Enterprise intranet access method and system based on containerized Web operation interface

Abstract

The invention belongs to the technical field of network security and network connection access, and provides an enterprise intranet access method and system based on a containerized Web operation interface, and the method comprises the following steps: obtaining an access request of an external client; the method comprises the following steps: establishing HTTPS communication connection with an external client by using an enterprise gateway, sending a multi-factor authentication requirement to the external client, carrying out user identity authentication, and if the authentication is passed, pulling up a container instance by using the enterprise gateway, and providing browser-based container built-in software with an operation graphic environment for the external client; the enterprise gateway dynamically evaluates the access connection initiated by the container to the enterprise intranet; and obtaining a request of actively ending the authentication of the external client, and destroying the container instance by the enterprise gateway to end the access. According to the invention, the weakening of the end-to-end encryption integrity of the HTTPS by the existing WebVPN system based on the intermediate agent is solved, and the security of intranet access can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security and network connection access technology, and in particular to an enterprise intranet access method and system based on a containerized Web operation interface. Background Art

[0002] At present, most enterprises connect their internal computers, servers and other network devices to form an intranet. Enterprise users can access other network devices in the intranet through the internal network devices. The intranet is generally not directly accessible from the external network. Deploying a VPN is a common way to achieve remote access to the intranet.

[0003] When users use VPN to remotely access the enterprise intranet, you first need to set up a VPN gateway on the boundary between the enterprise intranet and the extranet. When device A is in the extranet, it first establishes a tunnel connection with the VPN gateway through the public network. When it needs to send an access request to device B in the enterprise intranet, device A can encapsulate the access request into a VPN data packet and modify the destination address of the VPN data packet to the address of device B in the enterprise intranet. Then, device A can send the VPN data packet to the VPN gateway through the tunnel connection. Device B can receive the VPN data packet through the VPN gateway, unpack it, and restore and process the corresponding access request.

[0004] WebVPN is an improvement on the traditional VPN method. When using WebVPN to enable users to remotely access the corporate intranet, you first need to set up a WebVPN gateway on the boundary between the corporate intranet and the extranet. When device A is in the extranet, first use a browser to establish an HTTPS connection with the WebVPN gateway through the public network. When you need to access website B in the corporate intranet, website B establishes an HTTPS connection with the WebVPN gateway. As the middleman of the connection, the WebVPN gateway receives the data request from device A for website B, decrypts it, and sends it to website B through the HTTPS connection with website B. The entire process is transparent to the user.

[0005] In the process of implementing the present invention, the author found that the prior art has at least the following problems: On the one hand, VPN gateway configuration is complex, and deployment requires changes to the intranet architecture, which costs a lot of time and money. In addition, data transmission between gateways is based on the public network, which is easily affected by the network quality of the public network and cannot maintain high transmission speed and stability for a long time. Therefore, the efficiency of accessing the enterprise intranet is relatively low and the cost is relatively high.

[0006] On the other hand, WebVPN streamlines the complex architecture of traditional VPNs, improving the stability and usability of the entire architecture. However, its technical route based on intermediate proxies weakens the integrity of HTTPS end-to-end encryption, making content originally protected by HTTPS end-to-end encryption visible to intermediate proxies. Summary of the invention

[0007] In order to solve the problems of existing intranet access technology, the present invention provides an enterprise intranet access system and method based on a containerized Web operation interface, which takes into account the working conditions in actual VPN application scenarios, solves the problems of overly complex traditional VPN architecture and weakening of end-to-end encryption caused by WebVPN, and improves the stability and ease of use of enterprise intranet access.

[0008] The technical solution of the present invention is as follows: A method for accessing an enterprise intranet based on a containerized Web operation interface includes the following steps: Obtain an access request from an external client, where the access request is initiated by the external client by entering the enterprise access URL in a browser; use the enterprise gateway to establish an HTTPS communication connection with the external client, and send a multi-factor authentication request to the external client for user identity authentication. The user of the external client enters a username and password, and uses MFA or enterprise IM software to scan a code for authentication; If the user identity authentication is passed, the enterprise gateway is used to pull up the container instance, and the browser-based container built-in software with an operating graphical environment is provided to the external client, so that the external client user can access the enterprise intranet resources through the container built-in software; During the access process, the enterprise gateway dynamically evaluates the access connection initiated by the container to the enterprise intranet to ensure its security; After receiving a request from an external client to actively end authentication, the enterprise gateway destroys the container instance to end access.

[0009] Preferably, before using the enterprise gateway to establish an HTTPS communication connection with an external client, the method further includes: Receive an SSL / TLS request from an external client, extract the browser fingerprint, device feature code, and IP address currently used by the external client to log in, and return the OTP seed to the external client; receive a one-time key generated by the external client, and determine the legitimacy of the access based on the one-time key; the one-time key is generated by the external client using an algorithm combined with the current time after receiving the OTP seed.

[0010] Preferably, the method also includes: determining the form of user authentication based on the extracted browser fingerprint, device feature code, and IP address currently used by the external client to log in, and the form of user authentication includes any one or a combination of the following: password, MFA authentication, and enterprise IM code scanning authentication.

[0011] Preferably, before using the enterprise gateway to pull up the container instance, it also includes: storing a Linux container image file containing a graphical interface environment in the enterprise gateway.

[0012] Preferably, the method also includes: a Linux container image file containing a graphical interface environment stored in a container template library of an enterprise gateway is pre-configured and packaged according to enterprise needs; and contains a minimum Linux system environment, a Web remote desktop agent, a Web server, a Web browser, and software customized according to enterprise business needs required to run enterprise intranet access.

[0013] Preferably, when the container instance is pulled up: the graphical interface of the container instance is connected through a Web remote desktop agent, the graphical interface is forwarded to a Web server, and the Web server displays it to users of external clients; the Web server includes a function of mapping the graphical interface to an interactive HTML5 player; a virtual hard disk mount point is synchronously created, the virtual hard disk mount point is mapped to the storage of the enterprise gateway itself, and a file upload function is provided on the Web server interface.

[0014] Preferably, after launching the container instance, the user uses a browser to operate a graphical Linux interface provided by the container instance to open software, access an intranet, upload files, modify files, and other operations on the Linux operating system in the container instance.

[0015] Preferably, the dynamic evaluation includes: if the data request feature of the access connection matches any feature information in a preset blacklist feature library, then it is judged that the access connection meets the preset blacklist condition, and that the access connection does not meet the preset permission; otherwise, it is judged that the access connection does not meet the preset blacklist condition, and that the access connection meets the preset permission.

[0016] The present invention also provides an enterprise intranet access system based on a containerized Web operation interface, the system is used to execute the enterprise intranet access method of the containerized Web operation interface as described above, including: The authentication and authorization module is used to identify the identity of the external client and determine the required authentication method after judging the security; Situation awareness module, which is used to continuously collect user behaviors, load user behavior feature models, and dynamically evaluate user behaviors during user access to ensure their security; The graphical user interaction module is used to connect to the graphical interface of the container instance through the Web remote desktop agent, forward the graphical interface to the Web server, and display it to the user of the external client by the Web server.

[0017] Compared with the prior art, the advantages of the present invention are: (1) The overall system architecture is simple and clear, and the deployment difficulty is relatively low.

[0018] (2) While simplifying the intranet access mode, the security of the access process is improved.

[0019] (3) Addressed the issue where the WebVPN system weakens the integrity of HTTPS end-to-end encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flow chart of a method for accessing an enterprise intranet provided by an embodiment of the present invention; Figure 2 A schematic diagram of the structure of an enterprise remote access gateway server provided by an embodiment of the present invention; Figure 3 A schematic diagram of a network topology structure of an enterprise network provided by an embodiment of the present invention; Figure 4 A schematic diagram of a network topology structure for accessing an enterprise intranet provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0024] The embodiment of the present invention solves the problem that the WebVPN system weakens the integrity of HTTPS end-to-end encryption. Specifically, in the process of realizing its functions, the technical architecture of the WebVPN system implements the proxy of HTTPS traffic through the following steps, while introducing the weakening of the integrity of the end-to-end encryption of HTTPS: Establishing a proxy connection When the user terminal initiates an access request to the target HTTPS site, the proxy server module of the WebVPN system first uses the proxy domain name to establish an HTTPS (SSL / TLS) connection with the user. Subsequently, the proxy server, as an intermediate node, initiates an independent HTTPS connection request to the target server, forming a segmented encrypted link (user-proxy server, proxy server-target server).

[0025] Traffic decryption and link replacement After receiving the encrypted traffic from either side, the proxy server decrypts the TLS traffic using the preset private key and temporarily stores the data in plain text in the memory buffer. The content processing module rewrites the decrypted page elements (for example, modifying hyperlinks) and repackages the data packets to adapt to the computer network specifications that need to be followed when changing the internal / external network.

[0026] Dynamic certificate generation and identity masquerade The certificate management module dynamically generates an X.509 certificate that matches the proxy domain name during the proxy process. The certificate is issued by the WebVPN system based on its own root certificate and replaces the original certificate of the target server. The user's browser only verifies the validity of the proxy server's certificate chain, but cannot directly verify the true identity of the target server, resulting in a partial bypass of the HTTPS authentication mechanism.

[0027] Through the above steps, although the WebVPN system has achieved secure access control of internal enterprise resources, its technical characteristics have led to the following inherent contradictions: the end-to-end encryption of the original HTTPS communication is divided into two non-continuous encrypted channels, the complete encrypted link between the user and the target server is interrupted by the proxy node, and the proxy has the ability to view the plaintext content of the communication. Although the WebVPN system meets the proxy requirements, it actually weakens the end-to-end encryption capability guaranteed by the HTTPS protocol.

[0028] The embodiment of the present invention provides an enterprise intranet access method based on a containerized Web operation interface, which can be implemented by an enterprise remote access gateway server (hereinafter referred to as the enterprise gateway) and an external client. The enterprise gateway includes an authentication and authorization module, a situation awareness module, and a graphical user interaction module. Among them, the external client is a personal computer device. The external client can access various office automation systems in the enterprise intranet through the enterprise gateway; the enterprise gateway is a special device deployed on the boundary of the enterprise's internal and external networks, which is used to establish a communication connection with the external client and provide a containerized Linux graphical environment to the user of the external client; the application scenario of this embodiment can be: after the external client enters the authentication interface, the enterprise gateway and the external client perform an SSL / TLS handshake, and establish an HTTPS connection after using the OTP key to determine the legitimacy of the access, and then the authentication and authorization module determines the login authentication form according to the device characteristics of the current external client. After the authentication is passed, the enterprise gateway pulls up the container instance, and the container instance loads the graphical Linux environment. The user of the external client operates the graphical environment in the browser of the external client and accesses the enterprise intranet resources through the built-in software of the container.

[0029] The following will be combined with specific implementation methods. Figure 1 The processing flow of enterprise intranet access based on the containerized Web operation interface is described in detail, and the content can be as follows: Step S1: The external client uses a browser to input the enterprise access website and enter the authentication interface.

[0030] During implementation, the user enters the enterprise access URL on the browser of the external client, the browser opens the URL and displays the authentication interface, the user can choose which login authentication method to use on the authentication interface, or the enterprise gateway may determine that the user must use a certain authentication method.

[0031] Step S2: the enterprise remote access gateway server establishes an HTTPS communication connection with the external client.

[0032] In implementation, before the enterprise gateway establishes an HTTPS communication connection with the browser of the external client, a TCP connection must be established, and then an SSL / TLS handshake is performed on the connection. Specifically, the external client sends a SYN packet to the enterprise gateway, and the enterprise gateway receives the SYN packet sent by the external client. The enterprise gateway extracts the browser fingerprint, device feature code, and IP address currently used by the external client to log in, and returns the OTP seed to the external client. After the external client receives the OTP seed, it uses an algorithm combined with the current time to generate a one-time key, which is returned to the authentication and authorization module. The authentication and authorization module determines the legitimacy of the access based on the key calculated by its own algorithm and the client key. If it is legitimate, proceed to the next step.

[0033] After confirming the legitimacy of the external client, the enterprise gateway returns a SYN+ACK packet to the external client. After the external client receives the SYN+ACK packet returned by the enterprise gateway, it returns an ACK packet to the enterprise gateway. After the enterprise gateway receives the ACK packet returned by the external client, the external client establishes a TCP communication connection with the enterprise gateway.

[0034] After the external client establishes a communication connection with the enterprise gateway, the target client performs an SSL handshake with the target CDN node. First, the external client sends a Client Hello message to the enterprise gateway. After the enterprise gateway receives the Client Hello message from the external client, the external client and the enterprise gateway complete the SSL handshake. The Client Hello message is transmitted in plain text. The message content includes: the certificate identifier of the SSL certificate of the enterprise gateway corresponding to the client SSL certificate, the highest SSL protocol version supported by the external client, the random number A, the extension field, the encryption suite candidate list, and the compression algorithm candidate list. In the encryption suite candidate list, each encryption suite corresponds to a combination of four functions in the SSL protocol: authentication algorithm (authentication), key exchange algorithm (key negotiation), symmetric encryption algorithm (information encryption), and information digest (integrity check); the compression algorithm list is used for information compression transmission in the subsequent transmission process; the random number A is used for the generation of keys in the subsequent transmission process; the extension field supports the relevant parameters of the protocol and algorithm and other auxiliary information, etc. Common extension fields include SNI, etc.

[0035] Step S3: The enterprise gateway sends a multi-factor authentication request to the external client. The user of the external client enters the username and password and uses MFA or enterprise IM software to scan the code for authentication.

[0036] During implementation, the authentication and authorization module compares the browser fingerprint, device feature code, and IP address currently used by the external client with the database, and determines one or more login verification forms from password, MFA, and corporate IM code scanning.

[0037] If the browser fingerprint and device signature code of the current external client exist in the database, and the IP address belongs to the same prefecture-level administrative region as the last login IP address, the current external client requires a user name and password for user authentication.

[0038] If the browser fingerprint and device feature code of the current external client exist in the database, and the IP address does not belong to the same prefecture-level administrative region as the last login IP address, the current external client needs to use the SMS verification code for MFA authentication after passing the username and password authentication.

[0039] If the browser fingerprint and device feature code of the current external client exist in the database, but it has not been logged in for a long time, the current external client needs to use the enterprise IM software to scan the code for authentication after passing the username and password authentication.

[0040] If the browser fingerprint and device feature code of the current external client do not exist in the database, the current external client needs to use the enterprise IM software to scan the code for authentication after passing the username and password authentication. After scanning the code, the enterprise IM software pops up a face recognition window, and the authentication is completed after face recognition.

[0041] The enterprise gateway sends a multi-factor authentication request to the external client for user identity authentication. The user of the external client enters the username and password, combined with MFA or enterprise IM software scanning code authentication.

[0042] Step S4: If the authentication is successful, the enterprise gateway pulls up a container instance loaded with a graphical Linux environment. The user of the external client operates the graphical environment in the browser and accesses the intranet resources through the built-in software of the container.

[0043] Specifically, the image required for container instance deployment is customized by the enterprise administrator according to the enterprise's own needs, using a seed file to describe the required operating system version, operating environment, application, etc. After the description is completed, the registry is pulled according to the seed file and packaged for upload. Users use the browser to operate the graphical Linux interface provided by the container instance to open software, access the intranet, upload files, modify files, etc. on the Linux operating system in the container instance.

[0044] Step S5: During the access process, the enterprise gateway dynamically evaluates the access connection initiated by the container to the enterprise intranet to ensure its security.

[0045] Step S6: After the access is completed, the user actively ends the authentication, and the enterprise gateway destroys the container instance.

[0046] The above descriptions are only some specific implementation methods of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person familiar with the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for accessing an enterprise intranet based on a containerized Web operation interface, characterized in that: The following steps are involved: Obtaining an access request from an external client, wherein the access request is initiated by the external client by inputting an enterprise access website in a browser; Use the enterprise gateway to establish an HTTPS communication connection with the external client, and send a multi-factor authentication request to the external client for user identity authentication. If the user identity authentication passes, use the enterprise gateway to pull up the container instance and provide the external client with a browser-based container built-in software with an operating graphical environment, so that the external client user can access the enterprise intranet resources through the container built-in software; During the access process, the enterprise gateway dynamically evaluates the access connection initiated by the container to the enterprise intranet to ensure its security; After receiving a request from an external client to actively end authentication, the enterprise gateway destroys the container instance to end access.

2. The access method according to claim 1, characterized in that: Before using the enterprise gateway to establish an HTTPS communication connection with an external client, you must also: Receive SSL / TLS requests from external clients, extract the browser fingerprint, device feature code, and IP address currently used by the external client to log in, and return the OTP seed to the external client; Receive a one-time key generated by an external client, and determine the legitimacy of access based on the one-time key; the one-time key is generated by the external client after receiving the OTP seed using an algorithm combined with the current time.

3. The access method according to claim 2, characterized in that: The method further comprises: The form of user authentication is determined based on the extracted browser fingerprint, device feature code, and IP address used by the external client for current login. The form of user authentication includes any one or a combination of the following: password, MFA authentication, and enterprise IM code scanning authentication.

4. The access method according to claim 1, characterized in that: Before you use the enterprise gateway to launch a container instance, you also need to: A Linux container image file including a graphical interface environment is stored in the enterprise gateway.

5. The access method according to claim 4, characterized in that: The method further comprises: The Linux container image files containing the graphical interface environment stored in the container template library of the enterprise gateway are pre-configured and packaged according to enterprise needs; they include the minimum Linux system environment, Web remote desktop agent, Web server, Web browser required to run enterprise intranet access, and software customized according to enterprise business needs.

6. The access method according to claim 1, characterized in that: When launching the container instance: Connecting to the graphical interface of the container instance through a Web remote desktop agent, forwarding the graphical interface to a Web server, and displaying it to users of external clients by the Web server; the Web server includes a function of mapping the graphical interface to an interactive HTML5 player; Create a virtual hard disk mount point simultaneously, map the virtual hard disk mount point to the enterprise gateway's own storage, and provide file upload function on the Web server interface.

7. The access method according to claim 1, characterized in that: After launching the container instance: Users use a browser to operate the graphical Linux interface provided by the container instance to operate the Linux operating system in the container instance.

8. The access method according to claim 1, characterized in that: The dynamic evaluation comprises: If the data request feature of the access connection matches any feature information in the preset blacklist feature library, the access connection is judged to meet the preset blacklist conditions and the access connection is judged to not meet the preset permissions; otherwise, the access connection is judged to not meet the preset blacklist conditions and the access connection is judged to meet the preset permissions.

9. An enterprise intranet access system based on a containerized Web operation interface, characterized in that: The system is used to execute the enterprise intranet access method of the containerized Web operation interface according to any one of claims 1 to 8, comprising: The authentication and authorization module is used to identify the identity of the external client and determine the required authentication method after judging the security; Situation awareness module, which is used to continuously collect user behavior, load user behavior feature models, and dynamically evaluate user behavior during user access to ensure its security; The graphical user interaction module is used to connect to the graphical interface of the container instance through a Web remote desktop agent, forward the graphical interface to the Web server, and display it to users of external clients by the Web server.

Images