Fine-grained security controllable network proxy method based on multi-layer proxy architecture

Abstract

The invention relates to the technical field of network communication, in particular to a fine-grained security controllable network proxy method based on a multi-layer proxy architecture. Each layer of network is divided into independent network units according to needs, independent proxy transfer centers are set up, request forwarding between the proxy transfer centers is achieved, and then each proxy transfer center distributes user requests to different back-end services for processing. Each proxy transfer center has different security strategies and functions, such as data encryption, access control, content filtering and the like, network topology coupling is reduced, and the architecture can provide finer and more comprehensive security protection. The problems that a traditional single network agent method cannot meet the current complex and changeable network environment requirement, especially when two or more networks need to be accessed at the same time, the agent rule relation is complex, the coupling performance of network topology is high, and the safety and controllability of data transmission are guaranteed are solved.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture. Background Art

[0002] The traditional single network proxy method can no longer meet the needs of the current complex and ever-changing network environment, especially when it is necessary to access two or more networks at the same time. The proxy rule relationships are complex and the network topology is highly coupled. How to ensure the security and controllability of data transmission has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the present invention is to adopt a multi-layer proxy architecture, divide each layer of the network into independent network units as needed to set up independent proxy transit centers, realize request forwarding between proxy transit centers, and then each proxy transit center distributes user requests to different back-end service processing. Each proxy transit center has different security policies and functions, such as data encryption, access control, content filtering, etc., to reduce network topology coupling. This architecture can provide more detailed and comprehensive security protection.

[0004] The technical solution of the present invention is a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture, comprising the following steps:

[0005] Step S1: Divide network units and set up proxy transit centers. Select a demand management system, define the boundaries of network units according to network topology and business requirements, and configure and manage the proxy transit centers in each network unit;

[0006] Step S2: Monitoring and logging, the proxy transfer center records detailed logs of network communications, including request information, response information, processing time, etc. At the same time, log query and analysis tools are provided to help administrators quickly locate problems and optimize system performance;

[0007] Step S3: System optimization and expansion, providing flexible interfaces and tools, allowing administrators to dynamically add new network units, proxy transit centers or backend services, and adjust related configurations and policies. At the same time, regular performance testing and security assessments are conducted, and the system is optimized and improved based on the assessment results.

[0008] Preferably, the step S1 comprises:

[0009] Step S1.1: Security policy configuration, configure security policies for each proxy transfer center, such as data encryption, access control, content filtering, etc.;

[0010] Step S1.2: Request reception and distribution, receiving requests from users or clients, processing them according to routing rules and security policies, and distributing the requests to backend services;

[0011] Step S1.3: Service processing and response, receiving the response from the backend service, forwarding it to the user or client, and performing necessary optimization processing;

[0012] Preferably, step S3 comprises:

[0013] Step S3.1: Network unit expansion: when business demand increases, new network units are added and an agent transfer center is established in them;

[0014] Step S3.2: Proxy transit center expansion, increasing the number of proxy transit centers in the network unit to improve request processing capabilities;

[0015] Step S3.3: Backend service expansion, increasing the number or processing capacity of backend services to meet growing business needs;

[0016] Step S3.4: API support, providing a standard API interface to allow third-party applications or system integration;

[0017] Compared with the prior art, the present invention has the following beneficial effects:

[0018] Fine-grained security protection: By configuring different security policies and functions for each proxy transit center, the present invention provides fine-grained security protection, which can more effectively deal with various network security threats.

[0019] Network topology decoupling: The multi-layer proxy architecture reduces the coupling of network topology, making the network structure clearer, more flexible, and easier to manage and expand.

[0020] Flexibility and scalability: The present invention allows dynamic adjustment and optimization according to changes in business requirements and network environment, and has good flexibility and scalability.

[0021] High performance and stability: By optimizing the workflow and data processing mechanism of the proxy transit center, the present invention can provide high performance and stable network proxy services. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 Schematic diagram of network unit division and setting of proxy transfer center;

[0023] Figure 2 This is a request response process diagram;

[0024] Figure 3 This is a schematic diagram of the monitoring link association implementation. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] The embodiment of the present invention provides a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture, which performs the following steps:

[0027] Step S1: Divide network units and set up proxy transit centers. Select a demand management system, define the boundaries of network units according to network topology and business requirements, and configure and manage the proxy transit centers in each network unit;

[0028] Specifically, the step includes:

[0029] Step S1.1: Security policy configuration, configure security policies for each proxy transfer center, such as data encryption, access control, content filtering, etc.;

[0030] Data encryption can include:

[0031] Transport layer encryption:

[0032] Use TLS / SSL protocol to encrypt communications between proxy transfer centers to ensure that data is not stolen or tampered with during transmission.

[0033] Regularly check and renew TLS / SSL certificates to ensure their validity.

[0034] Application layer encryption:

[0035] For application layer data, encryption algorithms such as AES and RSA can be used to encrypt and decrypt the data to prevent data leakage during storage and transmission.

[0036] Consider using a Key Management Service (KMS) to securely manage and distribute keys.

[0037] End-to-end encryption:

[0038] Achieve end-to-end encryption to ensure that data is encrypted throughout the entire process from the source to the destination, and the proxy transit center is only responsible for forwarding encrypted data packets.

[0039] Access controls can include:

[0040] Allow or deny access requests from specific IP addresses or IP address ranges.

[0041] Monitor and update IP whitelist / blacklist in real time to respond to security threats.

[0042] Content filtering can include:

[0043] URL Filtering:

[0044] Block access to malicious websites, phishing sites, adult sites, and more.

[0045] Allow or deny access to specific URLs to meet the security policy requirements of the enterprise.

[0046] Keyword filtering:

[0047] Search for specific keywords or phrases in transmitted data and block messages or files containing them.

[0048] Keyword filtering can be used to prevent the leakage of sensitive information or the spread of inappropriate speech.

[0049] Attachment filtering:

[0050] Check attachments in emails, instant messages, etc. to prevent the spread of malware or viruses.

[0051] Allow or deny attachments of specific file types to meet your enterprise's security policy needs.

[0052] Data Loss Prevention (DLP):

[0053] Monitor and prevent the leakage of sensitive data such as credit card numbers, social security numbers, etc.

[0054] Use a DLP solution to identify, classify, and protect sensitive data.

[0055] Step S1.2: Request reception and distribution, receiving requests from users or clients, processing them according to routing rules and security policies, and distributing the requests to backend services;

[0056] Routing rules can be configured as follows:

[0057] Directly distribute the request to the specified backend service based on the requested URL or target address;

[0058] Static routing rules are simple and direct, but not flexible enough to cope with complex distribution requirements;

[0059] Dynamically determine the distribution target of the request based on specific attributes of the request (such as request header, request parameters, user identity, etc.);

[0060] Distribute requests to multiple backend service instances to achieve load balancing and high availability;

[0061] You can use regular expressions, pattern matching and other techniques to validate request parameters, request body and other data.

[0062] Security policies can include the following aspects:

[0063] Implement fine-grained access control policies to restrict third-party applications' access to resources based on their roles and permissions.

[0064] Use API keys, tokens, or other authentication mechanisms to authenticate requests.

[0065] Use mechanisms such as OAuth 2.0 or JWT (JSON Web Tokens) to implement authentication and authorization.

[0066] Ensure that only authenticated and authorized third-party applications can access the API.

[0067] Verify the data in the request to ensure its validity, integrity and compliance.

[0068] Monitor request traffic to identify and block malicious requests and abnormal behavior.

[0069] Use security devices such as firewalls and intrusion detection / prevention systems (IDS / IPS) to detect and defend against potential threats and attacks.

[0070] Step S1.3: Service processing and response, receiving the response from the backend service, forwarding it to the user or client, and performing necessary optimization processing;

[0071] In order to reduce the amount of data transmitted over the network, the server can compress the response data. This can be achieved by using compression algorithms (such as gzip, deflate, etc.). The compressed data is decompressed after being transmitted to the user or client.

[0072] According to the communication protocol agreed with the backend service (such as HTTP, RPC, etc.), the server needs to parse the received response data and convert it into an internally processable data structure.

[0073] Encapsulate the response data of the backend service into a protocol format that the user or client can understand. For example, if the client is a web browser, the server may need to encapsulate the response data into an HTTP response message.

[0074] In order to prevent system crashes caused by malicious requests or backend service failures, the server can implement current limiting and circuit breaking strategies. Current limiting can limit the number of requests per unit time to prevent system overload; circuit breaking can quickly cut off the connection with the service when a backend service fails to prevent the failure from spreading.

[0075] In order to improve response speed and reduce the pressure on backend services, the server can implement a caching strategy. When receiving the same request, the server can return the response directly from the cache without initiating a request to the backend service again. Based on the context information of the request (such as session ID, user ID, etc.), the server determines which user or client to forward the response to.

[0076] Step S2: Monitoring and logging, the proxy transfer center records detailed logs of network communications, including request information, response information, processing time, etc. At the same time, log query and analysis tools are provided to help administrators quickly locate problems and optimize system performance.

[0077] Record detailed information of each request, such as the initiator of the request (IP address, user ID, etc.), the requested resource (URL, path, etc.), the request method (GET, POST, etc.), the request parameters (if any), etc. This information helps administrators understand the usage of the system and the request behavior of the client.

[0078] Monitoring can continuously monitor the performance indicators of the monitoring proxy transfer center and backend services in real time, such as response time, throughput, error rate, etc. For subsequent analysis, statistical analysis of monitoring data and logs can be performed to identify performance bottlenecks and potential problems. Set alarm thresholds and send alarm notifications when monitoring indicators exceed the thresholds. Alarm notifications can be sent via email, SMS, etc. Use charts and dashboards to display monitoring data.

[0079] In terms of log storage and management, the proxy transit center will adopt appropriate methods, such as storing logs in files, databases or special log systems. At the same time, in order to ensure the availability of logs, the proxy transit center will regularly clean up expired logs to avoid unlimited disk space occupation.

[0080] Step S3: System optimization and expansion, providing flexible interfaces and tools, allowing administrators to dynamically add new network units, proxy transit centers or backend services, and adjust related configurations and policies. At the same time, regular performance testing and security assessments are conducted, and the system is optimized and improved based on the assessment results.

[0081] Specifically, the step includes:

[0082] Step S3.1: Network unit expansion: when business demand increases, new network units are added and an agent transfer center is established in them;

[0083] Step S3.2: Proxy transit center expansion, increasing the number of proxy transit centers in the network unit to improve request processing capabilities;

[0084] Step S3.3: Backend service expansion, increasing the number or processing capacity of backend services to meet growing business needs;

[0085] Step S3.4: API support, providing a standard API interface to allow third-party applications or system integration;

[0086] It can provide version control for APIs, allowing smooth transition between old and new versions. Identify the version in the URL path, request header, or query parameter. Support JSON and XML as response formats to meet the needs of different integration parties. Define clear error response formats and status codes.

[0087] The present invention provides a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture. Through the multi-layer proxy architecture, each layer of the network is divided into independent network units as needed to set up independent proxy transit centers, so as to realize request forwarding between proxy transit centers, and then each proxy transit center distributes user requests to different back-end service processing. Each proxy transit center has different security policies and functions, such as data encryption, access control, content filtering, etc., to reduce the coupling of network topology. This architecture can provide more detailed and comprehensive security protection.

[0088] The present invention provides fine-grained security protection by configuring different security policies and functions for each proxy transit center, and can more effectively deal with various network security threats. The establishment of a multi-layer proxy architecture reduces the coupling of network topology, making the network structure clearer and more flexible, easy to manage and expand, allowing dynamic adjustment and optimization according to business needs and changes in the network environment, and has good flexibility and scalability. The workflow and data processing mechanism of the proxy transit center are optimized to provide high-performance and stable network proxy services.

[0089] Those skilled in the art know that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be considered as structures within the hardware component; the devices, modules, and units for realizing various functions can also be considered as both software modules for realizing the method and structures within the hardware component.

[0090] The above is only a specific embodiment of the present invention, and the present invention is described in detail. The unexplained part is a conventional technology. However, the protection scope of the present invention is not limited to this. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture, characterized in that: The steps include: Step S1: Network unit division and setting of proxy transit center: Based on network topology and service requirements, define the boundaries of network units, and configure and manage the proxy transit center in each network unit; Step S2: Monitoring and logging: The proxy transfer center records detailed logs of network communications, including request information, response information, and processing time; at the same time, it provides log query and analysis tools to help administrators quickly locate problems and optimize system performance; Step S3: System optimization and expansion: Provide flexible interfaces and tools to allow administrators to dynamically add new network units, proxy transit centers or back-end services, and adjust related configurations and policies; at the same time, perform performance tests and security assessments regularly, and optimize and improve the system based on the assessment results.

2. According to claim 1, a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture is characterized in that: The step S1 further comprises: Step S1.1: Security policy configuration: configure security policies for each proxy transit center; Step S1.2: Request reception and distribution: Receive requests from users or clients, process them according to routing rules and security policies, and distribute the requests to backend services; Step S1.3: Service processing and response: Receive the response from the backend service, forward it to the user or client, and perform necessary optimization processing.

3. According to claim 1, a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture is characterized in that: The step S3 further comprises: Step S3.1: Network unit expansion: When business demand increases, new network units are added and agent transfer centers are set up in them; Step S3.2: Proxy transit center expansion: increase the number of proxy transit centers in the network unit to improve request processing capabilities; Step S3.3: Backend service expansion: Increase the number or processing capacity of backend services to meet growing business needs; Step S3.4: API support, providing a standard API interface to allow third-party applications or system integration; Steps S3.1 to S3.4 may be executed in any order.

4. According to claim 2, a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture is characterized in that: In step S1.1, the security policy includes data encryption, access control, and content filtering.

5. According to claim 2, a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture is characterized in that: The step S1.1 also includes providing but is not limited to a configuration interface or API: allowing an administrator to define and configure various security policies and send the configuration information to the proxy transfer center.

6. A fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture according to claim 5, characterized in that: The step S1.2 also includes request verification and filtering according to the configured security policy, and then forwarding the request to the backend service using the load balancing policy.

7. According to claim 2, a fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture is characterized in that: The step S1.3 also includes forwarding the request according to the source address and routing rules, and performing necessary processing on the response before forwarding.

8. A fine-grained secure and controllable network proxy method based on a multi-layer proxy architecture according to claim 7, characterized in that: In step S1.3, necessary processing is performed on the response including data encryption or compression.

Images