A method, system and storage medium for implementing intranet service access

Abstract

A method, system and storage medium for realizing intranet service access, comprising providing a visual interface for user registration and service configuration; starting a server proxy service and configuring two ports; starting a local service and a client proxy service and setting an external service port; when the client proxy service is started, performing load balancing through Nginx to select a server proxy for identity authentication; the server proxy saves the mapping relationship between a unique identifier and a TCP connection and updates the Nginx routing relationship; the external network carries the unique identifier through an HTTP request and sends it to Nginx; Nginx determines the corresponding server proxy routing relationship according to the unique identifier and routes the HTTP request to the corresponding server proxy; the server proxy forwards the HTTP request to the client proxy, and the client proxy forwards the HTTP request to the local service; the local service processes the HTTP request and returns a response, and the response is returned along the original path.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, system and storage medium for implementing intranet service access. Background Art

[0002] With the rapid development of Internet technology, IP address resources have gradually become scarce. In order to solve this problem, NAT (Network Address Translation) technology came into being and is widely used in various network environments such as homes and enterprises. NAT technology converts private IP addresses into public IP addresses, allowing multiple internal devices to share a public IP address to access the Internet. However, while this mechanism brings convenience, it also raises a new problem: the devices in the intranet cannot be directly accessed by the external network because the actual IP addresses and open service ports are invisible to the outside world.

[0003] At the same time, with the progress of digitalization and Internetization, more and more users need to cross network boundaries to access intranet services, such as home NAS (network attached storage), company internal servers, development environments, etc. These services usually run in the intranet environment behind NAT, and it is difficult to access them directly through the public network because there is no public IP address.

[0004] In addition, for network security and privacy protection reasons, many organizations and individuals do not want to directly expose intranet services to the public network to avoid potential attack risks.

[0005] Therefore, how to achieve intranet service access without changing the existing network architecture and without the need for a public IP has become a problem to be solved by existing technologies. Summary of the invention

[0006] The main purpose of the present invention is to provide a method, system and storage medium for implementing intranet service access, which can implement intranet service access without changing the existing network architecture and without the need for a public network IP.

[0007] To achieve the above object, the present invention provides a method for implementing intranet service access, which comprises the following steps:

[0008] Provide a visual interface for user registration and service configuration;

[0009] Start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests;

[0010] Start the local service and client proxy service, and set an external service port;

[0011] When the client proxy service is started, Nginx is used to load balance and select the server proxy, and then perform identity authentication;

[0012] After the identity authentication is passed, the server proxy saves the mapping relationship between the unique identifier and the TCP connection, and updates the Nginx routing relationship;

[0013] Start the external network service. The external network carries a unique identifier through HTTP request and sends it to Nginx. Nginx determines the corresponding server-side proxy routing relationship based on the unique identifier and routes the HTTP request to the corresponding server-side proxy. The server-side proxy forwards the HTTP request to the client proxy, and the client proxy forwards the HTTP request to the local service.

[0014] The local service processes the HTTP request and returns the response to the external network.

[0015] Optionally, when the client proxy service is started, the server proxy is selected through Nginx load balancing and identity authentication is performed. The specific steps include:

[0016] When the client proxy service is started, a server proxy is selected through Nginx load balancing to establish a TCP connection and generate a unique identifier;

[0017] When establishing a TCP connection, the client sends the account number, password, and unique identifier to the server proxy as authentication information;

[0018] When the server agent establishes a TCP connection, it will perform identity authentication based on the received account and password.

[0019] Optionally, Nginx chooses to use a round-robin or weight-based load balancing algorithm based on the performance of the deployment machine.

[0020] Optionally, when the performance of the deployed machines is the same, Nginx uses a round-robin load balancing algorithm; when the performance of the deployed machines is different, Nginx uses a weight-based load balancing algorithm.

[0021] Optionally, the TCP transmission between the client proxy and the server proxy is encrypted using the SSL / TLS protocol.

[0022] Optionally, each client proxy service is assigned or associated with a specific local service instance.

[0023] Optionally, the user configuration content includes at least role authority management and traffic control management.

[0024] Optionally, role permission management is implemented by configuring corresponding access permissions for different roles;

[0025] Traffic control management limits traffic based on IP access traffic. When the access traffic of the same IP exceeds the preset threshold, access is denied.

[0026] Corresponding to the method for implementing intranet service access, the present invention provides a system for implementing intranet service access, which includes:

[0027] Display module, used to provide a visual interface for user registration and service configuration;

[0028] The server proxy module is used to start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests; it is also used to forward HTTP requests to the client proxy module;

[0029] The local service module is used to start the local service; process the HTTP request and return the response to the external network service module;

[0030] The client proxy module is used to start the client proxy service and set an external service port; it is also used to forward HTTP requests to the local service module;

[0031] The reverse proxy server is used to select the server proxy for load balancing and perform identity authentication when the client proxy service is started; it is also used to determine the corresponding server proxy routing relationship based on the unique identifier and route the HTTP request to the corresponding server proxy;

[0032] The storage module is used to save the mapping relationship between the unique identifier and the TCP connection and update the Nginx routing relationship after the identity authentication is passed;

[0033] The external network service module is used to start the external network service and send the HTTP request of the external network to the reverse proxy server. The HTTP request carries a unique identifier.

[0034] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which is stored a program for implementing intranet service access. When the program for implementing intranet service access is executed by a processor, the steps of the method for implementing intranet service access as described above are implemented.

[0035] The beneficial effects of the present invention are:

[0036] (1) Compared with the prior art, the present invention uses a public network server as an intermediary, and overcomes the network isolation caused by NAT devices through port mapping and request forwarding technology. Without changing the existing network architecture and without the need for a public network IP, the present invention allows the external network to directly access the devices and services located in the intranet, thereby realizing intranet service access;

[0037] (2) Compared with the prior art, the present invention enables the client to select a server proxy through Nginx load balancing and establish a secure TCP connection when starting, and generates a unique identifier for subsequent identity authentication and request routing, thereby effectively preventing unauthorized access and improving the security of the system;

[0038] (3) Compared with the prior art, the present invention selects a suitable load balancing algorithm according to the performance of the deployment machine through Nginx, which can optimize resource utilization, improve system response speed and stability, avoid performance bottlenecks, and improve the processing capacity and user experience of the overall system;

[0039] (4) Compared with the prior art, the present invention encrypts the TCP transmission between the client agent and the server agent through the SSL / TLS protocol, thereby ensuring the security and integrity of data transmission, preventing data leakage and tampering, and enhancing the security of the system;

[0040] (5) Compared with the prior art, the present invention ensures accurate routing and processing of requests by specifying or associating each client proxy service to a specific local service instance, thereby improving the reliability and maintainability of the system;

[0041] (6) Compared with the prior art, the present invention enables the system to be flexibly configured according to the needs and scenarios of different users through the richness of user configuration content (including role authority management and flow control management), thereby improving the applicability and security of the system;

[0042] (7) Compared with the prior art, the present invention configures corresponding access rights for different roles through role-based permission management, thereby achieving fine-grained permission control and ensuring that only authorized users can access specific resources; flow control management effectively prevents malicious attacks and excessive use of resources, and protects the stability and security of the system. This dual management mechanism makes the system more robust and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0044] Figure 1 A simplified flow chart of a method for implementing intranet service access according to an embodiment of the present invention;

[0045] Figure 2 A framework diagram of a system for implementing intranet service access according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0047] like Figure 1 As shown, a method for implementing intranet service access of the present invention comprises the following steps:

[0048] Provide a visual interface for user registration and service configuration;

[0049] Start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests;

[0050] Start the local service and client proxy service, and set an external service port;

[0051] When the client proxy service is started, Nginx is used to load balance and select the server proxy, and then perform identity authentication;

[0052] After the identity authentication is passed, the server proxy saves the mapping relationship between the unique identifier and the TCP connection, and updates the Nginx routing relationship;

[0053] Start the external network service. The external network carries a unique identifier through HTTP request and sends it to Nginx. Nginx determines the corresponding server-side proxy routing relationship based on the unique identifier and routes the HTTP request to the corresponding server-side proxy. The server-side proxy forwards the HTTP request to the client proxy, and the client proxy forwards the HTTP request to the local service.

[0054] The local service processes the HTTP request and returns the response to the external network.

[0055] The present invention utilizes a public network server as an intermediary, and overcomes the network isolation caused by NAT devices through port mapping and request forwarding technology. Without changing the existing network architecture and without the need for a public network IP, the present invention allows the external network to directly access devices and services located in the intranet, thereby realizing intranet service access.

[0056] In this embodiment, when the client proxy service is started, the server proxy is selected through Nginx load balancing, and identity authentication specifically includes the following steps:

[0057] When the client proxy service is started, a server proxy is selected through Nginx load balancing to establish a TCP connection and generate a unique identifier;

[0058] When establishing a TCP connection, the client sends the account number, password, and unique identifier to the server proxy as authentication information;

[0059] When the server agent establishes a TCP connection, it will perform identity authentication based on the received account and password.

[0060] Preferably, the unique identifier is specifically a UUID (Universally Unique Identifier), which is a software construction standard. In a distributed system, it is used to allow all elements in the distributed system to have unique identification. UUID can provide a unique ID for information in a computer, usually represented by a string of 36 hexadecimal digits.

[0061] The present invention enables the client to select a server proxy through Nginx load balancing and establish a secure TCP connection when starting, and simultaneously generates a unique identifier for subsequent identity authentication and request routing, thereby effectively preventing unauthorized access and improving the security of the system.

[0062] In this embodiment, Nginx selects polling or weight-based load balancing algorithm according to the performance of the deployment machine. Reverse proxy server proxy service is implemented through Nginx, and the server proxy is clustered to avoid the single point problem of the server proxy and improve the availability of the server proxy.

[0063] Preferably, when the performance of the deployed machines is the same, Nginx adopts a polling load balancing algorithm; when the performance of the deployed machines is different, Nginx adopts a weight-based load balancing algorithm.

[0064] Preferably, the same machine performance can be the same eight-core processor, 16GB memory; different machine performance adopts a weight-based algorithm, the weight of good performance is greater than the weight of poor performance, and the specific weight size can be adjusted according to the actual test situation.

[0065] The present invention selects a suitable load balancing algorithm according to the performance of the deployment machine through Nginx, which can optimize resource utilization, improve system response speed and stability, avoid performance bottlenecks, and improve the processing capacity and user experience of the overall system.

[0066] In this embodiment, the TCP transmission between the client agent and the server agent is encrypted using the SSL / TLS protocol.

[0067] The present invention encrypts the TCP transmission between the client agent and the server agent through the SSL / TLS protocol, ensures the security and integrity of data transmission, prevents data leakage and tampering, and enhances the security of the system.

[0068] Preferably, TCP connection management is implemented using the Netty framework. Netty framework: Netty is a high-performance, asynchronous, event-driven network application framework that is mainly used to simplify and accelerate Java network programming. It is designed for building scalable, highly concurrent server-side and client-side applications and is widely used in distributed systems, game servers, real-time communications, big data, microservices, API gateways, message queues, RPC frameworks and other network communication scenarios.

[0069] In this embodiment, each client proxy service is assigned or associated with a specific local service instance.

[0070] The present invention ensures accurate routing and processing of requests by specifying or associating each client proxy service to a specific local service instance, thereby improving the reliability and maintainability of the system.

[0071] In this embodiment, the user configuration content includes at least role authority management and flow control management.

[0072] The present invention enables the system to be flexibly configured according to the needs and scenarios of different users through the richness of user configuration content (including role authority management and flow control management), thereby improving the applicability and security of the system.

[0073] Preferably, role permission management is achieved by configuring corresponding access permissions for different roles;

[0074] Traffic control management limits traffic based on IP access traffic. When the access traffic of the same IP exceeds the preset threshold, access is denied.

[0075] The present invention configures corresponding access rights for different roles through role authority management, realizes fine-grained authority control, and ensures that only authorized users can access specific resources; flow control management effectively prevents malicious attacks and excessive use of resources, and protects the stability and security of the system. This dual management mechanism makes the system more robust and reliable.

[0076] It is understandable that both role authority management and traffic control management can be managed in a manner that is achievable in the prior art, and the above content is only used as an example and does not constitute an improper limitation on the content of the present invention.

[0077] like Figure 2 As shown, the present invention also provides a system for implementing intranet service access, which includes:

[0078] Display module, used to provide a visual interface for user registration and service configuration;

[0079] The server proxy module is used to start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests; it is also used to forward HTTP requests to the client proxy module;

[0080] The local service module is used to start the local service; process the HTTP request and return the response to the external network service module;

[0081] The client proxy module is used to start the client proxy service and set an external service port; it is also used to forward HTTP requests to the local service module;

[0082] The reverse proxy server is used to select the server proxy for load balancing and perform identity authentication when the client proxy service is started; it is also used to determine the corresponding server proxy routing relationship based on the unique identifier and route the HTTP request to the corresponding server proxy;

[0083] The storage module is used to save the mapping relationship between the unique identifier and the TCP connection and update the Nginx routing relationship after the identity authentication is passed;

[0084] The external network service module is used to start the external network service and send the HTTP request of the external network to the reverse proxy server. The HTTP request carries a unique identifier.

[0085] The embodiment of the present invention further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the memory in the above embodiment; or a computer-readable storage medium that exists independently and is not installed in a device. The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement Figure 1 The computer readable storage medium may be a read-only memory, a disk or an optical disk.

[0086] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system embodiment and the storage medium embodiment, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0087] Furthermore, in this document, the terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device that includes the element.

[0088] The above description shows and describes the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the invention, through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not depart from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for implementing intranet service access, characterized in that: The following steps are involved: Provide a visual interface for user registration and service configuration; Start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests; Start the local service and client proxy service, and set an external service port; When the client proxy service is started, Nginx is used to load balance and select the server proxy, and then perform identity authentication; After the identity authentication is passed, the server proxy saves the mapping relationship between the unique identifier and the TCP connection, and updates the Nginx routing relationship; Start the external network service. The external network carries a unique identifier through HTTP request and sends it to Nginx. Nginx determines the corresponding server-side proxy routing relationship based on the unique identifier and routes the HTTP request to the corresponding server-side proxy; The server proxy forwards the HTTP request to the client proxy, and the client proxy forwards the HTTP request to the local service; The local service processes the HTTP request and returns the response to the external network.

2. The method for implementing intranet service access according to claim 1, characterized in that: When the client proxy service is started, the server proxy is selected through Nginx load balancing and identity authentication is performed. The specific steps include: When the client proxy service is started, a server proxy is selected through Nginx load balancing to establish a TCP connection and generate a unique identifier; When establishing a TCP connection, the client sends the account number, password, and unique identifier to the server proxy as authentication information; When the server agent establishes a TCP connection, it will perform identity authentication based on the received account and password.

3. The method for implementing intranet service access according to claim 1, characterized in that: Nginx chooses to use a round-robin or weight-based load balancing algorithm based on the performance of the deployment machine.

4. The method for implementing intranet service access according to claim 3, characterized in that: When the performance of the deployed machines is the same, Nginx uses a polling load balancing algorithm; when the performance of the deployed machines is different, Nginx uses a weight-based load balancing algorithm.

5. The method for implementing intranet service access according to claim 1, characterized in that: The TCP transmission between the client proxy and the server proxy is encrypted using the SSL / TLS protocol.

6. The method for implementing intranet service access according to claim 1, characterized in that: Each client proxy service is assigned or associated with a specific local service instance.

7. The method for implementing intranet service access according to claim 1, characterized in that: User configuration content at least includes role authority management and traffic control management.

8. The method for implementing intranet service access according to claim 7, characterized in that: Role permission management is achieved by configuring corresponding access rights for different roles; Traffic control management limits traffic based on IP access traffic. When the access traffic of the same IP exceeds the preset threshold, access is denied.

9. A system for implementing intranet service access, characterized in that: include: Display module, used to provide a visual interface for user registration and service configuration; The server proxy module is used to start the server proxy service and configure two ports, one for client proxy connection and the other for receiving external network requests; it is also used to forward HTTP requests to the client proxy module; The local service module is used to start the local service; process the HTTP request and return the response to the external network service module; The client proxy module is used to start the client proxy service and set an external service port; it is also used to forward HTTP requests to the local service module; The reverse proxy service module is used to select the server proxy for load balancing and perform identity authentication when the client proxy service is started; It is also used to determine the corresponding server-side proxy routing relationship based on the unique identifier and route the HTTP request to the corresponding server-side proxy; The storage module is used to save the mapping relationship between the unique identifier and the TCP connection and update the Nginx routing relationship after the identity authentication is passed; The external network service module is used to start the external network service and send the HTTP request to the reverse proxy service module. The HTTP request carries a unique identifier.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program for implementing intranet service access, and when the program for implementing intranet service access is executed by a processor, the steps of the method for implementing intranet service access as described in any one of claims 1 to 8 are implemented.

Images