Access request processing method and device, electronic equipment and readable medium

Abstract

The embodiment of the invention provides an access request processing method and device, electronic equipment and a readable medium, and relates to the technical field of networks, in the method, an intermediate proxy service receives a target access request sent by an access party; the target access request is used for accessing a target service, the target service is a national secret communication service associated with the intermediate proxy service, and a domain name of the national secret communication service recorded by the access party is synchronized as a domain name of the intermediate proxy service in advance. Sending the target access request to the target service in a state secret communication mode based on state secret communication related information and target address information which are pre-configured in the first configuration file; the first configuration file is a configuration file of the intermediate proxy service, and the target address information is address information of the target service. And sending response data returned by the target service to the access party. In this way, it is ensured that a state secret communication mode is adopted during interaction with the target service, and then the access security of the state secret communication service is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to an access request processing method, device, electronic device and readable medium. Background Art

[0002] With the continuous development of network technology, container platforms are increasingly used. Multiple containers can be created in the container platform. One container can be used to deploy an application service. Each application service provides its own functions, such as login, detection, data query, etc. In actual use, you can access the application service, send data to the application service, or get data from the application service.

[0003] In the prior art, in order to ensure security, some services need to be accessed in the form of national secret communication. Accordingly, how to ensure that the national secret communication method is used when interacting with these services has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present invention provide an access request processing method, device, electronic device and readable medium, which can solve the above technical problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses an access request processing method, which is applied to any intermediate proxy service in a container platform, and the intermediate proxy service is associated with at least one national secret communication service in the container platform. The method includes: Receive a target access request sent by a visitor; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the visitor is pre-synchronized as the domain name of the intermediate proxy service; Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service; The response data returned by the target service is sent to the accessing party.

[0006] On the other hand, an embodiment of the present invention discloses an access request processing device, which is applied to any intermediate proxy service in a container platform, wherein the intermediate proxy service is associated with at least one national secret communication service in the container platform, and the device includes: A receiving module, configured to receive a target access request sent by a visitor; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the visitor is pre-synchronized as the domain name of the intermediate proxy service; A first processing module is configured to send the target access request to the target service in a national secret communication manner based on the national secret communication related information and target address information pre-configured in a first configuration file; the first configuration file is a configuration file of the intermediate proxy service, and the target address information is address information of the target service; The return module is used to send the response data returned by the target service to the accessing party.

[0007] On the other hand, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store executable instructions, and the executable instructions enable the processor to execute the aforementioned method.

[0008] The embodiment of the present invention further discloses one or more machine-readable media on which instructions are stored, and when executed by one or more processors, the processors execute the aforementioned method.

[0009] The embodiment of the present invention includes the following advantages: the access request processing method provided by the embodiment of the present invention, the intermediate proxy service receives the target access request sent by the access party; the target access request is used to access the target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the access party is pre-synchronized as the domain name of the intermediate proxy service. Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service. The response data returned by the target service is sent to the access party. In this way, by pre-associating the national secret communication service with the intermediate proxy service in the container platform, the domain name of the national secret communication service associated with the intermediate proxy service recorded by the accessing party in advance is synchronized as the domain name of the intermediate proxy service. When the accessing party requests to access the target service associated with the intermediate proxy service, the target access request is received by the intermediate proxy service, and the intermediate proxy service interacts with the target service in the form of national secret communication on behalf of the accessing party based on the target access request, thereby ensuring that the national secret communication method is used when interacting with the target service, that is, ensuring that the target service is accessed in the form of national secret communication, thereby ensuring the access security of the national secret communication service. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0011] Figure 1 is a flowchart of a method for processing an access request provided by an embodiment of the present invention; Figure 2 is a block diagram of an access request processing device provided by an embodiment of the present invention; Figure 3 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] Figure 1 is a flowchart of a method for processing an access request provided by an embodiment of the present invention, which is applied to any intermediate proxy service in a container platform, wherein the intermediate proxy service is associated with at least one national secret communication service in the container platform, such as Figure 1 As shown, the access request processing method may include the following steps: Step 101, receiving a target access request sent by an accessing party; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the accessing party is pre-synchronized as the domain name of the intermediate proxy service.

[0014] Step 102: Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service.

[0015] Step 103: Send the response data returned by the target service to the accessing party.

[0016] The access request processing method provided by the embodiment of the present invention can be applied to the container scenario, in which the Chinese secret communication service of the container platform is accessed in the form of national secret communication. Among them, the container platform can be built using a container orchestration platform (kubernetes, K8s), and the container platform has multiple containers. Specifically, containerized deployment is adopted when the application is deployed to facilitate management. An application can have at least one application service, and an application service is deployed in a container. An application service can be regarded as an application instance. The container platform can be a container cloud platform. In the container cloud platform, internal access and external access to the application service can be achieved through the multiple access types provided, such as headless service (headless), cluster protocol address (clusterip), node port (nodeport) and other access types. The containers in the container cloud platform share the cloud environment host operating system kernel. Each container contains only the minimum components required to run the application. The container is an independent, executable software unit, which contains all the content required to run the application service, such as code, runtime environment, system tools and system libraries. Multiple containers are run on the same physical server.

[0017] The intermediate proxy service is a proxy service added to the national secret communication service in the container platform. The intermediate proxy service can run on a proxy server for providing a national secret proxy for the national secret communication service. The national secret communication service can be an application service in the container platform that needs to be accessed in the form of national secret communication. There are one or more national secret communication services in the container platform. In an embodiment of the present invention, at least one intermediate proxy service can be added to the container platform in advance. For any intermediate proxy service, the intermediate proxy service can execute the above-mentioned access request processing method to replace the access party and the national secret communication service associated with the intermediate proxy service to interact in the form of national secret communication. Specifically, the national secret communication related information required for access in the form of national secret communication can be configured in advance in the configuration file (i.e., the first configuration file) of the intermediate proxy service, as well as the address information of the national secret communication service associated with the intermediate proxy service. The intermediate proxy service can be accessed in the form of national secret communication, that is, the intermediate proxy service has the ability of national secret communication, and at least one intermediate proxy service can provide proxy services for all national secret communication services in the container platform.

[0018] Among them, an intermediate proxy service can provide proxy services for at least one national secret communication service. Accessing by national secret communication is equivalent to interacting by national secret communication. Specifically, accessing by national secret communication includes: establishing a connection with the application service according to the national secret protocol information, sending an access request encrypted by the national secret algorithm information to the application service, the application service executing the operation indicated by the access request, generating response data encrypted by the national secret algorithm information for the access request, and returning the encrypted response data to the accessing party. Among them, the national secret algorithm information is used to characterize the national secret algorithm used, and the national secret algorithm refers to the domestic cryptographic algorithm.

[0019] Specifically, for any intermediate proxy service, the intermediate proxy service is associated with at least one national secret communication service, and accordingly, the intermediate proxy service provides proxy services for at least one associated national secret communication service. All national secret communication services associated with all intermediate proxy services are all national secret communication services included in the container platform. The target service is a national secret communication service among at least one national secret communication service associated with the intermediate proxy service, and any national secret communication service associated with the intermediate proxy service can be used as the target service. Exemplarily, it is assumed that the intermediate proxy service is associated with national secret communication service a and national secret communication service b. When the target access request is used to access national secret communication service a, national secret communication service a is the target service, and when the target access request is used to access national secret communication service b, national secret communication service b is the target service. For any target access request received, it is processed based on the above steps 102 to 103.

[0020] Furthermore, the access request for accessing the target service is the target access request. The intermediate proxy service provides proxy services for the national secret communication service, which means that the access request for accessing the national secret communication service is submitted to the intermediate proxy service, and the intermediate proxy service is responsible for forwarding the target access request to the national secret communication service in the form of national secret communication, and forwarding the response data returned by the national secret communication service to the accessing party.

[0021] Accordingly, in order to ensure that the access request for accessing the target service is submitted to the intermediate proxy service, in an embodiment of the present invention, the domain name of the national secret communication service (including the above-mentioned target service) associated with the intermediate proxy service recorded by the accessing party is pre-synchronized with the domain name of the intermediate proxy service. Among them, when the accessing party needs to access the service, it often sends an access request to the application service based on the domain name of the application service recorded internally. If the domain name of the national secret communication service associated with the intermediate proxy service recorded by the accessing party is not synchronized with the domain name of the intermediate proxy service, then the access request will be sent directly to the national secret communication service. Accordingly, the domain name of the national secret communication service associated with the intermediate proxy service recorded by the accessing party is synchronized with the domain name of the intermediate proxy service, so that the target access request is actually sent to the intermediate proxy service.

[0022] In summary, in the access request processing method provided by the embodiment of the present invention, the intermediate proxy service receives the target access request sent by the accessing party; the target access request is used to access the target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the accessing party is pre-synchronized as the domain name of the intermediate proxy service. Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service. The response data returned by the target service is sent to the accessing party. In this way, by pre-associating the national secret communication service with the intermediate proxy service in the container platform, the domain name of the national secret communication service associated with the intermediate proxy service recorded by the accessing party in advance is synchronized as the domain name of the intermediate proxy service. When the accessing party requests to access the target service associated with the intermediate proxy service, the target access request is received by the intermediate proxy service, and the intermediate proxy service interacts with the target service in the form of national secret communication on behalf of the accessing party based on the target access request, thereby ensuring that the national secret communication method is used when interacting with the target service, that is, ensuring that the target service is accessed in the form of national secret communication, thereby ensuring the access security of the national secret communication service.

[0023] Optionally, when the intermediate proxy service is associated with multiple national secret communication services, the first configuration file is pre-configured with service identifiers and address information of each national secret communication service associated with the intermediate proxy service. Accordingly, the embodiment of the present invention may further include the following steps: Step S21: extract the service identifier of the target service carried in the target access request as the target identifier.

[0024] Step S22: Acquire address information corresponding to the service identifier and consistent with the target identifier from the first configuration file as the target address information.

[0025] Specifically, in the case where the intermediate proxy service is associated with multiple national secret communication services, the first configuration file will be pre-configured with the service identifiers and address information of each national secret communication service associated with the intermediate proxy service, that is, the first configuration file will record the service identifiers and address information of these multiple national secret communication services. Specifically, the service identifiers and address information of the national secret communication services can be recorded accordingly. Correspondingly, for the target access request received this time, the content of the bit field used to represent the service identifier in the target access request can be extracted to obtain the target identifier. Among them, the bit field used to represent the service identifier can be pre-defined in the development stage. Exemplarily, the bit field used to represent the service identifier can be the 5th to 8th bits, and the embodiments of the present invention are not limited to this.

[0026] Furthermore, for any address information of a national secret communication service recorded in the first configuration file, the service identifier corresponding to the address information is compared with the target identifier. If the two are the same, it means that the address information of the national secret communication service requested to be accessed this time is the recorded address information, and accordingly, the address information can be used as the target address information.

[0027] In an embodiment of the present invention, the first configuration file is pre-configured with the service identifiers and address information of various national secret communication services associated with the intermediate proxy service. The service identifier of the target service carried in the target access request is extracted as the target identifier. The address information of the corresponding service identifier and the target identifier that is consistent is obtained from the first configuration file as the target address information. In this way, when the intermediate proxy service is associated with multiple national secret communication services, the address information of the target service accessed this time can be accurately known. At the same time, an intermediate proxy service acts as a proxy for multiple national secret communication services, which can reduce the total number of intermediate proxy services required by the container platform, thereby saving costs to a certain extent.

[0028] Optionally, when the intermediate proxy service is associated with a national secret communication service, the first configuration file is pre-configured with address information of the national secret communication service associated with the intermediate proxy service. Accordingly, the embodiment of the present invention may also include the following steps: Step S31, directly read the address information in the first configuration file as the target address information.

[0029] Specifically, if the intermediate proxy service is only associated with one national secret communication service, then only one national secret communication service address information will be pre-configured in the first configuration file. Accordingly, for the target access request received this time, there is no need to extract the target identifier, nor to search in the first configuration file. The target address information can be obtained by directly reading the address information in the first configuration file. In this way, the processing steps can be simplified, thereby improving the overall processing efficiency.

[0030] Optionally, in an embodiment of the present invention, the intermediate proxy service is associated with the at least one national secret communication service through the following steps pre-executed by the control service: Step S41: Determine the service in the container platform that requires access via national secret communication as the national secret communication service.

[0031] Step S42: determine the national secret communication service to be associated for the intermediate proxy service.

[0032] Step S43: When the number of the national secret communication service to be associated is 1, in the proxy information configuration item of the first configuration file, the address information of the national secret communication service to be associated is set.

[0033] Step S44: When the number of the national secret communication services to be associated is greater than 1, in the proxy information configuration item, the service identifier and address information of each of the national secret communication services to be associated are set.

[0034] In an embodiment of the present invention, the control service is a service in the container platform, and the control service may be pre-specified. The control service may first count the services in the container platform that require access via national secret communications as national secret communication services. Create m containers in the container platform, deploy preset code files in these m containers, and obtain m intermediate proxy services, which is equivalent to creating a service for the preset code files. Wherein, m is an integer, and m is not greater than the total number of national secret communication services in the container platform. The preset code file is a code for implementing the functions of the above-mentioned intermediate proxy service. The preset code file may be pre-written by the developer, or may be the national secret module code directly obtained from the open source software. The embodiment of the present invention does not limit this.

[0035] Furthermore, in one implementation, m may be equal to the total number of national secret communication services in the container platform. In this way, by creating the same number of intermediate proxy services, a corresponding national secret communication service may be assigned to each intermediate proxy service. In an embodiment of the present invention, an intermediate proxy service may be obtained by creating a container and deploying a preset code file in the container, so the creation cost of a single intermediate proxy service is relatively low. Accordingly, by creating the same number of intermediate proxy services and assigning a national secret communication service to be associated to each intermediate proxy service, the configuration operation of the proxy information configuration items of the intermediate proxy service can be simplified while avoiding excessive costs, as well as simplifying the subsequent operation of determining the target address information.

[0036] Exemplarily, an intermediate proxy service may be selected from the unallocated intermediate proxy services, and a national secret communication service may be selected from the unallocated national secret communication services as the national secret communication service to be associated with the intermediate proxy service. Then, the intermediate proxy service is determined as an allocated intermediate proxy service, and the unallocated national secret communication service is determined as an allocated national secret communication service, and the steps of selecting an intermediate proxy service from the unallocated intermediate proxy services and selecting a corresponding national secret communication service from the unallocated national secret communication services are returned until the national secret communication service to be associated is selected for all intermediate proxy services. Among them, in the initial state, the unallocated intermediate proxy services include all intermediate proxy services, and the unallocated national secret communication services include all national secret communication services in the container platform. When selecting an intermediate proxy service from the unallocated intermediate proxy services, the selection may be made randomly, and the selection of a national secret communication service from the unallocated national secret communication services may also be made randomly, or the national secret communication service closest to the intermediate proxy service may be selected, and the embodiment of the present invention does not limit this.

[0037] In another implementation, m may be less than the total number of national secret communication services on the container platform. Accordingly, the m intermediate proxy services may be arranged in sequence first, for example, the m intermediate proxy services may be randomly arranged into a sequence. According to the arrangement order of the intermediate proxy services, a national secret communication service is selected for the intermediate proxy service in turn. After completing a round of selection, it is determined whether there are any remaining unselected national secret communication services. If so, a new round of selection is started, that is, from the remaining unselected national secret communication services, a national secret communication service is selected for the intermediate proxy service in turn according to the arrangement order of the intermediate proxy services until there are no remaining unselected national secret communication services. For any intermediate proxy service, the national secret communication service selected for the intermediate proxy service is determined as the national secret communication service to be associated with the intermediate proxy service.

[0038] For any intermediate proxy service, a first configuration file can be set for the intermediate proxy service, wherein the first configuration file of the intermediate proxy service includes multiple configuration items, and each configuration item can be used to configure corresponding information. In the initial state, the values ​​of each configuration item in the first configuration file are empty. After configuration, the values ​​of each configuration item are set to corresponding information. Specifically, the proxy information configuration item can be the address information of the national secret communication service to be associated with the intermediate proxy service. Exemplarily, the proxy information configuration item can be expressed as: location / {proxy_pass}. The address information of the national secret communication service to be associated with the intermediate proxy service can be used as the specific value of the proxy information configuration item in the first configuration file of the intermediate proxy service, so as to associate the intermediate proxy service with the national secret communication service to be associated, that is, the intermediate proxy service is added to these national secret communication services to be associated.

[0039] In the case where there is one national secret communication service to be associated with the intermediate proxy service, only the address information of this one national secret communication service is written in the proxy information configuration item. In the case where there are multiple national secret communication services to be associated with the intermediate proxy service, the address information and service identification of these multiple national secret communication services are written in the proxy information configuration item. Among them, the service identification can be information used to uniquely indicate the national secret communication service. Exemplarily, the service identification can be a number, name, etc. pre-assigned to the national secret communication service. For any national secret communication service to be associated with the intermediate proxy service, the address information and service identification of the national secret communication service to be associated can be stored correspondingly. Exemplarily, the service identification can be used as the key name and the address information can be used as the key value to store in the form of a key-value pair. Alternatively, a subfolder is created with the service identification as the subfolder name, and the address information is stored in the subfolder to achieve corresponding storage.

[0040] The address information of the national secret communication service may be the information required to access the national secret communication service, and the address information may be regarded as the communication address of the national secret communication service. For example, the address information may be the domain name of the national secret communication service. Accordingly, the intermediate proxy service may send the target access request to the target service in the form of national secret communication according to the address information of the target service and based on the national secret communication related information.

[0041] In an embodiment of the present invention, the services that require national secret communication to be accessed in the container platform are determined in advance as national secret communication services. The national secret communication services to be associated are determined for the intermediate proxy service. When the number of national secret communication services to be associated is 1, the address information of the national secret communication services to be associated is set in the proxy information configuration item of the first configuration file. In this way, when the intermediate proxy service proxies the target access request of the accessing party, the target access request can be accurately forwarded to the corresponding national secret communication service based on the configured address information, thereby ensuring processing efficiency. When the number of national secret communication services to be associated is greater than 1, the service identifier and address information of each national secret communication service to be associated are set in the proxy information configuration item. In this way, the total number of required intermediate proxy services can be reduced, thereby reducing costs.

[0042] Optionally, the above-mentioned step of determining the service in the container platform that requires national secret communication to be accessed as the national secret communication service may specifically include: step S41a, determining the application service in the container platform with a specified identification field as the national secret communication service. And / or, step S41b, determining the application service with a specified service type in the container platform as the national secret communication service. That is, in an embodiment of the present invention, the national secret communication service may include an application service with a specified identification field, or include an application service with a specified service type, or include an application service with a specified identification field and an application service with a specified service type.

[0043] In actual application scenarios, the container platform can be deployed first, and then the various application services of the application can be deployed in the container platform. Among them, the method of deploying the container platform can be selected as needed, and the embodiment of the present invention does not limit this. The user can set a specified identification field for the application service in advance as needed. Among them, the specified identification field is used to characterize that the application service requires access in the form of national secret communication, and the specific form of the specified identification field can be set as needed. Exemplarily, the specified identification field can be GM. When setting the specified identification field for the application service, the specified identification field can be set in the configuration file of the application service. Accordingly, in step S41a, the control service can detect whether there is a specified identification field in the configuration file of each application service in the container platform. If so, it is determined that the application service is set with a specified identification field, and the application service is determined as a national secret communication service.

[0044] Furthermore, the specified type can be set in advance by the user as needed, and the specified type is used to characterize the type of service that requires access in the form of national secret communication. Exemplarily, the data source type can be used as the specified type so that application services of all data source types are used as national secret communication services, and the embodiments of the present invention are not limited to this. Specifically, a type field characterizing the specified type can be added to the configuration file of the control service in advance. After the application services of the application are deployed in the container platform, the type of each application service can be recorded, and a type field can be set in the configuration file of the application service. The type field is used to characterize the type of the application service. In step S41b, the control service can detect whether the type field in the configuration file of each application service is the same as the type field characterizing the specified type. If they are the same, the application service is determined to be a national secret communication service.

[0045] In an embodiment of the present invention, by identifying application services with designated identification fields in the container platform and / or application services with designated service types, it is possible to determine the national secret communication services in the container platform, thereby ensuring the efficiency of determining the national secret communication services to a certain extent.

[0046] In an embodiment of the present invention, the domain name of the intermediate proxy service can be pre-synchronized to the accessing party as the domain name of the associated national secret communication service. Optionally, the domain name of the intermediate proxy service is pre-synchronized through the following steps: Step S51: determine the service that does not support national encryption communication in the container platform as the access party, and obtain the domain name of the intermediate proxy service.

[0047] Step S52: For any of the access parties, the domain names of the national secret communication services associated with the intermediate proxy service stored in the second configuration file are modified to the domain name of the intermediate proxy service; the second configuration file is the configuration file of the access party.

[0048] The above steps S51 to S52 may be executed by a control service, or may be executed by an intermediate proxy service, which is not limited in the embodiment of the present invention.

[0049] In actual application scenarios, for application services in the container platform, when accessing the application services internally, access is made through the domain name of the application service. Some internal services do not support national secret communication and can only be accessed through Hypertext Transfer Protocol Secure (https). However, some services have higher security requirements. For example, some services involve data with a higher security level. In order to ensure data security, they need to be accessed in the form of national secret communication to avoid the problem that information in the service can be easily accessed by network attackers through https access and data security cannot be ensured. Among them, https adds a security protocol (for example, Transport Layer Security (TLS) / Secure Sockets Layer (SSL)) on the basis of Hypertext Transfer Protocol (http) to achieve secure data transmission. In an embodiment of the present invention, services that do not support national secret communication in the container platform can be collected. For example, a service list input by a user can be received, and the service identifier of the service that does not support national secret communication is recorded in the service list. Accordingly, the service represented by the service identifier recorded in the service list can be determined as the aforementioned access party. The second configuration file of the access party may record the domain names of other application services in the container platform. Exemplarily, the second configuration file of the access party may record the correspondence between the service identifier of the application service and the domain name of the application service.

[0050] The domain name of the intermediate proxy service and the domain name of the national secret communication service are generated by the domain name proxy service. Among them, the domain name proxy service is a component for providing a domain name system (Domain Name System, DNS) proxy for the container platform. After the application service is successfully deployed, the domain name proxy service generates a domain name for the application service. Exemplarily, the domain name proxy service can be the default DNS service in the container platform, and the default DNS service can be a core DNS (CoreDNS) server. In an embodiment of the present invention, after the intermediate proxy service is created, the domain name proxy service generates a domain name for the intermediate proxy service. Accordingly, for any intermediate proxy service, the domain name previously generated for the intermediate proxy service can be read. The domain name proxy service can generate a domain name based on the namespace and service name of the service, and the generated domain name can be used for mutual positioning between services. Since the domain name generated by the domain name proxy service is not affected by changes in the Internet Protocol (Internet Protocol, IP) address of the service, that is, no matter how the service IP address changes, the domain name generated by the domain name proxy service for the service will not change. Therefore, compared with the method of using the service IP address, the problem of being unable to locate the service can be avoided.

[0051] Furthermore, the domain name proxy service can generate multiple domain names in different formats for a service. Exemplarily, multiple domain names in different formats generated for a service may include the following three formats: a short domain name format, a namespace-qualified domain name format, and a global domain name format, and the short domain name format, the namespace-qualified domain name format, and the global domain name format can be represented as: yourapp, yourapp.namespace, yourapp.namespace.svc.cluster.local, respectively.

[0052] Accordingly, for any national secret communication service associated with the intermediate proxy service, the domain names of various formats corresponding to the service identifier of the national secret communication service stored in the second configuration file of the accessing party can be modified to the domain names of the same format of the intermediate proxy service. For example, the domain name of the short domain name format of the national secret communication service can be modified to the domain name of the short domain name format of the intermediate proxy service, the domain name of the namespace-limited domain name format of the national secret communication service can be modified to the domain name of the namespace-limited domain name format of the intermediate proxy service, and the domain name of the global domain name format of the national secret communication service can be modified to the domain name of the global domain name format of the intermediate proxy service.

[0053] Exemplarily, assume that the domain name in the global domain name format of a national secret communication service associated with the intermediate proxy service is: kubernetes.namespace.svc.cluster.local, and the domain name in the global domain name format of the intermediate proxy service is: gmproxy.namespace.svc.cluster.local.

[0054] Then you can modify the domain name saved in the second configuration file of the access party: kubernetes.namespace.svc.cluster.local to: gmproxy.namespace.svc.cluster.local.

[0055] Furthermore, the access party can be restarted after the domain name is modified so that the access party reloads the second configuration file, thereby sending an access request with a new domain name. It should be noted that after the access party has the national secret communication capability, the domain name of the national secret communication service stored in the second configuration file of the access party can be modified to the actual domain name of each national secret communication service, so that the switching can be flexibly realized. Through the switching, the access request sent by the access party to the national secret communication service can be directly received by the national secret communication service.

[0056] In an embodiment of the present invention, a service that does not support national secret communication in the container platform is determined as a visitor, and the domain name of the intermediate proxy service is obtained. For any visitor, the domain names of the various national secret communication services associated with the intermediate proxy service stored in the second configuration file are modified to the domain name of the intermediate proxy service; the second configuration file is the configuration file of the visitor. In this way, there is no need to modify the visitor itself. By modifying the domain name of the intermediate proxy service with the domain name of the various national secret communication services associated with the intermediate proxy service stored in the second configuration file of the service that does not support national secret communication, the domain name of the intermediate proxy service is pre-synchronized to the visitor as the domain name of the associated national secret communication service, so that the service that does not support national secret communication can access the national secret communication service through the intermediate proxy service. In this way, it is equivalent to realizing the national secret communication between the visitor who does not have the national secret communication capability and the national secret communication service, and realizing the visitor to interact with the national secret communication service in the form of national secret communication.

[0057] It should be noted that the services that support national secret communications in the container platform can also be used as the access party. In this way, it is equivalent to performing national secret encryption again on the basis of the target access request that has been encrypted by the access party.

[0058] Optionally, in an embodiment of the present invention, the information related to national secret communication includes: a storage path of national secret encryption information corresponding to the domain name of the intermediate proxy service and national secret protocol information; the first configuration file is configured by the following steps performed in advance: Step S61: Set the values ​​of the encryption information item and the protocol information item in the first configuration file to the storage path of the national secret encryption information and the national secret protocol information respectively.

[0059] Accordingly, the step of sending the target access request to the target service in a national secret communication manner based on the national secret communication related information and the target address information pre-configured in the first configuration file may specifically include: Step 1021a: Load the national secret encrypted information based on the storage path of the national secret encrypted information.

[0060] Step 1021b: establish a connection with the target service based on the national secret protocol information and the target address information, and negotiate a communication key with the target service based on the national secret encryption information.

[0061] Step 1021c: encrypt the target access request based on the communication key, and send the encrypted target access request to the target service.

[0062] Among them, step S61 can be executed by the control service. The encryption information item and the protocol information item are respectively used to set the storage path of the national secret encryption information and the configuration items of the national secret protocol information. The storage path of the national secret encryption information and the national secret protocol information can be set as the specific values ​​of the encryption information item and the protocol information item, respectively. In this way, by setting the storage path, the specific value of the encryption information item can be avoided to be too long. The national secret encryption information can be the information required for encryption. Specifically, the national secret encryption information may include an encrypted public key and an encrypted private key. Among them, the encrypted public key is stored in the national secret encryption certificate, and the storage of the encrypted public key can be achieved by storing the national secret encryption certificate. The encrypted private key can also be called the national secret encryption certificate key. The national secret protocol information can be the version number of the national secret protocol, and the national secret protocol is a specification for establishing secure communication using the national secret algorithm described in the national secret standard technical specification. The intermediate proxy service establishes a connection with the corresponding national secret communication service based on the national secret protocol information and address information and performs subsequent interactions, which is equivalent to transforming TLS communication into national secret secure communication that meets the national secret standard.

[0063] In an embodiment of the present invention, the first configuration file of the intermediate proxy service may further include an algorithm information item, which is a configuration item for setting national secret algorithm information, and the national secret algorithm information may be set to a specific value of the algorithm information item. The national secret algorithm information may be the national secret algorithm itself, or may be an identifier for characterizing the national secret algorithm, for example, SM1, SM4, SM5, SM6, SM7, SM8, etc. The national secret algorithm information may indicate the national secret algorithm supported for use.

[0064] Specifically, the intermediate proxy service will load the value of the encryption information item in the first configuration file, access the storage path represented by the value of the encryption information item, and load the national secret encryption information. The intermediate proxy service can load the value of the protocol information item in the first configuration file, use the national secret handshake rules defined by the national secret protocol indicated by the value of the protocol information item to shake hands with the target service, and establish a connection after completing the handshake. In the handshake process, the intermediate proxy service synchronizes the supported national secret algorithm information to the target service, and the target service selects the national secret algorithm used in this interaction and synchronizes it to the intermediate proxy service.

[0065] Furthermore, during the handshake process, the communication key is negotiated with the target service based on the national secret encryption information. Specifically, the intermediate proxy service sends the encrypted public key to the target service. Exemplarily, the intermediate proxy service can send the national secret encryption certificate to the target service so that the target service obtains the encrypted public key in the national secret encryption certificate. The target service encrypts the randomly generated pre-master key based on the encrypted public key. Then it is sent to the intermediate proxy service. Among them, the pre-master key can be a random byte sequence of fixed length. The intermediate proxy service uses the encrypted private key in the national secret encryption information to decrypt the pre-master key. The intermediate proxy service and the target service respectively calculate the master key according to the plaintext pre-master key, the random number of the intermediate proxy service and the random number of the target service. Among them, the random number of the intermediate proxy service and the random number of the target service can be synchronized to each other in advance, and the plaintext pre-master key, the random number of the intermediate proxy service and the random number of the target service can be used as the input of the pseudo-random function, and the output of the pseudo-random function can be used as the master key. Then, the master key is used as the input of the key derivation function, and the output of the key derivation function is used as the symmetric key, and the symmetric key is the above-mentioned communication key. In this way, the intermediate proxy service and the target service both obtain the communication key.

[0066] Furthermore, the intermediate proxy service can use the communication key to encrypt the target access request according to the national secret algorithm used in this interaction, and send the encrypted target access request to the target service. In this way, data protection during communication is achieved. Accordingly, the target service can use the communication key to decrypt the received encrypted target access request to obtain a plaintext target access request. Execute the operation indicated by the plaintext target access request and generate response data. Then, according to the national secret algorithm used in this interaction, use the communication key to encrypt the response data, and return the encrypted response data to the intermediate proxy service. Accordingly, the intermediate proxy service sends the response data returned by the target service to the accessing party, which may include: the intermediate proxy service uses the communication key to decrypt the received encrypted response data, obtains the plaintext response data and returns it to the accessing party.

[0067] The target access request includes the domain name of the accessing party. After receiving the target access request, the intermediate proxy service will record the domain name of the accessing party that sent the target access request. When returning the response data, a connection is established with the accessing party based on the recorded domain name of the accessing party, and then the plain text response data is returned to the accessing party. Exemplarily, the intermediate proxy service and the accessing party can interact via https.

[0068] In an embodiment of the present invention, by pre-configuring the storage path of the national secret encryption information and the national secret protocol information in the first configuration file, the intermediate proxy service can send the target access request to the target service in the form of national secret communication based on the storage path of the national secret encryption information and the national secret protocol information, thereby ensuring smooth national secret communication between the intermediate proxy service and the target service.

[0069] Optionally, the above-mentioned national secret communication related information also includes: a storage path of the national secret signature information corresponding to the domain name of the intermediate proxy service; the first configuration file is also configured by the following steps performed in advance: Step S71: Set the signature information item in the first configuration file as the storage path of the national secret signature information.

[0070] Accordingly, the embodiment of the present invention may further include: Step S81: Load the national secret signature information based on the storage path of the national secret signature information.

[0071] Step S82: Generate a signature value for the target access request based on the national secret signature information, so that the target service can perform signature verification.

[0072] Among them, step S71 can be executed by the control service. The signature information item is a configuration item for setting the storage path of the national secret signature information. The storage path of the national secret signature information can be set to the signature information item. In this way, by setting the storage path, the specific value of the signature information item can be prevented from being too long. The national secret signature information can be the information required for signature verification. Specifically, the national secret signature information can include a signature public key and a signature private key. Among them, the signature public key is stored in the national secret signature certificate, and the storage of the signature public key can be achieved by storing the national secret signature certificate. The signature private key can also be called the national secret signature certificate key. In the embodiment of the present invention, the national secret algorithm information and the national secret protocol information can be input by the user to the control service, and the national secret signature information and the national secret encryption information are generated by calling the certificate issuance service provided by the certificate issuance authority. The certificate issuance service can be implemented in the form of a website, and the certificate issuance service can be used to generate the corresponding national secret signature information and national secret encryption information for the domain name of the intermediate proxy service. Among them, the national secret signature information corresponding to each domain name of the intermediate proxy service can be the same, and the national secret encryption information corresponding to each domain name of the intermediate proxy service can also be different, and the embodiment of the present invention does not limit this. After obtaining the national secret signature information and the national secret encryption information, the control service can store the national secret signature information and the national secret encryption information locally, and generate storage paths for the national secret signature information and the national secret encryption information respectively.

[0073] Exemplarily, the signature information item may include a national secret signature certificate item and a national secret signature certificate key item, and the encryption information item may include a national secret encryption certificate item and a national secret encryption certificate key item. The national secret signature certificate item, the national secret signature certificate key item, the national secret encryption certificate item and the national secret encryption certificate key item may be respectively represented as: ssl_sign_certificate, ssl_sign_certificate_key, ssl_enc_certificate, ssl_enc_certificate_key.

[0074] Assume that the storage paths of the national secret signature certificate, national secret signature certificate key, national secret encryption certificate, and national secret encryption certificate key are: / etc / gmproxy / certs / tls.crt; / etc / gmproxy / certs / tls.key; / etc / gmproxy / certs2 / tls.crt; / etc / gmproxy / certs2 / tls.key; Then the four configuration items of national secret signature certificate item, national secret signature certificate key item, national secret encryption certificate item and national secret encryption certificate key item can be set to the above storage paths respectively. Further, the protocol information item can be represented as ssl_protocols, and the protocol information item can be configured as NTLS.

[0075] In an embodiment of the present invention, the intermediate proxy service can specifically send the target access request to the target service in the form of national secret communication based on the national secret communication related information and target address information pre-configured in the first configuration file when the national secret switch is turned on. Correspondingly, the first configuration file may also include a national secret switch item. In an embodiment of the present invention, the value of the national secret switch item may also be set to a value representing the turn-on. Exemplarily, the national secret switch item may be represented as: enable_ntls, and the value of the national secret switch item may be set to a value representing the turn-on: on. In this way, the national secret switch of the intermediate proxy service may be turned on, and the intermediate proxy service may be controlled to process the target access request. Furthermore, the first configuration file may also include a service domain name item for configuring the domain name of the intermediate proxy service and a port item for configuring the listening port. The service domain name item and the port item may be represented as server_name and listen, respectively. Taking the kubernetes service with the namespace of k8s as "default" as an example, the service domain name item may be configured as: gmproxy.default.svc.cluster.local, and the port item may be configured as "443 ssl http2". Among them, "443 ssl http2" indicates the port used by the access party by default.

[0076] Specifically, the intermediate proxy service can synchronize the national secret signature certificate with the target service during the handshake process so that the target service can obtain the signature public key in the national secret signature certificate. After the intermediate proxy service encrypts the target access request based on the communication key, it generates a signature value for the encrypted target access request based on the signature private key in the national secret signature information, and sends the signature value to the target service. For example, the encrypted target access request is first hashed to obtain a hash value, and then the hash value is encrypted using the signature private key to obtain a signature value.

[0077] Correspondingly, the target service first uses the signature public key to perform signature verification on the signature value. If the verification is passed, the operation of decrypting the received encrypted target access request using the communication key is performed. Exemplarily, when the signature value is used to perform signature verification, the encrypted target access request can be hashed to obtain a verification hash value. Then, the signature value is decrypted using the signature public key to obtain a decrypted hash value. If the verification hash value is the same as the decrypted hash value, it is determined that the signature value has passed the signature verification. Otherwise, it is determined that the signature value has not passed the signature verification.

[0078] In an embodiment of the present invention, by pre-configuring the storage path of the national secret signature information in the first configuration file, the intermediate proxy service can obtain the national secret signature information based on the storage path of the national secret signature information, and perform signature verification between the national secret signature information and the target service, thereby further improving the security of national secret communications.

[0079] Reference Figure 2 , shows a block diagram of an access request processing device provided by an embodiment of the present invention, which can be applied to any intermediate proxy service in a container platform, and the intermediate proxy service is associated with at least one national secret communication service in the container platform, such as Figure 2 As shown, the access request processing device may specifically include: The receiving module 201 is used to receive a target access request sent by the accessing party; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the accessing party is pre-synchronized as the domain name of the intermediate proxy service; The first processing module 202 is used to send the target access request to the target service in a national secret communication manner based on the national secret communication related information and target address information pre-configured in the first configuration file; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service; The return module 203 is used to send the response data returned by the target service to the accessing party.

[0080] Optionally, in the case where the intermediate proxy service is associated with a plurality of the national secret communication services, the first configuration file is pre-configured with service identifiers and address information of each of the national secret communication services associated with the intermediate proxy service; the device further comprises: An extraction module, used for extracting the service identifier of the target service carried in the target access request as a target identifier; The acquisition module is used to acquire, from the first configuration file, address information corresponding to the service identifier and consistent with the target identifier as the target address information.

[0081] Optionally, in the case where the intermediate proxy service is associated with one of the national secret communication services, the first configuration file is pre-configured with address information of the national secret communication service associated with the intermediate proxy service; the device further includes: A reading module is used to directly read the address information in the first configuration file as the target address information.

[0082] Optionally, the intermediate proxy service is pre-associated with the at least one national secret communication service through the following modules in the control service: A first determination module is used to determine the service in the container platform that requires access via national secret communication as the national secret communication service; A second determination module is used to determine a national secret communication service to be associated for the intermediate proxy service; A first setting module, configured to set, in a proxy information configuration item of the first configuration file, address information of the national secret communication service to be associated when the number of the national secret communication service to be associated is 1; The second setting module is used to set the service identifier and address information of each national secret communication service to be associated in the proxy information configuration item when the number of the national secret communication services to be associated is greater than 1.

[0083] Optionally, the first determining module is specifically configured to: Determine the application service with the specified identification field set in the container platform as the national secret communication service; And / or, determining an application service of a specified type of service in the container platform as the national secret communication service.

[0084] Optionally, the domain name of the intermediate proxy service is pre-synchronized through the following modules: A second processing module is used to determine the service that does not support national secret communication in the container platform as the access party, and obtain the domain name of the intermediate proxy service; The modification module is used to modify the domain name of each of the national secret communication services associated with the intermediate proxy service stored in the second configuration file to the domain name of the intermediate proxy service for any of the access parties; the second configuration file is the configuration file of the access party.

[0085] Optionally, the information related to national secret communication includes: a storage path of national secret encryption information corresponding to the domain name of the intermediate proxy service and national secret protocol information; the first configuration file is pre-configured by the following modules: a third setting module, used to set the values ​​of the encryption information item and the protocol information item in the first configuration file to the storage path of the national secret encryption information and the national secret protocol information respectively; The first processing module 202 is specifically configured to: Loading the national secret encrypted information based on the storage path of the national secret encrypted information; Based on the national secret protocol information and the target address information, establish a connection with the target service, and negotiate a communication key with the target service based on the national secret encryption information; The target access request is encrypted based on the communication key, and the encrypted target access request is sent to the target service.

[0086] Optionally, the information related to national secret communication further includes: a storage path of national secret signature information corresponding to the domain name of the intermediate proxy service; the first configuration file is also pre-configured by the following modules: a fourth setting module, used to set the signature information item in the first configuration file to the storage path of the national secret signature information; The device also includes: A loading module, used to load the national secret signature information based on the storage path of the national secret signature information; A generation module is used to generate a signature value for the target access request based on the national secret signature information, so that the target service can perform signature verification.

[0087] In summary, in the access request processing device provided by the embodiment of the present invention, the intermediate proxy service receives the target access request sent by the accessing party; the target access request is used to access the target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the accessing party is pre-synchronized as the domain name of the intermediate proxy service. Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service. The response data returned by the target service is sent to the accessing party. In this way, by pre-associating the national secret communication service with the intermediate proxy service in the container platform, the domain name of the national secret communication service associated with the intermediate proxy service recorded by the accessing party in advance is synchronized as the domain name of the intermediate proxy service. When the accessing party requests to access the target service associated with the intermediate proxy service, the target access request is received by the intermediate proxy service, and the intermediate proxy service interacts with the target service in the form of national secret communication on behalf of the accessing party based on the target access request, thereby ensuring that the national secret communication method is used when interacting with the target service, that is, ensuring that the target service is accessed in the form of national secret communication, thereby ensuring the access security of the national secret communication service.

[0088] Reference Figure 3 Schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, the electronic device includes: a processor, a memory, a communication interface and a communication bus.

[0089] The processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store executable instructions, and the executable instructions enable the processor to execute the access request processing method of the aforementioned embodiment. The executable instructions can constitute a program. The embodiment of the present invention also provides one or more machine-readable media, on which instructions are stored, and when executed by one or more processors, the processor can execute the access request processing method of the aforementioned embodiment.

[0090] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0091] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0092] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0093] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a predictable manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0095] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0096] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0097] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0098] Moreover, the terms "include", "comprises" or any other variation thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of more restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or terminal device that includes the element.

[0099] The access request processing method, access request processing device, electronic device and one or more machine-readable media provided by the present invention are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for processing an access request, characterized in that: Applied to any intermediate proxy service in a container platform, the intermediate proxy service is associated with at least one national secret communication service in the container platform, the method comprising: Receive a target access request sent by a visitor; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the visitor is pre-synchronized as the domain name of the intermediate proxy service; Based on the national secret communication related information and target address information pre-configured in the first configuration file, the target access request is sent to the target service in the form of national secret communication; the first configuration file is the configuration file of the intermediate proxy service, and the target address information is the address information of the target service; The response data returned by the target service is sent to the accessing party.

2. The method according to claim 1, characterized in that In the case where the intermediate proxy service is associated with a plurality of the national secret communication services, the first configuration file is pre-configured with service identifiers and address information of each of the national secret communication services associated with the intermediate proxy service; the method further includes: Extracting the service identifier of the target service carried in the target access request as the target identifier; Acquire address information corresponding to the service identifier and consistent with the target identifier from the first configuration file as the target address information.

3. The method according to claim 1, characterized in that In the case where the intermediate proxy service is associated with one of the national secret communication services, the first configuration file is pre-configured with address information of the national secret communication service associated with the intermediate proxy service; The method further comprises: The address information in the first configuration file is directly read as the target address information.

4. The method according to any one of claims 1 to 3, characterized in that: The intermediate proxy service is associated with the at least one national secret communication service through the following steps pre-performed by the control service: Determine the service in the container platform that requires access via national secret communication as the national secret communication service; Determining a national secret communication service to be associated for the intermediate proxy service; When the number of the national secret communication service to be associated is 1, in the proxy information configuration item of the first configuration file, the address information of the national secret communication service to be associated is set; When the number of the national secret communication services to be associated is greater than 1, the service identifier and address information of each of the national secret communication services to be associated are set in the proxy information configuration item.

5. The method according to claim 4, characterized in that The determining the service in the container platform that requires access via national secret communication as the national secret communication service includes: Determine the application service with the specified identification field set in the container platform as the national secret communication service; And / or, determining an application service of a specified type of service in the container platform as the national secret communication service.

6. The method according to any one of claims 1 to 3, characterized in that: The domain name of the intermediate proxy service is pre-synchronized through the following steps: Determine the service that does not support national secret communication in the container platform as the access party, and obtain the domain name of the intermediate proxy service; For any of the access parties, the domain names of the national secret communication services associated with the intermediate proxy service stored in the second configuration file are modified to the domain name of the intermediate proxy service; the second configuration file is the configuration file of the access party.

7. The method according to claim 1, characterized in that The information related to national secret communication includes: the storage path of the national secret encryption information corresponding to the domain name of the intermediate proxy service and the national secret protocol information; the first configuration file is configured by pre-performing the following steps: setting the values ​​of the encryption information item and the protocol information item in the first configuration file to the storage path of the national secret encryption information and the national secret protocol information respectively; The sending of the target access request to the target service in a manner of national secret communication based on the national secret communication related information and the target address information pre-configured in the first configuration file includes: Loading the national secret encrypted information based on the storage path of the national secret encrypted information; Based on the national secret protocol information and the target address information, establish a connection with the target service, and negotiate a communication key with the target service based on the national secret encryption information; The target access request is encrypted based on the communication key, and the encrypted target access request is sent to the target service.

8. The method according to claim 7, characterized in that The information related to national secret communication also includes: a storage path of national secret signature information corresponding to the domain name of the intermediate proxy service; the first configuration file is also configured by the following steps performed in advance: setting the signature information item in the first configuration file to the storage path of the national secret signature information; After encrypting the target access request based on the communication key, the method further includes: Load the national secret signature information based on the storage path of the national secret signature information; A signature value is generated for the target access request based on the national secret signature information, so that the target service can perform signature verification.

9. An access request processing device, characterized in that: Applied to any intermediate proxy service in a container platform, the intermediate proxy service is associated with at least one national secret communication service in the container platform, the device comprising: A receiving module, configured to receive a target access request sent by a visitor; the target access request is used to access a target service, the target service is the national secret communication service associated with the intermediate proxy service, and the domain name of the national secret communication service recorded by the visitor is pre-synchronized as the domain name of the intermediate proxy service; A first processing module is configured to send the target access request to the target service in a national secret communication manner based on the national secret communication related information and target address information pre-configured in a first configuration file; the first configuration file is a configuration file of the intermediate proxy service, and the target address information is address information of the target service; The return module is used to send the response data returned by the target service to the accessing party.

10. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store executable instructions, and the executable instructions enable the processor to execute the method according to any one of claims 1 to 8.

11. One or more machine-readable media, characterized in that Instructions are stored thereon, which, when executed by one or more processors, cause the processors to perform the method as claimed in any one of claims 1 to 8.

Images