Cross-domain access system, method and device and computer equipment

Abstract

The invention relates to a cross-domain access system, method and device and computer equipment, and the system comprises an initial domain in which a first docking system and a first cross-domain access system are deployed; the first docking system sends an original cross-domain access request to a first cross-domain access system, wherein the original cross-domain access request comprises parameters of a target domain to be accessed; a first proxy service and a first nginx service are deployed in the first cross-domain access system, and the first proxy service is used for querying an address corresponding to a parameter of a target domain from a database of an initial domain according to the parameter of the target domain; updating the original cross-domain access request according to the address to obtain a new cross-domain access request; sending the new cross-domain access request to a second cross-domain access system of the target domain through the first nginx service to obtain a target service; a second cross-domain access system is deployed in the target domain, and a second proxy service is deployed in the second cross-domain access system. According to the scheme, the problem of multi-system cross-region access multiple NAT address translation is solved.

Description

Technical Field

[0001] The present invention relates to the field of software development, and in particular to a cross-domain access system, method, device and computer equipment. Background Art

[0002] The current cross-segment access technology is mainly to use NAT technology to enable hosts in network A to access network B. On the one hand, NAT alleviates the problem of IPv4 address shortage, and on the other hand, NAT technology prevents network A from communicating directly with network B, thus improving network security.

[0003] The existing cross-segment access technology requires the opening of a point-to-point access policy. If two systems access each other, NAT address conversion is required. If multiple systems access each other, a large number of NAT addresses will be wasted. If the network policy is no longer needed in the future, it will be difficult to recycle and reuse the NAT addresses. Summary of the invention

[0004] In order to solve the problem in the prior art that there is no data interaction between tools and the tools cannot be connected in series to form a whole, the embodiments of this specification provide a cross-domain access system, method, apparatus and computer device.

[0005] This embodiment of the specification provides a cross-domain access system, the system comprising:

[0006] A starting domain, wherein a first docking system and a first cross-domain access system are deployed in the starting domain; the first docking system is used to send an original cross-domain access request to the first cross-domain access system, wherein the original cross-domain access request includes: parameters of the target domain to be accessed; a first proxy service and a first nginx service are deployed in the first cross-domain access system, wherein the first proxy service is used to query the address corresponding to the parameters of the target domain to be accessed from the database of the starting domain according to the parameters of the target domain to be accessed; the original cross-domain access request is updated according to the address to obtain a new cross-domain access request; the new cross-domain access request is sent to the second cross-domain access system of the target domain through the first nginx service to obtain the target service;

[0007] A target domain, wherein the target domain is isolated from the starting domain, wherein a second cross-domain access system is deployed in the target domain, wherein a second proxy service is deployed in the second cross-domain access system, wherein the second proxy service is used to receive a new cross-domain access request, and query the address of the target system to be accessed from a database of the target domain according to parameters in the new cross-domain access request.

[0008] According to one aspect of the embodiments of this specification, the target domain also includes a second docking system, and the second docking system is used to provide services of the target system according to the address of the target system to be accessed.

[0009] According to one aspect of the embodiments of this specification, a bare metal area is deployed between the starting domain and the target domain, and the object storage and database of the starting domain and the target domain are deployed in the bare metal area respectively.

[0010] An embodiment of the present specification provides a cross-domain access method, the method comprising: receiving an original cross-domain access request issued by a first docking system, the original cross-domain access request including parameters of a target domain to be accessed; querying an address corresponding to the parameters of the target domain from a database of a starting domain according to the parameters of the target domain to be accessed; updating the original cross-domain access request according to the address to obtain a new cross-domain access request; and sending the new cross-domain access request to a second cross-domain access system of the target domain through a first nginx service to obtain a target service.

[0011] According to one aspect of an embodiment of the present specification, the original cross-domain access request further includes a target system to be accessed in the target domain, and sending the new cross-domain access request to the second cross-domain access system of the target domain through the first nginx service includes: the proxy service of the target domain queries from a database to obtain an address corresponding to the target service parameter according to the target service parameter in the new cross-domain access request; and sending the new cross-domain access request to the target service.

[0012] According to one aspect of an embodiment of the present specification, the method includes: encrypting the original cross-domain access request to generate an encryption request, and sending the encryption request to a cross-domain access system; when the cross-domain access system uses the public key in the encryption request to decrypt, decrypted data is obtained; verifying whether the decrypted data is consistent with the calculated signature; if they are consistent, the first proxy service sends the encryption request to the first nginx service.

[0013] According to one aspect of an embodiment of the present specification, the method includes: determining whether the request is a file download request; if so, determining whether the file involved in the file download request has been downloaded; if so, obtaining the file from a database; if not, determining whether to limit the flow of the file download request; if so, limiting the flow of the request in nginx.

[0014] According to one aspect of an embodiment of the present specification, when the request is a file download request, the method further includes: judging whether the file has been recorded based on the file version and hash information of the file involved in the file download request; if so, obtaining sensitive information of the file and determining the sensitivity level corresponding to the sensitive information; feeding back the sensitive information of files with a sensitivity level higher than a preset level to the docking system through a first proxy service; if not, checking the sensitive information of the file and determining the corresponding sensitivity level; sending files with a sensitivity level lower than the preset level to a second proxy service, and storing the sensitive information monitoring results and the file in the database of the starting domain.

[0015] The embodiment of this specification also provides a cross-domain access device, which includes: a request receiving unit, used to receive an original cross-domain access request issued by a first docking system, wherein the original cross-domain access request includes parameters of a target domain to be accessed; an address determining unit, used to query an address corresponding to the parameters of the target domain from a database of a starting domain according to the parameters of the target domain to be accessed; a request determining unit, used to update the original cross-domain access request according to the address to obtain a new cross-domain access request; and a target service determining unit, used to send the new cross-domain access request to the target domain through a first nginx service, and a second cross-domain access system of the target domain provides a cross-domain access service.

[0016] The embodiment of the present specification also provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the cross-domain access method is implemented when the processor executes the computer program.

[0017] The embodiment of the present specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the cross-domain access method is implemented.

[0018] The embodiments of this specification also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the cross-domain access method is implemented.

[0019] This solution solves the problem that multiple systems need to perform multiple NAT address translations when accessing across regions, preventing the leakage of sensitive information of important files and improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 The figure shows a flow chart of a cross-domain access system according to an embodiment of the present specification;

[0022] Figure 2 The figure shows a specific structural diagram of a cross-domain access system according to an embodiment of the present specification;

[0023] Figure 3 The figure is a flow chart of a cross-domain access method according to an embodiment of the present specification;

[0024] Figure 4 The figure is a flow chart of a method for sending a new cross-domain access request to a target service according to an embodiment of the present specification;

[0025] Figure 5 The figure is a flow chart of a method for verifying an original cross-domain access request according to an embodiment of the present specification;

[0026] Figure 6 The figure is a flow chart of a method for limiting the flow of file download requests according to an embodiment of the present specification;

[0027] Figure 7 The figure shows a flow chart of a method for processing sensitive files according to an embodiment of the present specification;

[0028] Figure 8 The figure shows a schematic diagram of the structure of a cross-domain access device according to an embodiment of the present specification;

[0029] Fig. 9 Shown is a schematic diagram of another cross-domain access system according to an embodiment of this specification;

[0030] Fig.10 Shown is a schematic diagram of a computer device provided in an embodiment of this specification.

[0031] Description of the accompanying symbols:

[0032] 110, start domain;

[0033] 120. Target domain;

[0034] 801, request receiving unit;

[0035] 802, address determination unit;

[0036] 803, request determination unit;

[0037] 804, target service determination unit;

[0038] 1002. Computer equipment;

[0039] 1004. Processor;

[0040] 1006. Memory;

[0041] 1008. Driving mechanism;

[0042] 1010, input / output module;

[0043] 1012. Input device;

[0044] 1014. Output device;

[0045] 1016. Presentation equipment;

[0046] 1018. Graphical user interface;

[0047] 1020. Network interface;

[0048] 1022. Communication link;

[0049] 1024. Communication bus. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0051] It should be noted that the terms "first", "second", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this specification described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0052] This specification provides method operation steps as described in the embodiments or flow charts, but more or fewer operation steps may be included based on routine or non-creative work. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the system or device product is executed in practice, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel.

[0053] It should be noted that the cross-domain access system, method, device and computer equipment of this specification can be used in the field of software development and in the field of computer technology. This specification does not limit the application field of the cross-domain access system, method, device and computer equipment.

[0054] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0055] The stability of the project is crucial for banks and other companies. If a project suddenly crashes during system operation, and no disaster recovery strategy has been adopted for the project before, the losses caused will be significant. In order to make the project more stable, this application proposes a cross-domain access system based on dual availability domains (AZ). All resources required for the cross-domain access system are based on the ecological cloud environment. The required databases, message queues, and container service resources are all based on the cloud environment, which can make project research and development more convenient and secure. Dual availability domains can make the operation of the project more stable.

[0056] Figure 1 The figure is a schematic diagram of a cross-domain access system according to an embodiment of the present specification, which specifically includes:

[0057] The starting domain 110 and the target domain 120. In the embodiment of the present specification, the starting domain 110 and the target domain 120 are two independent network environments, and the two cannot directly interact with each other. Among them, the first docking system and the first cross-domain access system are deployed in the starting domain. The first docking system is used to send an original cross-domain access request to the first cross-domain access system, and the original cross-domain access request includes: parameters of the target domain to be accessed.

[0058] In the embodiment of this specification, the starting domain 110 may be an office domain in the company's internal network environment, and the target domain 120 may be a business domain in the company's internal network environment. In order to protect the security of enterprise data information, the office domain and the business domain are isolated. The front-end may be published in the office domain, and accessing the front-end resources from the business domain to the office domain is called static resource cross-segment access.

[0059] In this specification, the order of request access of the initiating domain 110 and the target domain 120 can be interchanged. For example, the target domain 120 generates a demand for obtaining relevant data in a management system in the initiating domain 110 according to business needs, and the target domain 120 can issue an original cross-domain access request, the purpose of which is to obtain data information provided by a target service in the initiating domain 110. Then the original cross-domain access request flows from the target domain 120 to the initiating domain 110.

[0060] like Figure 2 The figure shows a schematic diagram of the specific structure of a cross-domain access system in an embodiment of the present specification. In the figure, a first docking system and a first cross-domain access system are deployed in the starting domain. The first docking system is used to send an original cross-domain access request to the first cross-domain access system. The original cross-domain access request includes: parameters of the target domain to be accessed. A first proxy service and a first nginx service are deployed in the first cross-domain access system. The first proxy service is used to query the address corresponding to the parameters of the target domain to be accessed from the database of the starting domain according to the parameters of the target domain to be accessed; update the original cross-domain access request according to the address to obtain a new cross-domain access request; send the new cross-domain access request to the second cross-domain access system of the target domain through the first nginx service to obtain the target service.

[0061] Figure 1 The target domain 120 is isolated from the starting domain 110, and a second cross-domain access system is deployed in the target domain 120. A second proxy service is deployed in the second cross-domain access system. The second proxy service is used to receive a new cross-domain access request and query the address of the target system to be accessed from the database of the target domain according to the parameters in the new cross-domain access request.

[0062] In some embodiments of the present specification, the target domain further includes a second docking system, and the second docking system is used to provide services of the target system according to the address of the target system to be accessed.

[0063] Figure 2 In the office domain Figure 1 The starting domain in the business domain corresponds to Figure 1 The target domain in the office domain is deployed with a docking system (including docking system 1, docking system 2, ... docking system n) and a cross-domain access system. The docking system is used to send an original cross-domain access request to the cross-domain access system. The business domain is also deployed with a cross-domain access system and a docking system (including docking system 1, docking system 2, ... docking system n).

[0064] Take the example of access from the office network to the business network. All systems are deployed in the office network. If the office system wants to access the business network system, it needs to request the cross-domain access system of the office domain through F5. The cross-domain access system of the office domain forwards the request to the network area of ​​the office domain, and further forwards the request to the proxy service in the cross-domain access system of the office domain through the software load balancing SLB in the cross-domain access system of the office domain. The proxy service accesses the database corresponding to the office domain to query the address that needs to be replaced, and then forwards the request to the proxy forwarding service of the corresponding network segment through nginx. The corresponding proxy forwarding service forwards the application to the corresponding docking service. Among them, a NAT address conversion is required between the two network segments of the office domain and the business domain, and cross-segment access can be performed after the conversion.

[0065] In some embodiments of this specification, a bare metal area is deployed between the starting domain and the target domain, and the bare metal area is respectively deployed with object storage and database serving the starting domain, and object storage and database serving the target domain. The starting domain and the target domain use two sets of databases, and container services in different areas do not share data.

[0066] Figure 3 The flowchart of a cross-domain access method according to an embodiment of the present specification is shown. The method is applied to Figure 1 and Figure 2 The system specifically comprises the following steps:

[0067] Step 301: Receive an original cross-domain access request sent by a first docking system, wherein the original cross-domain access request includes parameters of a target domain to be accessed. In the embodiment of this specification, the first docking system may include multiple docking systems, such as Figure 2 As shown, the docking system that issues the original cross-domain access request may be docking system 1 in the first docking system, or may be docking system n in the first docking system. The present application does not limit the docking system that issues the original cross-domain access request.

[0068] In this step, the original cross-domain access request includes: the address of the cross-domain access service and the parameters of the access target domain. In the embodiment of this specification, the original cross-domain access request can be expressed as follows:

[0069] http: / / www.baidu.com?address=yewu&system=baidu

[0070] {method:'a / b / c',

[0071] Type: 'get',

[0072] Parameters: 'a=b&c=d&e=f'

[0073] }

[0074] The parameters of the target domain included in the original cross-domain access request are: address=yewu, and system=baidu. http: / / www.baidu.com is the address of the cross-domain access system. The original cross-domain access request also includes the method a / b / c called by the cross-domain access, the call type is get, and the call parameters a=b&c=d&e=f.

[0075] Step 302, according to the parameters of the target domain to be accessed, query the address corresponding to the parameters of the target domain from the database of the starting domain. In this specification, the address of the target domain that the original cross-domain access request wants to access cannot be directly determined based on the parameters of the target domain in the original cross-domain access request. A NAT address conversion is required between the starting domain and the target domain before cross-segment access can be performed.

[0076] Therefore, in this step, the address corresponding to the parameter of the target domain in the original cross-domain access request needs to be queried. Specifically, according to the parameter of the target domain, the address of the target domain corresponding to the parameter is queried from the database of the starting domain.

[0077] Step 303, update the original cross-domain access request according to the address to obtain a new cross-domain access request. In this step, after determining the address of the target domain, the original cross-domain access request is updated using the address of the target domain to obtain a new cross-domain access request. The new cross-domain access request already contains the address of the target domain that the original domain wants to access.

[0078] For example, the original cross-domain access request is “http: / / www.baidu.com?address=yewu&system=baidu”;

[0079] It can be converted to: http: / / www.toyewu.com?system=baidu. The latter is a new cross-domain access request after the original cross-domain access request is updated after the address of the target domain is queried, and the new cross-domain access request includes the address of the target domain.

[0080] Step 304: Send the new cross-domain access request to the target domain through the first nginx service, and the second cross-domain access system of the target domain provides a cross-domain access service.

[0081] In this step, the new cross-domain access information can be sent from the cross-domain access system of the starting domain to the cross-domain access system of the target domain. However, the new cross-domain access information cannot be directly identified and parsed within the target domain. Therefore, the new cross-domain access request is forwarded to the target domain by the first nginx service in the first cross-domain access system of the initial domain. The second proxy service in the second cross-domain access system of the target domain identifies the new cross-domain access request, determines the specific target domain to be accessed by the new cross-domain access request, and provides the cross-domain access service in the target domain.

[0082] Figure 4 The flowchart of a method for sending a new cross-domain access request to a target service in an embodiment of the present specification is shown. When the original cross-domain access request further includes parameters of a target system to be accessed in the target domain, the method specifically includes the following steps:

[0083] Step 401, the second proxy service of the target domain queries the database for the address corresponding to the target system parameter according to the target system parameter in the new cross-domain access request. For example, the original cross-domain access request is: http: / / www.baidu.com?address=yewu&system=baidu, and the new cross-domain access request is: http: / / www.toyewu.com?system=baidu. It can be seen that in the new cross-domain access request, the parameter "system=baidu" represents the target system "baidu" in the target domain. The second proxy service cannot directly determine the address of the target system according to the parameters in the new cross-domain access request. Therefore, similar to the first proxy service, the second proxy service needs to query the address corresponding to the parameter from the database of the target domain according to the parameter.

[0084] Step 402, sending the new cross-domain access request to the address corresponding to the target system to obtain the service provided by the target system. In this step, after the second proxy service determines the address corresponding to the target system, the second ngnix in the target domain sends the new cross-domain access request to the address to obtain the service or data provided by the target system at the address.

[0085] Figure 5 The flowchart of a method for verifying an original cross-domain access request according to an embodiment of the present specification is shown, which specifically includes the following steps:

[0086] Step 501: encrypt an original cross-domain access request to generate an encrypted request, and send the encrypted request to a cross-domain access system.

[0087] In this step, in order to ensure the security of data interaction between the docking system and the cross-domain access system, it is necessary to encrypt the original cross-domain access request before sending it to the cross-domain access system of the original domain. For example, the original cross-domain access request can be expressed as follows: http: / / www.baidu.com? address=yewu&system=baidu. Specifically, the message digest of the original cross-domain access request can be calculated first, and the message digest can be encrypted with a private key to generate a digital signature. The encrypted message digest is the digital signature of the docking system. The digital signature and other data (including the original cross-domain access request) are sent together to the cross-domain access system of the original domain. The embodiment of this specification may refer to the combination of the digital signature and other data as an encrypted request.

[0088] In the process of sending the digital signature and other data to the cross-domain access system of the original domain, a timestamp and a public key may be added, so that the digital signature, the timestamp, the public key and the original cross-domain access request are sent to the cross-domain access system. According to the previous embodiment, the encryption request may be expressed as follows:

[0089] http: / / www.baidu.com?address=yewu&system=baidu×tamp=122222&ak=as1234566&sign=292929292sadadasd, where timestamp=122222 indicates a timestamp, ak=as1234566&sign indicates a public key, and sign=292929292sadadasd indicates a digital signature generated by encrypting a private key.

[0090] Step 502: When the cross-domain access system uses the public key in the encryption request to perform decryption, decrypted data is obtained.

[0091] In this step, when the cross-domain access system receives the encryption request, it obtains the public key in the encryption request data, decrypts the encryption request using the public key, and obtains the decrypted signature. At the same time, the cross-domain access system can use the same hash algorithm to perform a hash operation on the received encryption request to obtain a hash value.

[0092] Step 503, determining whether the signature is consistent with the calculated signature.

[0093] In this step, the decrypted signature is further compared with the calculated hash value to determine whether the two are consistent. If they are consistent, it means that the digital signature in the encryption request is valid, and it is sent by the docking system of the initial domain to the cross-domain access system, and the encryption request data has not been tampered with. If the two are inconsistent, it means that the digital signature in the encryption request is invalid, and the encryption request data may be tampered with. Thus, the cross-domain access system completes the signature verification of the original cross-domain access request and verifies the validity of the address in the original access request.

[0094] Step 504: If they are consistent, the first proxy service sends the encrypted request to the first nginx service.

[0095] In this specification, the public-private key signature verification mechanism is used to ensure the integrity and authenticity of the cross-domain access request received by the cross-domain access system. Only when the received cross-domain access request is complete and authentic will the system forward the cross-domain access request to the target domain for further processing.

[0096] In some other embodiments of the present specification, similarly, after the second proxy service in the target domain receives the new cross-domain access request, the second proxy service can also encrypt the new cross-domain access request, generate an encrypted request, and send the encrypted request to the cross-domain access system of the target domain;

[0097] When the cross-domain access system uses the public key in the encryption request to perform decryption, decrypted data is obtained;

[0098] Verify whether the decrypted data is consistent with the calculated signature;

[0099] If they are consistent, the first proxy service sends the encrypted request to the first nginx service.

[0100] Figure 6 The flowchart of a method for limiting the flow of file download requests in an embodiment of this specification is shown, which specifically includes the following steps:

[0101] Step 601, determining whether the request is a file download request.

[0102] After the signature verification in the above steps is passed and before the request is sent to the target domain, it is necessary to determine whether the type of cross-domain access request is a file download request type. Because the file download request involves the target domain providing the file corresponding to the request, the file content may involve commercial secrets or important sensitive information. Therefore, it is necessary to first determine whether the request is a file download request, and further determine whether the file required for the file download request involves sensitive files.

[0103] Step 602: If yes, determine whether the file involved in the file download request has been downloaded.

[0104] If the type of the cross-domain access request belongs to a file download interface, it is further determined whether the file has been downloaded.

[0105] Step 603: If yes, obtain the file from the database.

[0106] If it has been downloaded, the information corresponding to the file is directly obtained from the database corresponding to the first proxy service.

[0107] Step 604: If not, determine whether to limit the flow of the file download request.

[0108] If the file has never been downloaded, it is further determined whether the request needs to be limited. Specifically, based on the number of requests at the same time, it is determined whether the current flow corresponding to the request should exceed the preset threshold. This allows flow control to be achieved and prevents frame loss when the port is blocked.

[0109] Step 605: If yes, the first nginx service performs flow restriction on the request. In this step, if the flow exceeds the preset threshold, flow restriction is required, and the first nginx service performs flow restriction on the corresponding request.

[0110] When it is determined that the request needs to be flow controlled, a blocking signal is sent back to the source address when the send or receive buffer begins to overflow, thereby achieving flow control of the request. Flow control can effectively prevent the impact of a large amount of data on the network in an instant, ensuring efficient and stable operation of the user network.

[0111] In this manual, employees frequently upload, download, and forward files during office work. To prevent employees from accidentally uploading sensitive files to the system and accessing them from another network area, which may lead to the spread of files with sensitive information, it is necessary to scan the uploaded files for sensitive information. Only after confirming that the files do not contain sensitive information can the files be transferred.

[0112] Figure 7 The flowchart of a method for processing sensitive files in an embodiment of the present specification is shown, which specifically includes the following steps:

[0113] Step 701: Determine whether the file has been recorded based on the file version and hash information of the file involved in the file download request.

[0114] In this step, based on the file version and hash information of the file involved in the file download request, it is determined whether there is a record of the file in the file sensitive information library. Specifically, it is possible to query whether there is the same file from the sensitive information record library in the database corresponding to the first proxy service.

[0115] Step 702: If yes, obtain the sensitive information of the file and determine the sensitivity level corresponding to the sensitive information.

[0116] In this step, if the file has been recorded in the sensitive information database, it means that the file contains certain sensitive information and has been recorded in the sensitive database before. Then the sensitivity level corresponding to the sensitive information recorded for the file in the file sensitive information database is further determined. Among them, the correspondence between sensitive information and sensitivity level is not elaborated in this application, and the correspondence can be in many different forms. In the embodiments of this specification, the higher the sensitivity level, the higher the sensitivity and confidentiality of the file, and the higher the security requirements for file transmission.

[0117] Step 703: Feedback the sensitive information of the file whose sensitivity level is higher than the preset level to the first docking system through the first proxy service.

[0118] In this step, if the sensitive information of the file in the file sensitive information database is recorded as a sensitive information file, it can be determined whether the sensitivity level of the file in this step is higher than the preset level according to the preset confidentiality level or sensitivity level of the docking system, so as to determine whether to feed the file back to the docking system. Alternatively, it can also be determined whether to feed the file back to a specific application in the docking system according to whether the docking system is a special case system.

[0119] Specifically, if it is determined that the sensitivity level of the file in this step is lower than the preset level, it means that the sensitive information level of the file is low or there is no sensitive information, the file sensitivity is not high, and the file content is relatively safe, then the cross-domain access request can flow normally without being directly returned to the docking system; if the sensitivity level of the file in this step is higher than the preset level, it means that the sensitive information level of the file is high, the file content is relatively sensitive, and it cannot continue to flow, then the sensitive information of the file (for example, sensitive reasons, sensitive sources, etc.) will be fed back to the docking system in the starting domain.

[0120] Step 704, if not, check the sensitive information of the file and determine the corresponding sensitivity level. In this step, if the file has not been recorded in the sensitive information record library before, continue to transfer the request. The request is sent from the first nginx service of the starting domain to the cross-domain access system of the target domain. Then the second proxy service of the target domain requests the target service to obtain the specific file information provided in the target service. Further call the sensitive information monitoring server to determine whether the file information contains sensitive information, and obtain the sensitive information check result, which includes the sensitivity level.

[0121] Step 705, send the file with a sensitivity level lower than the preset level to the second proxy service, and store the sensitive information monitoring result and the file in the database of the starting domain. In this step, after obtaining the file information from the target service of the target domain, call the sensitive information monitoring server to perform sensitive information check on the file information to obtain the detection result. Feedback the detection result and file information to the first proxy service of the starting domain through the second proxy service, and the first proxy service stores the file in the object storage. The first proxy service updates the sensitive information of the file in the database.

[0122] If the file does not contain sensitive information or the level of sensitive information is low, a security notification will be given, the file will be circulated normally, and the file will be fed back to the docking system of the starting domain; if the file contains sensitive information, the level of sensitive information is high, and the docking system is not on the whitelist, it means that the docking system does not have the authority to read or view files containing sensitive information or confidential information, and the file information of the file will be refused to be proxied to the network of the starting domain; if the docking system is on the whitelist, it will be released, indicating that the docking system has the authority to read files containing sensitive information or confidential information, and the request will be recorded in the database to leave a trace.

[0123] Figure 8 This is a schematic diagram of the structure of a cross-domain access device according to an embodiment of the present specification. In this figure, the basic structure of the cross-domain access device is described, wherein the functional units and modules can be implemented in software, or a general chip or a specific chip can be used to implement cross-domain access. The device specifically includes:

[0124] The request receiving unit 801 is configured to receive an original cross-domain access request sent by the first docking system, wherein the original cross-domain access request includes parameters of a target domain to be accessed;

[0125] An address determining unit 802, configured to query an address corresponding to the parameters of the target domain from a database of the starting domain according to the parameters of the target domain to be visited;

[0126] A request determining unit 803, configured to update the original cross-domain access request according to the address to obtain a new cross-domain access request;

[0127] The target service determination unit 804 is configured to send the new cross-domain access request to the target domain through the first nginx service, and the second cross-domain access system of the target domain provides the cross-domain access service.

[0128] Fig. 9 Shown is a schematic diagram of another cross-domain access system according to an embodiment of this specification.

[0129] In the figure, a cross-domain access system is built in different network segments, specifically: a cross-domain access system is built in the business network and the office network. The cross-domain access system includes: proxy forwarding service and nginx service. To access the docking system, you only need to replace the destination address to be accessed with the address of the cross-domain access system. The proxy forwarding service will proxy to the target cross-domain access system through nginx, and the cross-domain access system of the target network segment will proxy to the corresponding target address.

[0130] like Fig.10 The schematic diagram of a computer device provided by an embodiment of this specification is shown. The cross-domain access method described in this application can be applied to the computer device. The computer device 1002 may include one or more processors 1004, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 1002 may also include any memory 1006, which is used to store any kind of information such as code, settings, data, etc. Non-restrictive, for example, the memory 1006 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 1002. In one case, when the processor 1004 executes an associated instruction stored in any memory or a combination of memories, the computer device 1002 can perform any operation of the associated instruction. The computer device 1002 also includes one or more drive mechanisms 1008 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0131] The computer device 1002 may also include an input / output module 1010 (I / O) for receiving various inputs (via input devices 1012) and for providing various outputs (via output devices 1014). A specific output mechanism may include a presentation device 1016 and an associated graphical user interface (GUI) 1018. In other embodiments, the input / output module 1010 (I / O), the input device 1012, and the output device 1014 may not be included, and the computer device 1002 may be used as a computer device in a network. The computer device 1002 may also include one or more network interfaces 1020 for exchanging data with other devices via one or more communication links 1022. One or more communication buses 1024 couple the components described above together.

[0132] The communication link 1022 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 1022 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0133] Corresponds to Figures 3 to 7 The method in the embodiment of the present specification also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are executed.

[0134] The embodiment of the present specification also provides a computer-readable instruction, wherein when the processor executes the instruction, the program therein causes the processor to execute the following Figures 3 to 7 The method shown.

[0135] The present specification also provides a computer program product, wherein the computer program product includes a computer program, wherein the computer program is executed by a processor as follows: Figures 3 to 7 The method shown.

[0136] It should be understood that in the various embodiments of this specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0137] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0138] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this specification.

[0139] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0140] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0141] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0142] In addition, each functional unit in each embodiment of this specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0143] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0144] Specific embodiments are used in this specification to illustrate the principles and implementation methods of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of this specification. At the same time, for those skilled in the art, according to the ideas of this specification, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this specification.

Claims

1. A cross-domain access system, characterized in that: The system comprises: A starting domain, in which a first docking system and a first cross-domain access system are deployed; The first docking system is used to send an original cross-domain access request to the first cross-domain access system, and the original cross-domain access request includes: parameters of the target domain to be accessed; The first cross-domain access system is deployed with a first proxy service and a first nginx service, wherein the first proxy service is used to query the address corresponding to the parameter of the target domain to be accessed from the database of the starting domain according to the parameter of the target domain to be accessed; update the original cross-domain access request according to the address to obtain a new cross-domain access request; send the new cross-domain access request to the second cross-domain access system of the target domain through the first nginx service to obtain the target service; A target domain, wherein the target domain is isolated from the starting domain, wherein a second cross-domain access system is deployed in the target domain, wherein a second proxy service is deployed in the second cross-domain access system, wherein the second proxy service is used to receive a new cross-domain access request, and query the address of the target system to be accessed from a database of the target domain according to parameters in the new cross-domain access request.

2. The system according to claim 1, characterized in that The target domain also includes a second docking system, and the second docking system is used to provide services of the target system according to the address of the target system to be accessed.

3. The system according to claim 1, characterized in that A bare metal area is deployed between the starting domain and the target domain, and the object storage and database of the starting domain and the target domain are deployed in the bare metal area respectively.

4. A cross-domain access method, characterized in that: The method is applied to the cross-domain access system according to any one of claims 1 to 3, comprising: Receiving an original cross-domain access request sent by the first docking system, wherein the original cross-domain access request includes parameters of a target domain to be accessed; According to the parameters of the target domain to be visited, querying the address corresponding to the parameters of the target domain from the database of the starting domain; Update the original cross-domain access request according to the address to obtain a new cross-domain access request; The new cross-domain access request is sent to the target domain through the first nginx service, and the second cross-domain access system of the target domain provides a cross-domain access service.

5. The method according to claim 4, characterized in that The original cross-domain access request further includes parameters of a target system to be accessed in the target domain, and the method further includes: The second proxy service of the target domain queries a database according to the target system parameter in the new cross-domain access request to obtain an address corresponding to the target system parameter; The new cross-domain access request is sent to the address corresponding to the target system to obtain the service provided by the target system.

6. The method according to claim 4, characterized in that The method comprises: Encrypting the original cross-domain access request to generate an encrypted request, and sending the encrypted request to the cross-domain access system; When the cross-domain access system uses the public key in the encryption request to perform decryption, decrypted data is obtained; Verify whether the decrypted data is consistent with the calculated signature; If they are consistent, the first proxy service sends the encrypted request to the first nginx service.

7. The method according to claim 4, characterized in that The method comprises: Determine whether the request is a file download request; If so, determining whether the file involved in the file download request has been downloaded; If so, obtaining the file from the database; If not, determine whether to limit the flow of the file download request; If so, the first nginx service performs flow restriction on the request.

8. The method according to claim 7, characterized in that When the request is a file download request, the method further comprises: Determining whether the file has been recorded according to the file version and hash information of the file involved in the file download request; If so, obtaining sensitive information of the file and determining a sensitivity level corresponding to the sensitive information; Feedback the sensitive information of files with a sensitivity level higher than a preset level to the first docking system through the first proxy service; If not, check the sensitive information of the file and determine the corresponding sensitivity level; Files with a sensitivity level lower than a preset level are sent to a second proxy service, and the sensitive information monitoring results and the files are stored in a database of the starting domain.

9. A cross-domain access device, characterized in that: The device comprises: A request receiving unit, configured to receive an original cross-domain access request sent by the first docking system, wherein the original cross-domain access request includes parameters of a target domain to be accessed; An address determination unit, configured to query an address corresponding to the parameter of the target domain from a database of the starting domain according to the parameter of the target domain to be visited; a request determining unit, configured to update the original cross-domain access request according to the address to obtain a new cross-domain access request; The target service determination unit is used to send the new cross-domain access request to the target domain through the first nginx service, and the second cross-domain access system of the target domain provides the cross-domain access service.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 4 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 4 to 8 is implemented.

12. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 4 to 8 is implemented.

Images