided by the embodiment of the present application is shown. The execution subject of the method can be a terminal device, wherein the terminal device can be a device such as a personal computer, or a mobile terminal device such as a mobile phone or a tablet computer, and the terminal device can be a terminal device used by a user. In the embodiment of the present application, the execution subject is taken as an example as a target terminal. As shown in the figure, the intranet service data access method 300 can include the following steps: Step 301: Send an intranet service access request to the intranet access control platform.

[0047] In a specific implementation, the target terminal can send an intranet service access request to the intranet access control platform by clicking the target address link.

[0048] Step 302: Obtain the identity authentication page sent by the intranet access control platform based on the intranet business access request, and return the user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has access rights to the intranet business data.

[0049] In a specific implementation, after receiving the intranet service access request, the intranet access control platform processes the intranet service request accordingly, obtains the user's unique identifier, and sends an identity authentication page to the target terminal corresponding to the user's unique identifier. The target terminal obtains the identity authentication page and returns user identity information such as user name and mobile phone number based on the identity authentication page. When the intranet access control platform determines that the user identity information has the access rights to the intranet service data, it forwards the intranet service access request to the intranet service system.

[0050] Step 303: Receive a service processing page returned by the intranet service system based on the intranet service access request.

[0051] In the specific implementation, the target terminal can establish a network security tunnel with the intranet access control platform, receive the business processing page returned by the intranet business system based on the intranet business access request through the network security tunnel, and then complete the processing of to-do items in the business processing page on the target terminal.

[0052] In a possible implementation, in the above step 301, sending an intranet service access request to the intranet access control platform includes: A service processing message sent by an intranet access control platform is received, wherein the service processing message includes a target address link; and in response to a triggering operation on the target address link, an intranet service access request is sent to the intranet access control platform.

[0053] In an embodiment of the present application, the target terminal receives a business processing message sent by an intranet access control platform, which includes a target address link; when a trigger operation of a user clicking on the target address link or other triggering behavior is detected, an intranet business access request is sent to the intranet access control platform.

[0054] In this way, users can complete user identity authentication and intranet service access by triggering the target address link without installing additional VPN clients or configuring complex network parameters. This greatly simplifies the access process for target terminals, especially non-professional users, and significantly reduces technical support requirements and user training costs.

[0055] In a possible implementation, in the above step 302, returning the user identity information based on the identity authentication page includes: The identity authentication page is displayed in a preset display area; user identity information is determined based on user credentials input into the identity authentication page; and the user identity information is returned to the intranet access control platform.

[0056] In the embodiment of the present application, if it is identified that the target terminal is being authenticated for the first time, the identity authentication page is displayed in the preset display area, such as Figure 4 As shown in the figure, a personal identification number (PIN) input box pops up to prompt the user to complete identity authentication. If the authentication is successful, the user identity information is returned to the intranet access control platform.

[0057] Optionally, if the target terminal has saved a valid session credential (with an expiration time that can be set), there is no need to enter the user credential again as long as the session has not expired.

[0058] In a possible implementation, in the above step 303, receiving the service processing page returned by the intranet service system based on the intranet service access request includes: Establish a network security tunnel with the intranet access control platform; the intranet access control platform is used to forward the intranet business access request to the intranet business system, and send the business processing page returned by the intranet business system based on the intranet business access request to the target terminal; obtain the business processing page sent by the intranet access control platform through the network security tunnel.

[0059] In an embodiment of the present application, a network security tunnel is established between intranet access control platforms. For example, the target terminal can access it under WIFI, or under data traffic, etc.; when the intranet access control platform determines that the user identity information has the access right to the intranet business data, it forwards the intranet business access request to the intranet business system, and returns the business processing page of the intranet business system to the target terminal through the network security tunnel. The target terminal obtains the business processing page sent by the intranet access control platform through the network security tunnel to ensure the security of information transmission.

[0060] In an exemplary embodiment, the above-mentioned method for accessing intranet service data is described by taking the SIM intranet communication platform as an example. Figure 5 As shown in , the SIM intranet communication platform 510 includes a security gateway protection module 511 , a super SIM trusted authentication module 512 and a short link service module 513 .

[0061] The intranet business system 520 is used to detect to-do items. When a to-do item corresponding to a target user is detected, a first business processing message is sent to the security gateway protection module 511. The first business processing message includes an intranet address link 1. The security gateway protection module 512 is used to convert the intranet address link 1 into the public network address link 2; The super SIM trusted authentication module 513 is used to perform enhanced security encapsulation on the public network address link 2 to obtain the encrypted public network address link 3; specifically, the super SIM trusted authentication module 513 is used to encrypt the public network address link 2 through the target public key in the SIM card on the mobile terminal to obtain the encrypted public network address link 3; The short link service module 513 is used to convert the encrypted public network address link 3 into a target address link 4 with a specific domain name, and send the target address link 4 to the mobile terminal 540; The user clicks on the target address link 4 via the mobile terminal 540; The short link service module 513 is used for resolving the target address link 4 into the encrypted public network address link 3 in response to the triggering operation of the mobile terminal 540 on the target address link 4; The super SIM trusted authentication module 513 is used to extract the encrypted information in the encrypted public network address link 3 and parse it into the public network address link 2; trigger the mobile terminal 540 to perform super SIM security authentication; The mobile terminal 540 is used to pop up an identity authentication page during the first authentication, obtain the PIN code entered by the user, establish a network security tunnel with the security gateway protection module 512 when the authentication is successful, and receive the business processing page returned by the intranet business system 520 through the network security tunnel; if the authentication fails, click the target address link 4 again; The security gateway protection module 512 is used to allow the access request and perform access control on the business processing page.

[0062] The embodiment of the present application provides a method for accessing intranet business data, wherein the target terminal sends an intranet business access request to the intranet access control platform; obtains the identity authentication page sent by the intranet access control platform based on the intranet business access request, and returns user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has the access rights to the intranet business data; and receives the business processing page returned by the intranet business system based on the intranet business access request. In this way, the user can complete user identity authentication and intranet business access by triggering the target address link without installing an additional VPN client or configuring complex network parameters, which greatly simplifies the access process of the target terminal, especially non-professional users, and improves the user experience.

[0063] In addition, the intranet access control platform processes the target address link corresponding to the intranet service access request initiated by the target terminal, and verifies the user identity and access rights based on the user's unique identifier, thereby ensuring that only users with corresponding access rights can access intranet services, preventing unauthorized access due to improper device configuration, and reducing the risk of information leakage.

[0064] Figure 6 The structure diagram of the intranet access control platform provided by the embodiment of the present application is shown as one of the schematic diagrams. The intranet access control platform can be implemented as follows: Figure 1 All or part of the contents of the embodiment shown, the intranet access control platform 600 includes: The link resolution module 610 is used to respond to the intranet service access request initiated by the target terminal and resolve the target address link corresponding to the intranet service access request into an encrypted public network address link; An information decryption module 620, configured to decrypt the encrypted information in the encrypted public network address link to obtain a unique user identifier of the target terminal; The information acquisition module 630 is used to acquire the user identity information returned by the target terminal based on the identity authentication page by sending the identity authentication page to the target terminal corresponding to the user unique identifier; The request forwarding module 640 is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has the access rights to the intranet business data; the intranet business system is used to return the business processing page to the target terminal according to the intranet business access request.

[0065] In a possible implementation, the intranet access control platform 600 further includes: A security encapsulation module is used to obtain a first business processing message sent by the intranet business system, wherein the first business processing message is sent by the intranet business system when a to-do item corresponding to a target user is detected, and the first business processing message includes an intranet address link, to-do content and the target user; securely encapsulate the intranet address link to obtain a target address link; generate a second business processing message based on the target address link and the to-do content; and send the second business processing message to a target terminal corresponding to the target user.

[0066] In a possible implementation, the security encapsulation module, when used to securely encapsulate the intranet address link to obtain the target address link, is specifically used to: Converting the intranet address link to a public network address link; The public network address link is encrypted by using the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, wherein the encrypted public network address link includes a user unique identifier corresponding to the target user; The encrypted public network address link is converted into a target address link with a specific domain name.

[0067] In a possible implementation, the information decryption module 620, when used to decrypt the encrypted information in the encrypted public network address link to obtain the user unique identifier of the target terminal, is specifically used to: Obtaining a target private key from a SIM card on the target terminal; The encrypted information in the encrypted public network address link is decrypted using the target private key to obtain a unique user identifier of the target terminal.

[0068] In a possible implementation, the request forwarding module 640, when used to determine that the user identity information has the access right to the intranet service data, is specifically used to: When it is determined, according to the network access control list and the role-based access control model, that the user corresponding to the user identity information is in a user group having access rights, it is determined that the user identity information has access rights to the intranet business data.

[0069] In a possible implementation, the request forwarding module 640, when used to forward the intranet service access request to the intranet service system, is specifically used to: Establishing a network security tunnel with the target terminal; The intranet service access request is forwarded to the intranet service system, and the service processing page of the intranet service system is returned to the target terminal through the network security tunnel.

[0070] The embodiment of the present application provides an intranet business data access device, including a link parsing module, an information decryption module, an information acquisition module and a request forwarding module; the link parsing module responds to the intranet business access request initiated by the target terminal, and resolves the target address link corresponding to the intranet business access request into an encrypted public network address link; the information decryption module decrypts the encrypted information in the encrypted public network address link to obtain the user unique identifier of the target terminal; the information acquisition module obtains the user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user unique identifier; the request forwarding module forwards the intranet business access request to the intranet business system when it is determined that the user identity information has the intranet business data access permission; the intranet business system is used to return the business processing page to the target terminal according to the intranet business access request. In this way, it can be ensured that only users with corresponding access permissions can access the intranet business, prevent unauthorized access caused by improper device configuration, and reduce the risk of information leakage.

[0071] Figure 7 The second schematic diagram of the structure of the terminal provided in the embodiment of the present application is shown. The terminal can implement the following Figure 3 In the embodiment shown, all or part of the contents, the terminal 700 includes: An access request module 710 is used to send an intranet service access request to the intranet access control platform; The information sending module 720 is used to obtain the identity authentication page sent by the intranet access control platform based on the intranet service access request, and return the user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has the access right to the intranet service data; The page receiving module 730 is used to receive the business processing page returned by the intranet business system based on the intranet business access request.

[0072] In a possible implementation, the access request module 710, when used to send an intranet service access request to the intranet access control platform, is specifically used to: Receiving a business processing message sent by the intranet access control platform, wherein the business processing message includes a target address link; In response to the triggering operation on the target address link, an intranet service access request is sent to the intranet access control platform.

[0073] In a possible implementation, the information sending module 720, when used to return the user identity information based on the identity authentication page, is specifically used to: Displaying the identity authentication page in a preset display area; Determining user identity information based on user credentials entered into the identity authentication page; The user identity information is returned to the intranet access control platform.

[0074] In a possible implementation, the page receiving module 730, when used to receive the service processing page returned by the intranet service system based on the intranet service access request, is specifically used to: Establishing a network security tunnel with the intranet access control platform; the intranet access control platform is used to forward the intranet service access request to the intranet service system, and send the service processing page returned by the intranet service system based on the intranet service access request to the target terminal; The business processing page sent by the intranet access control platform is obtained through the network security tunnel.

[0075] The embodiment of the present application provides a terminal, including an access request module, an information sending module and a page receiving module; the access request module sends an intranet service access request to an intranet access control platform; the information sending module obtains the identity authentication page sent by the intranet access control platform based on the intranet service access request, and returns the user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has the access right to the intranet service data; the page receiving module receives the service processing page returned by the intranet service system based on the intranet service access request. In this way, the user can complete the user identity authentication and intranet service access by triggering the target address link without installing an additional VPN client or configuring complex network parameters, which greatly simplifies the access process of the target terminal, especially non-professional users, and improves the user experience.

[0076] In addition, the intranet access control platform processes the target address link corresponding to the intranet service access request initiated by the target terminal, and verifies the user identity and access rights based on the user's unique identifier, thereby ensuring that only users with corresponding access rights can access intranet services, preventing unauthorized access due to improper device configuration, and reducing the risk of information leakage.

[0077] Figure 8The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 800 includes a processor 810, and optionally, includes an internal bus 820, a network interface 830, and a memory 840. Among them, the memory 840 may include a memory 841, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 842 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 800 may also include hardware required for other services.

[0078] The processor 810, the network interface 830 and the memory may be connected to each other via an internal bus 820, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0079] The memory 840 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 840 may include a memory 841 and a non-volatile memory 842, and provide instructions and data to the processor 810.

[0080] The processor 810 reads the corresponding computer program from the non-volatile memory 842 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 810 executes the program stored in the memory and specifically performs: Figure 1 or Figure 3 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0081] The above application Figure 1 or Figure 3The method disclosed in the illustrated embodiment can be applied to the processor 810 or implemented by the processor 810. The processor 810 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 810. The above processor 810 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0082] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0083] Of course, in addition to software implementation, the electronic device 800 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0084] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 or Figure 3 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0085] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0086] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1 or Figure 3 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0087] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0088] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0089] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0090] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0091] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0092] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A method for accessing intranet business data, applied to an intranet access control platform, characterized in that: include: In response to an intranet service access request initiated by a target terminal, resolving a target address link corresponding to the intranet service access request into an encrypted public network address link; Decrypting the encrypted information in the encrypted public network address link to obtain a unique user identifier of the target terminal; By sending an identity authentication page to a target terminal corresponding to the user unique identifier, obtaining user identity information returned by the target terminal based on the identity authentication page; When it is determined that the user identity information has access rights to intranet business data, the intranet business access request is forwarded to the intranet business system; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request.

2. The method according to claim 1, characterized in that Before the step of responding to the intranet service access request initiated by the target terminal and resolving the target address link corresponding to the intranet service access request into an encrypted public network address link, the step further includes: Acquire a first business processing message sent by the intranet business system, where the first business processing message is sent by the intranet business system when a to-do item corresponding to a target user is detected, and the first business processing message includes an intranet address link, to-do content, and the target user; Securely encapsulate the intranet address link to obtain a target address link; Generate a second business processing message according to the target address link and the to-do content; Send the second service processing message to the target terminal corresponding to the target user.

3. The method according to claim 2, characterized in that The step of securely encapsulating the intranet address link to obtain a target address link includes: Converting the intranet address link to a public network address link; The public network address link is encrypted by using the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, wherein the encrypted public network address link includes a user unique identifier corresponding to the target user; The encrypted public network address link is converted into a target address link with a specific domain name.

4. The method according to claim 1, characterized in that: The decrypting of the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal includes: Obtaining a target private key from a SIM card on the target terminal; The encrypted information in the encrypted public network address link is decrypted using the target private key to obtain a unique user identifier of the target terminal.

5. The method according to claim 1, characterized in that Determining that the user identity information has access rights to intranet business data includes: When it is determined, according to the network access control list and the role-based access control model, that the user corresponding to the user identity information is in a user group with access rights, it is determined that the user identity information has access rights to the intranet business data.

6. The method according to claim 1, characterized in that The forwarding the intranet service access request to the intranet service system includes: Establishing a network security tunnel with the target terminal; The intranet service access request is forwarded to the intranet service system, and the service processing page of the intranet service system is returned to the target terminal through the network security tunnel.

7. A method for accessing intranet service data, applied to a target terminal, characterized in that: include: Sending intranet service access request to the intranet access control platform; Obtaining an identity authentication page sent by the intranet access control platform based on the intranet service access request, and returning user identity information based on the identity authentication page; The intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has the access right to the intranet service data; Receive a service processing page returned by the intranet service system based on the intranet service access request.

8. The method according to claim 7, characterized in that The sending of the intranet service access request to the intranet access control platform includes: Receiving a business processing message sent by the intranet access control platform, wherein the business processing message includes a target address link; In response to the triggering operation on the target address link, an intranet service access request is sent to the intranet access control platform.

9. The method according to claim 7, characterized in that: The returning the user identity information based on the identity authentication page includes: Displaying the identity authentication page in a preset display area; Determining user identity information based on user credentials entered into the identity authentication page; The user identity information is returned to the intranet access control platform.

10. The method according to claim 7, characterized in that Receiving a service processing page returned by the intranet service system based on the intranet service access request includes: Establishing a network security tunnel with the intranet access control platform; the intranet access control platform is used to forward the intranet service access request to the intranet service system, and send the service processing page returned by the intranet service system based on the intranet service access request to the target terminal; The business processing page sent by the intranet access control platform is obtained through the network security tunnel.

11. An intranet access control platform, characterized in that: include: A link resolution module, configured to respond to an intranet service access request initiated by a target terminal and resolve a target address link corresponding to the intranet service access request into an encrypted public network address link; An information decryption module, used to decrypt the encrypted information in the encrypted public network address link to obtain a unique user identifier of the target terminal; An information acquisition module, configured to acquire user identity information returned by the target terminal based on the identity authentication page by sending the identity authentication page to the target terminal corresponding to the user unique identifier; The request forwarding module is used to forward the intranet business access request to the intranet business system when it is determined that the user identity information has the access rights to the intranet business data; the intranet business system is used to return the business processing page to the target terminal according to the intranet business access request.

12. A terminal, characterized in that: include: An access request module is used to send an intranet service access request to the intranet access control platform; An information sending module is used to obtain an identity authentication page sent by the intranet access control platform based on the intranet service access request, and return user identity information based on the identity authentication page; The intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has the access right to the intranet service data; The page receiving module is used to receive the business processing page returned by the intranet business system based on the intranet business access request.

13. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer is caused to perform the steps of the method according to any one of claims 1 to 10.

Images