A method, apparatus, and storage medium for distinguishing between internal and external network requests.

Abstract

This application provides a method, apparatus, and storage medium for distinguishing between internal and external network requests. The method includes: receiving a user request, the request including header information; setting first information for the header information, including a name and a value of the first information; obtaining the value of the first information based on its name, and distinguishing the source of the request based on its value; and performing a corresponding operation according to the source of the request, wherein the source of the request includes an internal network or the Internet. When the request originates from an internal network, the request is received by an internal network proxy server, and the value of the first information is set to a first header information; when the request originates from the Internet, the request is received by an Internet proxy server, and the value of the first information is set to a second header information. This method is used to prevent the internal / external network distinction identifier from being tampered with and to improve service reusability.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method, apparatus, and storage medium for distinguishing between internal and external network requests. Background Technology

[0002] With increasing security requirements, the need for internal and external network isolation is growing. Systems that support access from both the internal office network and the internet may require configuring certain roles or functions to be accessible only from the internal network. For example, platform administrators may only allow internal network access, disallowing internet access, or certain business functions may be restricted to internet access only.

[0003] Existing technologies for differentiating and isolating internal and external networks have the following problems: First, existing technologies differentiate between internal and external networks by sending identifiers through channels, which can be easily tampered with and turned into security incidents; Second, existing technologies have a relatively coarse degree of differentiation between internal and external networks, requiring the development of one set of services for the internal network and another set for the Internet for a function that is needed on both networks, resulting in low reusability. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, and storage medium for distinguishing between internal and external network requests, so as to prevent the internal and external network distinction identifier from being tampered with and to improve the reusability of services.

[0005] To achieve the above objectives, a first aspect of this application provides a method for distinguishing between internal and external network requests. The method includes: receiving a user's request, the request including header information; setting first information for the header information, including a name and a value of the first information; obtaining the value of the first information based on the name of the first information, and distinguishing the source of the request based on the value of the first information; and performing corresponding operations according to the source of the request, wherein the source of the request includes an internal network or the Internet, when the request comes from an internal network, the request is received by an internal network proxy server, and the value of the first information is set to first header information; when the request comes from the Internet, the request is received by an Internet proxy server, and the value of the first information is set to second header information.

[0006] In this embodiment of the application, the first header information is private, and the second header information is public.

[0007] In this embodiment of the application, distinguishing the source of the request based on the value of the first information, and performing corresponding operations according to the source of the request, includes: when the value of the first information is first header information, determining that the request comes from the intranet and processing the business function corresponding to the request normally; and when the value of the first information is second header information, determining that the request comes from the Internet and prohibiting the processing of the business function corresponding to the request.

[0008] In this embodiment of the application, the method further includes: before setting the first information for the header information, determining whether the request carries the first information; if the request carries the first information, resetting the value of the first information to overwrite the original value.

[0009] In this embodiment of the application, the method further includes: determining whether the request comes from a designated account; if not, prohibiting the processing of the business function corresponding to the request.

[0010] In this embodiment of the application, the method further includes: monitoring the source of the request, and when the number of Internet requests from the same source reaches a preset number within a preset time period, issuing an alarm and blocking the request from that source.

[0011] In this embodiment of the application, the intranet proxy server is an intranet Nginx, and the internet proxy server is an internet Nginx.

[0012] In this embodiment of the application, the name of the first information is from-c.

[0013] A second aspect of this application provides an apparatus for distinguishing between internal and external network requests. The apparatus includes: a proxy server for receiving user requests, the requests including header information, and setting first information for the header information, including a name and a value of the first information; and an application server for obtaining the value of the first information based on the name of the first information, distinguishing the source of the request based on the value of the first information, and performing corresponding operations according to the source of the request. The source of the request includes an internal network or the Internet. The proxy server includes an internal network proxy server and an Internet proxy server. When the request originates from the internal network, the request is received by the internal network proxy server, and the value of the first information is set to a first header information. When the request originates from the Internet, the request is received by the Internet proxy server, and the value of the first information is set to a second header information.

[0014] In this embodiment of the application, the proxy server is further configured to determine whether the request carries the first information. If the request carries the first information, the value of the first information is reset to overwrite the original value.

[0015] In this embodiment of the application, the application server is further configured to determine whether the request comes from a specified account; if not, the business function corresponding to the request is prohibited from being processed.

[0016] A third aspect of this application provides a processor configured to perform the above-described method for distinguishing between internal and external network requests.

[0017] A fourth aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned method for distinguishing between internal and external network requests.

[0018] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method for distinguishing between internal and external network requests as described above.

[0019] The above technical solution allows for the differentiation of request sources by setting a first piece of information in the request header after the intranet or internet proxy server receives a user request. Different values ​​for this first piece of information are assigned to requests from different sources to distinguish the request's origin, rather than relying on external identification information. Since the proxy server resides at the application layer, the header information set at this layer prevents malicious external tampering. Furthermore, by distinguishing the request source, different business logic branches can be entered to implement business functions based on different request sources during service execution, eliminating the need to develop separate services for the intranet and the internet, thus improving service reusability.

[0020] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0022] Figure 1 The illustration shows a flowchart of a method for distinguishing between internal and external network requests according to an embodiment of this application;

[0023] Figure 2 This illustration schematically depicts a processing diagram illustrating the distinction between internal and external network requests for an application service according to an embodiment of this application.

[0024] Figure 3 This illustration schematically depicts another application service request differentiation process according to an embodiment of this application.

[0025] Figure 4 This schematic diagram illustrates a structural block diagram of an apparatus for distinguishing between internal and external network requests according to an embodiment of this application;

[0026] Figure 5 The diagram illustrates the internal structure of a computer device according to an embodiment of this application.

[0027] Explanation of reference numerals in the attached figures

[0028] 100 - A device that distinguishes between internal and external network requests;

[0029] 101 - Proxy server;

[0030] 102 - Application Server. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0033] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0034] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant national laws and regulations. Furthermore, it should be noted that existing industry solutions such as software, components, and models may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0035] Figure 1 This illustration schematically shows a flowchart of a method for distinguishing between internal and external network requests according to an embodiment of this application, such as... Figure 1As shown, in one embodiment of this application, a method for distinguishing between internal and external network requests is provided, the method including the following steps S101-S104.

[0036] Step S101: Receive a request from the user, the request including header information.

[0037] Step S102: Set first information for the header information, including the name of the first information and the value of the first information.

[0038] Step S103: Obtain the value of the first information based on its name, and distinguish the source of the request based on the value of the first information.

[0039] Step S104: Perform the corresponding operation based on the source of the request.

[0040] The request originates from either an intranet or the internet. When the request originates from an intranet, it is received by an intranet proxy server, which sets the value of the first information to the first header information. When the request originates from the internet, it is received by an internet proxy server, which sets the value of the first information to the second header information. Specifically, when a user accesses the internet via an intranet, the access request is sent to the intranet proxy server through the intranet channel. The intranet proxy server then sets the value of the first information in the intranet request header for that request. Similarly, when a user accesses the internet via an internet channel, the access request is sent to the internet proxy server through the internet channel, and the internet proxy server sets the value of the first information in the internet request header for that request. This invention distinguishes between intranets and internets by setting different values ​​for the first information in the header information for access requests from different sources, rather than using external identification information to differentiate the access source. Furthermore, since the proxy server is located at the application layer, the header information set at this layer can prevent the identifier from being maliciously tampered with externally.

[0041] When a request with different header information is received by the corresponding application service, the value of the first information is obtained from the request header information. This value is then used to determine whether the request originates from the intranet or the internet within the business logic branch. Using the method proposed in this invention, after determining the source of the service request based on the value of the first information, the application service can enter different business logic branches to implement business functions, without having to develop separate services for the intranet and the internet, thus improving the reusability of application services.

[0042] It should be understood that, although Figure 1The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0043] In one specific implementation, the first header information is private, and the second header information is public.

[0044] It should be noted that, in other embodiments of the present invention, depending on the actual situation, the first information of the intranet request and the first information of the Internet request can be set to other values, as long as they are distinguishable. The present invention is not limited thereto.

[0045] According to a specific implementation, the source of the request is distinguished based on the value of the first information, and the corresponding operation is performed according to the source of the request, including: when the value of the first information is a first header information, it is determined that the request comes from the intranet, and the business function corresponding to the request is processed normally; and when the value of the first information is a second header information, it is determined that the request comes from the Internet, and the business function corresponding to the request is prohibited from being processed.

[0046] In some application services, to prevent data leakage, network attacks, or other potential security risks, internet users are not allowed to access the service. For such applications, when the value of the first information of the request is "public", the business function corresponding to the request is directly prohibited from being processed in order to protect the system. Figure 2 This illustration shows a schematic diagram illustrating the processing of application service requests distinguishing between internal and external networks according to an embodiment of this application, such as... Figure 2As shown, for an application service used for transactions, after an intranet user or internet user initiates a request, the intranet proxy server or internet proxy server sets first information. Then, the proxy server forwards the request with the first information set to the application service. The forwarding process may involve components such as gateways. The application service obtains the value of the first information from the request header information, and then determines whether the transaction originates from the internet or the intranet by judging whether the value of the first information is public or private. In this way, it can implement corresponding business functions, such as allowing intranet users to process business functions normally, prohibiting internet users from requesting business functions, or granting intranet users and internet users different business function permissions.

[0047] According to one specific implementation, the method further includes: before setting the first information for the header information, determining whether the request carries the first information; if the request carries the first information, resetting the value of the first information to overwrite the original value.

[0048] It is understandable that if an internet user attempts to impersonate an intranet user to access the site, they may set the first information in the header information externally, or in other cases, the request from the internet itself may contain the first information. In the method proposed in this invention, when the proxy server receives the request, if the original request itself contains the first information, it ignores the original value and resets the value of the first information according to its source, thereby further preventing malicious external access.

[0049] According to one specific implementation, the method further includes: determining whether the request comes from a designated account; if not, prohibiting the processing of the business function corresponding to the request.

[0050] It should be noted that some applications, in addition to restricting the source of requests, also have requirements regarding the account initiating the request. For example, some applications only allow access to a limited number of users with designated accounts, such as administrators; if the request does not originate from a designated account, access is denied. This invention enhances the security of application access through dual verification of both the request source and the requesting account. Figure 3 This illustration schematically depicts another application service request differentiation process according to an embodiment of this application, such as... Figure 3 As shown, for some applications, only designated accounts are allowed to log in and access the application on the intranet. Therefore, when a user makes a login request, the account and the request source are double-verified. Login is only allowed if both requirements are met; otherwise, login is prohibited, thus improving the security of application data.

[0051] According to one specific implementation, the method further includes: monitoring the source of the request, and when the number of Internet requests from the same source reaches a preset number within a preset time period, issuing an alarm and blocking the request from that source.

[0052] This setting prevents malicious users or automated scripts from abusing service resources, ensuring that legitimate users receive timely service responses. Furthermore, the preset time period and preset number of attempts need to be configured reasonably based on actual business needs and system capacity; this invention does not impose limitations on these settings.

[0053] In one specific implementation, the intranet proxy server is an intranet Nginx, and the internet proxy server is an internet Nginx.

[0054] As a proxy server, Nginx has advantages such as high performance, lightweight, and flexibility, therefore Nginx is preferred as the proxy server in this invention. In other embodiments of the present invention, the selection of the proxy server can also be adjusted according to actual circumstances, and the present invention is not limited thereto.

[0055] In one specific implementation, the name of the first information is from-c.

[0056] In other embodiments of the present invention, the name of the first information may be set to another name depending on the actual production situation, and the present invention is not limited thereto.

[0057] Figure 4 This schematically illustrates a structural block diagram of an apparatus for distinguishing between internal and external network requests according to an embodiment of this application. In one embodiment, such as... Figure 4 As shown, the device 100 for distinguishing between internal and external network requests includes: a proxy server 101, used to receive user requests, the requests including header information, and setting first information for the header information, including the name and value of the first information; and an application server 102, used to obtain the value of the first information based on the name of the first information, and distinguish the source of the request based on the value of the first information and perform corresponding operations according to the source of the request, wherein the source of the request includes the internal network or the Internet, the proxy server 101 includes an internal network proxy server and an Internet proxy server, when the request comes from the internal network, the request is received by the internal network proxy server and the value of the first information is set to the first header information, when the request comes from the Internet, the request is received by the Internet proxy server and the value of the first information is set to the second header information.

[0058] It should be noted that although the application server can receive the request header information, it will directly ignore the first information or handle errors if the application server is not configured. Therefore, before the application server receives the request, it needs to be configured to recognize the first information in the header and perform logical judgments based on its value.

[0059] According to one specific implementation, the proxy server 101 is further configured to determine whether the request carries the first information. If the request carries the first information, the value of the first information is reset to overwrite the original value.

[0060] In one specific implementation, the application server 102 is further configured to determine whether the request originates from a specified account; if not, the business function corresponding to the request is prohibited from being processed.

[0061] In one specific implementation, the first header information is private, and the second header information is public.

[0062] According to a specific implementation, the source of the request is distinguished based on the value of the first information, and the corresponding operation is performed according to the source of the request, including: when the value of the first information is a first header information, it is determined that the request comes from the intranet, and the business function corresponding to the request is processed normally; and when the value of the first information is a second header information, it is determined that the request comes from the Internet, and the business function corresponding to the request is prohibited from being processed.

[0063] According to one specific implementation, the device is also used to monitor the source of the request, and when the number of Internet requests from the same source reaches a preset number within a preset time period, an alarm is triggered and the request from that source is blocked.

[0064] In one specific implementation, the intranet proxy server is an intranet Nginx, and the internet proxy server is an internet Nginx.

[0065] In one specific implementation, the name of the first information is from-c.

[0066] This application provides a storage medium on which a program is stored, which, when executed by a processor, implements the above-described method for distinguishing between internal and external network requests.

[0067] This application provides a processor for running a program, wherein the program executes the above-described method for distinguishing between internal and external network requests.

[0068] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor A01, a network interface A02, memory (not shown), and a database (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02, and a database (not shown). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A04. The database stores application service data. The network interface A02 communicates with external terminals via a network connection. When executed by the processor A01, the computer program B02 implements a method for distinguishing between internal and external network requests.

[0069] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0070] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform an initialization method for distinguishing between internal and external network requests as described in any embodiment of the present invention.

[0071] In one embodiment, the device for distinguishing between internal and external network requests provided in this application can be implemented as a computer program, which can be implemented in the form of, for example... Figure 5 The computer device shown runs on this device. The computer device's memory can store the various program modules that make up the device for distinguishing between internal and external network requests, for example, Figure 4 The proxy server 101 and application server 102 are shown. The computer program, composed of various program modules, causes the processor to execute the steps of the methods for distinguishing between internal and external network requests in the various embodiments of this application described in this specification.

[0072] Figure 5 The computer equipment shown can be used as follows Figure 4 The proxy server 101 in the device for distinguishing between internal and external network requests executes steps S101-S102. The computer device can execute steps S103-S104 through the application server 102.

[0073] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0078] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0079] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0081] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for distinguishing between intranet and extranet requests, characterized in that, The method comprises: receiving a request of a user, the request comprising header information; setting first information for the header information, including a name of the first information and a value of the first information; obtaining the value of the first information based on the name of the first information, and distinguishing a source of the request based on the value of the first information; and performing corresponding operations according to the source of the request, wherein the source of the request comprises an intranet or the Internet, when the request comes from the intranet, the request is received by an intranet proxy server, and the value of the first information is set as first header information, and when the request comes from the Internet, the request is received by an Internet proxy server, and the value of the first information is set as second header information.

2. The method of claim 1, wherein, The first header information is private, and the second header information is public.

3. The method of claim 1, wherein, Distinguishing the source of the request based on the value of the first information, and performing corresponding operations according to the source of the request comprises: when the value of the first information is the first header information, it is judged that the request comes from the intranet, and a business function corresponding to the request is normally processed; and when the value of the first information is the second header information, it is judged that the request comes from the Internet, and the business function corresponding to the request is prohibited from being processed.

4. The method of claim 1, wherein, The method further comprises: Before setting the first information for the header information, it is judged whether the request carries the first information, and if the request carries the first information, the value of the first information is reset, and the original value is overwritten.

5. The method of claim 1, wherein, The method further comprises: It is judged whether the request comes from a specified account, and if not, the business function corresponding to the request is prohibited from being processed.

6. The method of claim 1, wherein, The method further comprises: The source of the request is monitored, and when the number of Internet requests from the same source reaches a preset number within a preset time period, an alarm is given and the request from the source is intercepted.

7. The method of claim 1, wherein, The intranet proxy server is an intranet Nginx, and the Internet proxy server is an Internet Nginx.

8. The method of claim 1, wherein, The name of the first information is from-c.

9. A device for distinguishing between internal and external network requests, characterized in that, The apparatus comprises: a proxy server configured to receive a request of a user, the request comprising header information, and set first information for the header information, including a name of the first information and a value of the first information; and an application server configured to obtain the value of the first information based on the name of the first information, and distinguish a source of the request based on the value of the first information, and perform corresponding operations according to the source of the request, wherein the source of the request comprises an intranet or the Internet, the proxy server comprises an intranet proxy server and an Internet proxy server, when the request comes from the intranet, the request is received by the intranet proxy server, and the value of the first information is set as first header information, and when the request comes from the Internet, the request is received by the Internet proxy server, and the value of the first information is set as second header information.

10. The apparatus of claim 9, wherein, The proxy server is further configured to judge whether the request carries the first information, and if the request carries the first information, reset the value of the first information, and overwrite the original value.

11. The apparatus of claim 9, wherein, The application server is further configured to determine whether the request is from a specified account, and if not, to prohibit processing of a service function corresponding to the request.

12. A processor, comprising: A method configured to perform the internal and external network request differentiation according to any one of claims 1-8.

13. A machine-readable storage medium having stored thereon instructions, the instructions being executable by a machine to cause the machine to: The instructions, when executed by a processor, cause the processor to be configured to perform the internal and external network request differentiation according to any one of claims 1-8.

14. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the internal and external network request differentiation according to any one of claims 1-8.

Images