Intranet service data access method and related device

Abstract

The application discloses an intranet service data access method and related equipment, and belongs to the technical field of network security. The method is applied to an intranet access control platform and comprises the following steps: in response to an intranet service access request initiated by a target terminal, an encrypted public network address link is parsed from a target address link corresponding to the intranet service access request; encrypted information in the encrypted public network address link is decrypted to obtain a user unique identifier of the target terminal; an identity authentication page is sent to the target terminal corresponding to the user unique identifier, and user identity information returned by the target terminal based on the identity authentication page is acquired; and the intranet service access request is forwarded to an intranet service system under the condition that the user identity information has intranet service data access permission. In this way, only users with corresponding access permission can access intranet services, unauthorized access caused by improper device configuration is prevented, and the risk of information leakage is reduced.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and related equipment for accessing intranet business data. Background Technology

[0002] With the continuous evolution of mobile communication technology and the deepening of enterprise informatization, mobile terminals have become an important tool for employees to access the enterprise intranet and conduct business activities anytime and anywhere. In order to ensure that mobile devices can securely and efficiently access internal enterprise resources in the public Internet environment, the industry has widely adopted Virtual Private Network (VPN) technology as a solution.

[0003] Traditional VPN technology establishes a secure tunnel across the public internet by installing dedicated client software on mobile devices, allowing remote users to interact with data as if they were on a corporate intranet. This process typically involves the following steps: First, users install and configure the VPN client application on their mobile devices, such as smartphones, following instructions provided by the company; second, users must authenticate themselves by providing a username and complex password assigned by the company; after successful authentication, the client software encapsulates and forwards the user's network traffic to the corporate intranet via an encrypted communication protocol, enabling secure access to internal resources.

[0004] Although VPN technology provides basic security for mobile devices accessing corporate intranets, there is still a risk of sensitive corporate information being leaked if the user's device itself has security vulnerabilities or is improperly configured. Summary of the Invention

[0005] This application provides a method and related equipment for accessing intranet business data, which at least solves the problem that the risk of intranet information leakage is high when user equipment has security vulnerabilities or is misconfigured.

[0006] To solve the above-mentioned technical problems, this application is implemented as follows:

[0007] In a first aspect, embodiments of this application provide an intranet business data access method, applied to an intranet access control platform, comprising: responding to an intranet business access request initiated by a target terminal, parsing the target address link corresponding to the intranet business access request into an encrypted public IP address link; decrypting the encrypted information in the encrypted public IP address link to obtain a unique user identifier of the target terminal; obtaining user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the unique user identifier; and, if it is determined that the user identity information has intranet business data access permissions, forwarding the intranet business access request to an intranet business system; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request.

[0008] Secondly, embodiments of this application provide an intranet service data access method applied to a target terminal, comprising: sending an intranet service access request to an intranet access control platform; obtaining an authentication page sent by the intranet access control platform based on the intranet service access request, and returning user identity information based on the authentication page; the intranet access control platform forwarding the intranet service access request to an intranet service system when it determines that the user identity information has intranet service data access permissions; and receiving a service processing page returned by the intranet service system based on the intranet service access request.

[0009] Thirdly, this application provides an intranet access control platform, comprising: a link parsing module, configured to, in response to an intranet service access request initiated by a target terminal, parse the target address link corresponding to the intranet service access request into an encrypted public IP address link; an information decryption module, configured to decrypt the encrypted information in the encrypted public IP address link to obtain the user's unique identifier of the target terminal; an information acquisition module, configured to, by sending an identity authentication page to the target terminal corresponding to the user's unique identifier, acquire the user's identity information returned by the target terminal based on the identity authentication page; and a request forwarding module, configured to, if it is determined that the user's identity information has intranet service data access permissions, forward the intranet service access request to the intranet service system; the intranet service system is configured to, according to the intranet service access request, return a service processing page to the target terminal.

[0010] Fourthly, this application provides a terminal, comprising: an access request module for sending an intranet service access request to an intranet access control platform; an information sending module for obtaining an authentication page sent by the intranet access control platform based on the intranet service access request, and returning user identity information based on the authentication page; the intranet access control platform for forwarding the intranet service access request to an intranet service system when it determines that the user identity information has intranet service data access permissions; and a page receiving module for receiving a service processing page returned by the intranet service system based on the intranet service access request.

[0011] Fifthly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first or second aspect above.

[0012] In a sixth aspect, embodiments of this application provide a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first or second aspect above.

[0013] In a seventh aspect, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the steps of the method described in the first or second aspect above.

[0014] In this embodiment, the intranet access control platform responds to an intranet service access request initiated by a target terminal by parsing the target address link corresponding to the intranet service access request into an encrypted public IP address link; decrypting the encrypted information in the encrypted public IP address link to obtain the target terminal's unique user identifier; sending an authentication page to the target terminal corresponding to the unique user identifier to obtain the user identity information returned by the target terminal based on the authentication page; and forwarding the intranet service access request to the intranet service system if it is determined that the user identity information has intranet service data access permissions. The intranet service system then returns a service processing page to the target terminal based on the intranet service access request. In this way, by parsing the target address link corresponding to the intranet service access request initiated by the target terminal to obtain the unique user identifier, and verifying the user's identity and access permissions based on this unique user identifier, it can ensure that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 This paper illustrates a flowchart of an intranet service data access method provided in an embodiment of this application.

[0018] Figure 2 This illustration shows an example diagram of the internal and external network conversion of service processing messages provided in an embodiment of this application;

[0019] Figure 3 This paper illustrates another flowchart of the intranet service data access method provided in an embodiment of this application.

[0020] Figure 4 An example diagram of the identity authentication page provided in an embodiment of this application is shown;

[0021] Figure 5 This paper illustrates a service timing diagram of an intranet service data access method provided in an embodiment of this application.

[0022] Figure 6 This paper shows one of the structural schematic diagrams of the intranet service data access device provided in an embodiment of this application;

[0023] Figure 7 This is a second schematic diagram of the structure of the intranet service data access device provided in an embodiment of this application;

[0024] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0025] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0026] Figure 1This illustration shows a flowchart of an intranet service data access method provided in an embodiment of this application. The execution subject of this method can be a terminal device or a server. The terminal device can be a personal computer, a mobile terminal device such as a mobile phone or tablet, or a user-used terminal device. The server can be an independent server or a server cluster composed of multiple servers. Furthermore, the server can be a backend server for a specific service, or a backend server for a platform or application (e.g., an intranet access control platform, a Super SIM intranet platform, a proxy gateway, etc.). This embodiment uses an intranet access control platform as the execution subject for illustration. For the terminal device, the following related content can be used, and will not be repeated here. As shown in the figure, the intranet service data access method 100 may include the following steps:

[0027] Step 101: In response to the intranet service access request initiated by the target terminal, parse the target address link corresponding to the intranet service access request into an encrypted public network address link.

[0028] In practice, users initiate intranet service access requests through target terminals. Specifically, users can initiate intranet service access requests by clicking on a target address link. The intranet access control platform responds to these intranet service access requests by resolving the target address link corresponding to the intranet service access request into an encrypted public IP address link. Specifically, the intranet access control platform can pre-store the mapping relationship between the unique identifier in the target address link and the encrypted public IP address link in a database. Upon receiving an intranet access request, it extracts the unique identifier from the target address link and, based on this unique identifier, searches for the corresponding encrypted public key address link in the database.

[0029] Step 102: Decrypt the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal.

[0030] In practice, the intranet access control platform can use the decryption method corresponding to the encryption method of the encrypted public network address link to decrypt the encrypted information in the encrypted public network address link obtained in step 101 above, and obtain the unique user identifier of the target terminal. The encryption method may include symmetric encryption algorithm and asymmetric encryption algorithm; the unique user identifier may include device serial number, user ID, etc.

[0031] Step 103: By sending the identity authentication page to the target terminal corresponding to the user's unique identifier, obtain the user identity information returned by the target terminal based on the identity authentication page.

[0032] In practice, the intranet access control platform generates a Uniform Resource Locator (URL) for the authentication page based on the user's unique identifier and sends it to the target terminal to obtain user identity information such as username and mobile phone number returned by the target terminal based on the authentication page.

[0033] Step 104: If it is determined that the user identity information has intranet business data access permissions, the intranet business access request is forwarded to the intranet business system; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request.

[0034] In practice, the intranet access control platform checks whether the user corresponding to the user identity information returned by the target terminal has intranet business data access permissions. If it is determined that the user identity information has intranet business data access permissions, the intranet business access request is forwarded to the intranet business system. The intranet business system processes the intranet business access request and returns a business processing page. The intranet access control platform then sends the business processing page returned by the intranet business system to the target terminal.

[0035] In this way, by parsing the target address link corresponding to the intranet service access request initiated by the target terminal to obtain the user's unique identifier, and verifying the user's identity and access permissions based on the user's unique identifier, it can be ensured that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0036] In one possible implementation, before step 101 above, in response to an intranet service access request initiated by the target terminal, and before resolving the target address link corresponding to the intranet service access request into an encrypted public address link, the method further includes:

[0037] Step 105: Obtain the first business processing message sent by the intranet business system. The first business processing message is sent by the intranet business system when it detects the to-do item corresponding to the target user. The first business processing message includes an intranet address link, the to-do item content, and the target user.

[0038] In this embodiment, the intranet business system detects the to-do items corresponding to the target user. These to-do items can be those assigned by administrators or generated by the intranet business system when an applicant submits an application such as a business trip, leave, or expense reimbursement, for the target user's approval. If a to-do item corresponding to the target user is detected in the intranet business system, a first business processing message is generated. This first business processing message can be an SMS message, a 5G message, etc. Figure 2As shown, the first business processing message 210 includes an intranet address link 211, a to-do item 212, and a target user.

[0039] Step 106: Securely encapsulate the intranet address link to obtain the target address link.

[0040] Continuing with the above embodiment, the internal network address link 211 is securely encapsulated to obtain the target address link 221. This can prevent data leakage or unauthorized access, which is beneficial for protecting sensitive information and enhancing information security.

[0041] Step 107: Generate a second business processing message based on the target address link and the to-do content.

[0042] Continuing with the above embodiment, a second business processing message 220 is generated based on the target address link 221 and the to-do content 212. Sensitive information in the to-do content 212 can be hidden, resulting in to-do content 222.

[0043] Step 108: Send the second service processing message to the target terminal corresponding to the target user.

[0044] Continuing with the previous embodiment, a second service processing message 220 is sent to the target terminal corresponding to the target user. This ensures that the target terminal receives a clear and secure service processing message, improving user experience. Furthermore, by converting the service processing message between internal and external networks, information leakage or unauthorized access can be avoided.

[0045] In one possible implementation, step 106 above, which involves securely encapsulating the intranet address link to obtain the target address link, includes:

[0046] The internal network address link is converted into a public network address link; the public network address link is encrypted using the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, which includes the unique user identifier corresponding to the target user; the encrypted public network address link is converted into a target address link with a specific domain name.

[0047] In this embodiment, Network Address Translation (NAT) technology can be used to convert an internal network address link into a public network address link, enabling external users to access the address link. A link containing a unique user identifier is generated, and this information is encrypted using the target public key in the SIM card on the target terminal, securely encapsulating the public network address link into an encrypted public network address link. This achieves enhanced security encapsulation of the public network address link, where the encrypted public network address link includes the unique user identifier corresponding to the target user. Furthermore, the encrypted public network address link is converted into a target address link with a specific domain name, such as hfx.net, to improve user recognition and trust in the link.

[0048] In this way, by encapsulating internal network address links in a multi-layered and progressive manner, the ability of internal network resources to resist attacks can be improved, effectively preventing unauthorized users from intercepting, tampering with, or forging access links.

[0049] In one possible implementation, step 102 above, which involves decrypting the encrypted information in the encrypted public IP address link to obtain the unique user identifier of the target terminal, includes:

[0050] Obtain the target private key from the SIM card on the target terminal; use the target private key to decrypt the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal.

[0051] In this embodiment, the target private key in the SIM card on the target terminal is obtained, and the encrypted information in the encrypted public network address link is decrypted using the target private key to obtain the unique user identifier of the target terminal. By utilizing the hardware security features of the SIM card, user identity authentication is pushed down to the chip level, achieving physical isolation and greatly improving the ability to resist advanced threats such as side-channel attacks and physical tampering.

[0052] In one possible implementation, step 104 above, determining that the user identity information has intranet business data access permissions, includes:

[0053] If, based on the network access control list and the role-based access control model, it is determined that the user corresponding to the user identity information is within a user group with access permissions, then the user identity information is determined to have intranet business data access permissions.

[0054] In this embodiment of the application, the system can identify whether the user corresponding to the user identity information is in a user group with access permissions based on the network access control list (ACL) and role-based access control (RBAC) models. If the authentication is successful and the user has the necessary permissions, it can be determined that the user identity information has access permissions for intranet business data.

[0055] In one possible implementation, step 104 above, forwarding the intranet service access request to the intranet service system, includes:

[0056] Establish a network security tunnel with the target terminal; forward the intranet service access request to the intranet service system, and return the service processing page of the intranet service system to the target terminal through the network security tunnel.

[0057] In this embodiment of the application, when it is determined that the user's identity information has access to intranet business data, a network security tunnel is established with the target terminal. For example, the target terminal can access the network under WIFI or under data traffic. The intranet business access request is forwarded to the intranet business system, and the business processing page of the intranet business system is returned to the target terminal through the network security tunnel to ensure the security of information transmission.

[0058] This application provides a method for accessing intranet business data. Applied to an intranet access control platform, this method responds to an intranet business access request initiated by a target terminal by parsing the target address link corresponding to the intranet business access request into an encrypted public IP address link. The encrypted information in the encrypted public IP address link is decrypted to obtain the target terminal's unique user identifier. An authentication page is sent to the target terminal corresponding to the unique user identifier to obtain the user's identity information returned by the target terminal based on the authentication page. If it is determined that the user's identity information has intranet business data access permissions, the intranet business access request is forwarded to the intranet business system. This method ensures that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0059] Furthermore, by employing network address translation, role-based access control, network access control lists, strong encryption algorithms, and a dual authentication system using the SIM card's built-in private key, the ability of internal network resources to resist attacks can be enhanced, effectively preventing unauthorized users from intercepting, tampering with, or forging access links.

[0060] Figure 3This illustration shows another flowchart of the intranet service data access method provided in this application embodiment. The execution subject of this method can be a terminal device, such as a personal computer or a mobile terminal device such as a mobile phone or tablet computer. The terminal device can be a user-used terminal device. This application embodiment uses the target terminal as the execution subject as an example for explanation. As shown in the figure, the intranet service data access method 300 may include the following steps:

[0061] Step 301: Send an intranet service access request to the intranet access control platform.

[0062] In practice, the target terminal can send an intranet service access request to the intranet access control platform by clicking the target address link.

[0063] Step 302: Obtain the authentication page sent by the intranet access control platform based on the intranet service access request, and return the user's identity information based on the authentication page; the intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user's identity information has intranet service data access permissions.

[0064] In practice, after receiving an intranet service access request, the intranet access control platform processes the request accordingly, obtains the user's unique identifier, and sends an authentication page to the target terminal corresponding to the unique user identifier. The target terminal obtains the authentication page and returns user identity information such as username and mobile phone number based on the authentication page. If the intranet access control platform determines that the user's identity information has intranet service data access permissions, it forwards the intranet service access request to the intranet service system.

[0065] Step 303: Receive the business processing page returned by the intranet business system based on the intranet business access request.

[0066] In practice, the target terminal can establish a network security tunnel with the intranet access control platform, and receive the business processing page returned by the intranet business system based on the intranet business access request through the network security tunnel, and then complete the processing of the pending items on the business processing page on the target terminal.

[0067] In one possible implementation, step 301 above, sending an intranet service access request to the intranet access control platform, includes:

[0068] Receive a service processing message sent by the intranet access control platform, the service processing message including a target address link; in response to a trigger operation on the target address link, send an intranet service access request to the intranet access control platform.

[0069] In this embodiment of the application, the target terminal receives a service processing message sent by the intranet access control platform, which includes a target address link; upon detecting a user's click or other triggering operation on the target address link, the terminal sends an intranet service access request to the intranet access control platform.

[0070] In this way, users can complete user authentication and intranet service access by triggering the target address link, without having to install additional VPN clients or configure complex network parameters. This greatly simplifies the access process for target terminals, especially non-professional users, and significantly reduces the need for technical support and user training costs.

[0071] In one possible implementation, step 302 above, returning user identity information based on the identity authentication page, includes:

[0072] The identity authentication page is displayed in a preset display area; the user's identity information is determined based on the user credentials entered on the identity authentication page; and the user's identity information is returned to the intranet access control platform.

[0073] In this embodiment of the application, if the target terminal is identified as being authenticated for the first time, an identity authentication page is displayed in a preset display area, such as... Figure 4 As shown, a pop-up Personal Identification Number (PIN) input box prompts the user to complete identity authentication. If the authentication is successful, the user's identity information is returned to the intranet access control platform.

[0074] Optionally, if the target terminal has already saved a valid session credential (with an expiration time that can be set), the user credential does not need to be entered again as long as the session has not expired.

[0075] In one possible implementation, step 303 above, receiving the service processing page returned by the intranet service system based on the intranet service access request, includes:

[0076] A network security tunnel is established between the network access control platform and the intranet access control platform; the intranet access control platform forwards the intranet service access request to the intranet service system and sends the service processing page returned by the intranet service system based on the intranet service access request to the target terminal; the service processing page sent by the intranet access control platform is obtained through the network security tunnel.

[0077] In this embodiment, a network security tunnel is established between intranet access control platforms. For example, the target terminal can access the network via Wi-Fi or mobile data. When the intranet access control platform determines that the user's identity information has intranet business data access permissions, it forwards the intranet business access request to the intranet business system and returns the business processing page of the intranet business system to the target terminal through the network security tunnel. The target terminal obtains the business processing page sent by the intranet access control platform through the network security tunnel to ensure the security of information transmission.

[0078] In an exemplary embodiment, the above-described intranet service data access method is described using a SIM intranet platform as an example. Figure 5 As shown, the SIM intranet communication platform 510 includes a security gateway protection module 511, a super SIM trusted authentication module 512, and a short link service module 513.

[0079] The intranet business system 520 is used to detect pending items. When it detects a pending item corresponding to a target user, it sends a first business processing message to the security gateway protection module 511. The first business processing message includes the intranet address link 1.

[0080] Security gateway protection module 512 is used to convert internal network address link 1 to public network address link 2;

[0081] The Super SIM Trusted Authentication Module 513 is used to encapsulate the public network address link 2 into an encrypted public network address link 3 with enhanced security. Specifically, the Super SIM Trusted Authentication Module 513 is used to encrypt the public network address link 2 using the target public key in the SIM card on the mobile terminal to obtain the encrypted public network address link 3.

[0082] The short link service module 513 is used to convert the encrypted public network address link 3 into a target address link 4 with a specific domain name, and send the target address link 4 to the mobile terminal 540;

[0083] The user clicks on the target address link 4 via mobile terminal 540;

[0084] The short link service module 513 is used to respond to the trigger operation of the mobile terminal 540 on the target address link 4 and parse the target address link 4 into the encrypted public network address link 3;

[0085] The Super SIM trusted authentication module 513 is used to extract the encrypted information from the encrypted public network address link 3 and parse it to the public network address link 2; triggering the mobile terminal 540 to perform Super SIM security authentication;

[0086] The mobile terminal 540 is used to pop up an identity authentication page during the first authentication, obtain the PIN code entered by the user, establish a network security tunnel with the security gateway protection module 512 when the authentication is successful, and receive the business processing page returned by the intranet business system 520 through the network security tunnel; if the authentication fails, the target address link 4 is clicked again.

[0087] The security gateway protection module 512 is used to allow the access request and perform access control on the business processing page.

[0088] This application provides a method for accessing intranet service data. A target terminal sends an intranet service access request to an intranet access control platform; obtains an authentication page sent by the intranet access control platform based on the intranet service access request, and returns user identity information based on the authentication page; the intranet access control platform, if it determines that the user identity information has intranet service data access permissions, forwards the intranet service access request to the intranet service system; and receives a service processing page returned by the intranet service system based on the intranet service access request. In this way, users can complete user authentication and intranet service access simply by triggering a target address link, without installing additional VPN clients or configuring complex network parameters, greatly simplifying the access process for target terminals, especially for non-professional users, and improving user experience.

[0089] Furthermore, the intranet access control platform processes the target address link corresponding to the intranet service access request initiated by the target terminal, and verifies the user's identity and access permissions based on the user's unique identifier. This ensures that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0090] Figure 6 This illustration shows one of the structural diagrams of an intranet access control platform provided in an embodiment of this application. This intranet access control platform can achieve the following: Figure 1 The intranet access control platform 600, as shown in the embodiments, includes all or part of the following:

[0091] The link resolution module 610 is used to respond to an intranet service access request initiated by the target terminal and resolve the target address link corresponding to the intranet service access request into an encrypted public network address link.

[0092] The information decryption module 620 is used to decrypt the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal;

[0093] Information acquisition module 630 is used to acquire user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user's unique identifier;

[0094] The request forwarding module 640 is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has intranet service data access permissions; the intranet service system is used to return a service processing page to the target terminal according to the intranet service access request.

[0095] In one possible implementation, the intranet access control platform 600 also includes:

[0096] A secure encapsulation module is used to acquire a first business processing message sent by the intranet business system. The first business processing message is sent by the intranet business system when it detects a to-do item corresponding to a target user. The first business processing message includes an intranet address link, the to-do item, and the target user. The module performs secure encapsulation on the intranet address link to obtain a target address link. Based on the target address link and the to-do item, a second business processing message is generated. The module then sends the second business processing message to the target terminal corresponding to the target user.

[0097] In one possible implementation, the security encapsulation module, when used to securely encapsulate the intranet address link to obtain the target address link, specifically performs the following:

[0098] Convert the internal network address link to a public network address link;

[0099] The public network address link is encrypted using the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, which includes the unique user identifier corresponding to the target user.

[0100] The encrypted public IP address link is converted into a target address link with a specific domain name.

[0101] In one possible implementation, the information decryption module 620, when used to decrypt the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal, is specifically used for:

[0102] Obtain the target private key from the SIM card on the target terminal;

[0103] Using the target private key, the encrypted information in the encrypted public IP address link is decrypted to obtain the unique user identifier of the target terminal.

[0104] In one possible implementation, the request forwarding module 640, when determining that the user identity information has intranet service data access permissions, specifically performs the following:

[0105] If, based on the network access control list and the role-based access control model, it is determined that the user corresponding to the user identity information is within a user group with access permissions, then the user identity information is determined to have intranet business data access permissions.

[0106] In one possible implementation, the request forwarding module 640, when forwarding the intranet service access request to the intranet service system, is specifically used for:

[0107] Establish a network security tunnel with the target terminal;

[0108] The intranet service access request is forwarded to the intranet service system, and the service processing page of the intranet service system is returned to the target terminal through the network security tunnel.

[0109] This application provides an intranet service data access device, including a link parsing module, an information decryption module, an information acquisition module, and a request forwarding module. The link parsing module, in response to an intranet service access request initiated by a target terminal, parses the target address link corresponding to the intranet service access request into an encrypted public IP address link. The information decryption module decrypts the encrypted information in the encrypted public IP address link to obtain the unique user identifier of the target terminal. The information acquisition module obtains the user identity information returned by the target terminal based on the identity authentication page by sending an authentication page to the target terminal corresponding to the unique user identifier. The request forwarding module, upon determining that the user identity information has intranet service data access permissions, forwards the intranet service access request to the intranet service system. The intranet service system returns a service processing page to the target terminal based on the intranet service access request. This method ensures that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0110] Figure 7 This is a second schematic diagram of the structure of a terminal provided in an embodiment of this application. This terminal can achieve the following: Figure 3 The terminal 700, comprising all or part of the contents shown in the embodiment, includes:

[0111] Access request module 710 is used to send intranet service access requests to the intranet access control platform;

[0112] The information sending module 720 is used to obtain the identity authentication page sent by the intranet access control platform based on the intranet service access request, and return user identity information based on the identity authentication page; the intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has intranet service data access permissions.

[0113] The page receiving module 730 is used to receive the business processing page returned by the intranet business system based on the intranet business access request.

[0114] In one possible implementation, the access request module 710, when used to send an intranet service access request to the intranet access control platform, is specifically used for:

[0115] Receive a service processing message sent by the intranet access control platform, wherein the service processing message includes a target address link;

[0116] In response to the triggering operation of the target address link, an intranet service access request is sent to the intranet access control platform.

[0117] In one possible implementation, the information sending module 720, when used to return user identity information based on the identity authentication page, is specifically used for:

[0118] The identity authentication page is displayed in a preset display area;

[0119] The user's identity information is determined based on the user credentials entered on the identity authentication page;

[0120] The user identity information is returned to the intranet access control platform.

[0121] In one possible implementation, the page receiving module 730, when receiving the business processing page returned by the intranet business system based on the intranet business access request, is specifically used for:

[0122] Establish a network security tunnel between the internal network access control platform and the internal network access control platform; the internal network access control platform is used to forward the internal network service access request to the internal network service system, and send the service processing page returned by the internal network service system based on the internal network service access request to the target terminal.

[0123] The service processing page sent by the intranet access control platform is obtained through the network security tunnel.

[0124] This application provides a terminal including an access request module, an information sending module, and a page receiving module. The access request module sends an intranet service access request to an intranet access control platform. The information sending module obtains an authentication page sent by the intranet access control platform based on the intranet service access request and returns user identity information based on the authentication page. The intranet access control platform, upon determining that the user identity information has intranet service data access permissions, forwards the intranet service access request to the intranet service system. The page receiving module receives a service processing page returned by the intranet service system based on the intranet service access request. In this way, users can complete user authentication and intranet service access simply by triggering a target address link, without needing to install additional VPN clients or configure complex network parameters. This greatly simplifies the access process for target terminals, especially for non-professional users, and improves the user experience.

[0125] Furthermore, the intranet access control platform processes the target address link corresponding to the intranet service access request initiated by the target terminal, and verifies the user's identity and access permissions based on the user's unique identifier. This ensures that only users with the corresponding access permissions can access intranet services, preventing unauthorized access due to improper device configuration and reducing the risk of information leakage.

[0126] Figure 8 This diagram illustrates the hardware structure of an electronic device implementing the embodiments of this application. Referring to the diagram, at the hardware level, the electronic device 800 includes a processor 810, and optionally includes an internal bus 820, a network interface 830, and a memory 840. The memory 840 may include main memory 841, such as high-speed random-access memory (RAM), and may also include non-volatile memory 842, such as at least one disk storage device. Of course, the electronic device 800 may also include other hardware required for other services.

[0127] The processor 810, network interface 830, and memory can be interconnected via an internal bus 820. This internal bus 820 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in this diagram, but this does not imply that there is only one bus or one type of bus.

[0128] Memory 840 stores programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 840 may include main memory 841 and non-volatile memory 842, and provides instructions and data to processor 810.

[0129] The processor 810 reads the corresponding computer program from the non-volatile memory 842 into memory and then runs it, forming a device for locating the target user at the logical level. The processor 810 executes the program stored in memory and specifically performs the following: Figure 1 or Figure 3 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0130] The above is as stated in this application. Figure 1 or Figure 3The methods disclosed in the illustrated embodiments can be applied to or implemented by processor 810. Processor 810 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 810 or by instructions in software form. The processor 810 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0131] The computer device can also execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0132] Of course, in addition to software implementation, the electronic device 800 of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0133] This application also proposes a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform... Figure 1 or Figure 3 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0134] The computer-readable storage medium mentioned above includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0135] Furthermore, embodiments of this application also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the following process: Figure 1 or Figure 3 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0136] The embodiments of this application can be applied to various scenarios of electronic device collaboration or interconnection, including: collaboration and interconnection between mobile phones and laptops / tablets; collaboration and interconnection between mobile terminals and smart TVs / monitors; collaboration and interconnection between mobile phones or tablets and in-vehicle entertainment systems; collaboration and interconnection between mobile terminals and smart conferencing systems, etc. This satisfies users' diverse needs in smart home, smart office, and smart travel scenarios.

[0137] In summary, the above description is merely a preferred embodiment of this application and does not limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0138] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0139] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can store information accessible to a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0140] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0141] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for accessing intranet business data, applied to an intranet access control platform, characterized in that, include: In response to an intranet service access request initiated by the target terminal, the target address link corresponding to the intranet service access request is parsed into an encrypted public network address link; The encrypted information in the encrypted public network address link is decrypted to obtain the unique user identifier of the target terminal. By sending an identity authentication page to the target terminal corresponding to the user's unique identifier, the user's identity information returned by the target terminal based on the identity authentication page is obtained; If it is determined that the user's identity information has intranet business data access permissions, the intranet business access request is forwarded to the intranet business system; the intranet business system is used to return a business processing page to the target terminal according to the intranet business access request. Specifically, before resolving the target address link corresponding to the intranet service access request initiated by the target terminal into an encrypted public address link, the method further includes: Obtain a first business processing message sent by the intranet business system. The first business processing message is sent by the intranet business system when it detects a to-do item corresponding to the target user. The first business processing message includes an intranet address link, the to-do item content, and the target user. The intranet address link is securely encapsulated to obtain the target address link; A second business processing message is generated based on the target address link and the to-do content; The second service processing message is sent to the target terminal corresponding to the target user.

2. The method according to claim 1, characterized in that, The step of securely encapsulating the intranet address link to obtain the target address link includes: Convert the internal network address link to a public network address link; The public network address link is encrypted using the target public key in the SIM card on the target terminal to obtain an encrypted public network address link, which includes the unique user identifier corresponding to the target user. The encrypted public IP address link is converted into a target address link with a specific domain name.

3. The method according to claim 1, characterized in that, The process of decrypting the encrypted information in the encrypted public IP address link to obtain the unique user identifier of the target terminal includes: Obtain the target private key from the SIM card on the target terminal; Using the target private key, the encrypted information in the encrypted public IP address link is decrypted to obtain the unique user identifier of the target terminal.

4. The method according to claim 1, characterized in that, The step of determining that the user identity information has intranet business data access permissions includes: If, based on the network access control list and the role-based access control model, it is determined that the user corresponding to the user identity information is within a user group with access permissions, then the user identity information is determined to have intranet business data access permissions.

5. The method according to claim 1, characterized in that, The forwarding of the intranet service access request to the intranet service system includes: Establish a network security tunnel with the target terminal; The intranet service access request is forwarded to the intranet service system, and the service processing page of the intranet service system is returned to the target terminal through the network security tunnel.

6. A method for accessing intranet service data, applied to a target terminal, characterized in that, include: Send an intranet service access request to the intranet access control platform; Obtain the authentication page sent by the intranet access control platform based on the intranet service access request, and return the user's identity information based on the authentication page; The intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user's identity information has intranet service data access permissions. Receive the business processing page returned by the intranet business system based on the intranet business access request; The step of sending an intranet service access request to the intranet access control platform includes: The system receives a business processing message sent by an intranet access control platform. The business processing message includes a target address link. The target address link is obtained by the intranet access control platform through secure encapsulation of an intranet address link. The intranet address link is sent by the intranet business system to the intranet access control platform when it detects the to-do items of the target user corresponding to the target terminal. In response to the triggering operation of the target address link, an intranet service access request is sent to the intranet access control platform.

7. The method according to claim 6, characterized in that, The return of user identity information based on the identity authentication page includes: The identity authentication page is displayed in a preset display area; The user's identity information is determined based on the user credentials entered on the identity authentication page; The user identity information is returned to the intranet access control platform.

8. The method according to claim 6, characterized in that, Receiving the business processing page returned by the intranet business system based on the intranet business access request, including: Establish a network security tunnel between the internal network access control platform and the internal network access control platform; the internal network access control platform is used to forward the internal network service access request to the internal network service system, and send the service processing page returned by the internal network service system based on the internal network service access request to the target terminal. The service processing page sent by the intranet access control platform is obtained through the network security tunnel.

9. An intranet access control platform, characterized in that, include: The link resolution module is used to respond to the intranet service access request initiated by the target terminal and resolve the target address link corresponding to the intranet service access request into an encrypted public network address link. The information decryption module is used to decrypt the encrypted information in the encrypted public network address link to obtain the unique user identifier of the target terminal. The information acquisition module is used to acquire user identity information returned by the target terminal based on the identity authentication page by sending an identity authentication page to the target terminal corresponding to the user's unique identifier; The request forwarding module is used to forward the intranet service access request to the intranet service system when it is determined that the user identity information has intranet service data access permissions; the intranet service system is used to return a service processing page to the target terminal according to the intranet service access request; A security encapsulation module is used to obtain a first business processing message sent by the intranet business system. The first business processing message is sent by the intranet business system when it detects a to-do item corresponding to the target user. The first business processing message includes an intranet address link, the to-do content, and the target user. The intranet address link is securely encapsulated to obtain the target address link; a second business processing message is generated based on the target address link and the to-do content; the second business processing message is sent to the target terminal corresponding to the target user.

10. A terminal, characterized in that, include: The access request module is used to send intranet service access requests to the intranet access control platform; The information sending module is used to obtain the identity authentication page sent by the intranet access control platform based on the intranet service access request, and return the user identity information based on the identity authentication page; The intranet access control platform is used to forward the intranet service access request to the intranet service system when it is determined that the user's identity information has intranet service data access permissions. The page receiving module is used to receive the business processing page returned by the intranet business system based on the intranet business access request; The access request module, when used to send intranet service access requests to the intranet access control platform, is specifically used for: The system receives a business processing message sent by an intranet access control platform. The business processing message includes a target address link. The target address link is obtained by the intranet access control platform through secure encapsulation of an intranet address link. The intranet address link is sent by the intranet business system to the intranet access control platform when it detects the to-do items of the target user corresponding to the target terminal. In response to the triggering operation of the target address link, an intranet service access request is sent to the intranet access control platform.

11. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

13. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 8.

Images