Method, device and equipment for public cloud to access Web service of intranet equipment

Abstract

The invention discloses a method, device and equipment for a public cloud to access the Web service of intranet equipment, applied to a cloud service platform, and the method comprises the following steps: receiving an HTTP request of public network user equipment to access the intranet equipment, and analyzing the HTTP request to determine SSH session information carrying SSH session connection established between the cloud service platform and the intranet equipment; according to the SSH session information, a Socket endpoint corresponding to the SSH session connection is determined, and the Socket endpoint comprises a virtual network card and a port number; and according to the Socket endpoint, the HTTP request is transmitted to the intranet equipment through the SSH session connection. Therefore, the problems that an existing port mapping method is high in security risk, inflexible in management and control and limited in number of external ports are solved.

Description

Background Art

[0002] When the cloud network management platform accesses the self-owned and third-party network devices in the LAN isolated by NAT (Network Address Translation), it faces the problem of limited access caused by the NAT mechanism. The solutions in the related technology include fixed port mapping rules and preset HTTP routing rules.

[0003] The fixed port mapping rule is that in most cloud service platforms that can send configurations to devices, tunnel technology is usually used to map the web port of the device to be accessed to a fixed port on the cloud IP, thereby achieving remote access to the device.

[0004] HTTP routing rules refer to the pre-setting of the device's unique identification and HTTP routing rules after the device leaves the factory, and then the device and the platform maintain a long connection forwarding tunnel. In this way, when the user accesses the device through a browser, the cloud service platform can forward the request to the correct device based on the identification information in the HTTP request.

[0005] However, the above port mapping method has the problems of high security risks, inflexible management and control, and limited number of external ports. Summary of the invention

[0006] The purpose of this application is to provide a method, device and equipment for accessing the Web service of an intranet device from a public cloud, which is used to solve the problems of high security risks, inflexible management and control, and limited number of external ports in the existing port mapping method.

[0007] In a first aspect, an embodiment of the present application provides a method for a public cloud to access an intranet device Web service, which is applied to a cloud service platform, and the method includes:

[0008] Receiving an HTTP request from a public network user device to access an intranet device, parsing the HTTP request to determine SSH session information that carries an SSH session connection established between the cloud service platform and the intranet device;

[0009] Determine the logical IP address of the virtual network card according to the parsing result of the SSH session information;

[0010] The HTTP request is transmitted to the virtual network card via the logical IP address, and the virtual network card transmits the HTTP request to the intranet device via the SSH session connection corresponding to the logical IP address.

[0011] In some possible embodiments, the method further includes:

[0012] Parsing the HTTP request to determine that no SSH session information is carried;

[0013] If the cloud service platform has established an SSH session connection with the intranet device, obtain the corresponding SSH session information; otherwise, execute the SSH session connection establishment process with the intranet device and obtain the corresponding SSH session information;

[0014] The corresponding SSH session information is returned to the user equipment, so that the HTTP request subsequently initiated by the user equipment carries the SSH session information.

[0015] In some possible embodiments, when the HTTP request carries the SSH session information, it also carries the user device information;

[0016] The SSH session information includes at least one of the following: SSH session ID, Socket endpoint, and expiration time of the SSH session;

[0017] The user device information includes at least one of the following: a source IP address, and verification information for verifying the legitimacy of the browser.

[0018] In some possible embodiments, determining the logical IP address of the virtual network card according to the parsing result of the SSH session information includes:

[0019] Sending the parsed result of the SSH session information to the tunnel management module through the HTTP processing module, wherein the parsed result of the SSH session information includes at least one of an SSH session ID and a Socket endpoint;

[0020] The tunnel management module determines the logical IP address corresponding to the SSH session ID / Socket endpoint obtained by parsing according to the pre-established mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card, and returns it to the HTTP processing module

[0021] In some possible embodiments, the cloud service platform establishes an SSH session connection with the intranet device in the following manner:

[0022] Sending the HTTP request to the SSH tunnel management module through the HTTP processing module;

[0023] When notifying the SSH tunnel management module to determine that no SSH session connection is established with the intranet device, an SSH command is issued to the intranet device;

[0024] The Web service port returned by the user device is received through the tunnel management module, the Web port is forwarded to a port of one of the virtual network cards, the logical IP address of the virtual network card and the port mapping is determined, and an SSH session connection using the logical IP address is established.

[0025] In some possible embodiments, returning the corresponding SSH session information to the user equipment so that an HTTP request subsequently initiated by the user equipment carries the SSH session information includes:

[0026] Encrypt the corresponding SSH session information and user device information using AES256 and encode them into a string using Base64;

[0027] The character string is encrypted and returned to the user device, so that the user device initiates an HTTP request when accessing a wildcard domain name with the encrypted character string later.

[0028] In some possible embodiments, the SSH session information includes an expiration time of the SSH session, and further includes:

[0029] When it is determined that the expiration time of the SSH session has been reached, if there is data transmission in the corresponding SSH session connection, the SSH session connection is disconnected after the data transmission is completed, otherwise the SSH session connection is directly disconnected;

[0030] The source IP address in the character string is parsed to determine whether it is consistent with the source IP address in the pre-stored SSH session information, and if not, the HTTP request is rejected.

[0031] In a second aspect, an embodiment of the present application provides a method for a public cloud to access an intranet device Web service, which is applied to a user device, and the method includes:

[0032] According to the user's access operation to the intranet device displayed on the web page, if the corresponding SSH session information is obtained from the cloud service platform in advance, an HTTP request carrying the SSH session information is generated;

[0033] Sending the HTTP request to the cloud service platform;

[0034] The SSH session information is related information of the SSH session connection established between the cloud service platform and the intranet device.

[0035] In a third aspect, an embodiment of the present application provides a device for a public cloud to access an intranet device Web service, the device comprising:

[0036] An HTTP request receiving module is used to receive an HTTP request from a public network user device to access an intranet device, and parse the HTTP request to determine SSH session information that carries the SSH session information for establishing an SSH session connection between the cloud service platform and the intranet device;

[0037] A socket endpoint determination module, used to determine the logical IP address of the virtual network card according to the parsing result of the SSH session information;

[0038] The HTTP request transmission module is used to transmit the HTTP request to the virtual network card through the logical IP address, and the virtual network card transmits the HTTP request to the intranet device through the SSH session connection corresponding to the logical IP address.

[0039] In a fourth aspect, an embodiment of the present application provides a device for a public cloud to access an intranet device Web service, the device comprising:

[0040] An HTTP request generation module is used to generate an HTTP request carrying the SSH session information according to the user's access operation on the intranet device displayed on the web page, if the corresponding SSH session information is obtained from the cloud service platform in advance;

[0041] An HTTP request sending module, used to send the HTTP request to the cloud service platform;

[0042] The SSH session information is related information of the SSH session connection established between the cloud service platform and the intranet device.

[0043] In the fifth aspect, another embodiment of the present application also provides a device for a public cloud to access the Web service of an intranet device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for a public cloud to access the Web service of an intranet device provided in the first aspect above, or execute the method for a public cloud to access the Web service of an intranet device provided in the second aspect above.

[0044] In the sixth aspect, another embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute any method of a public cloud accessing an intranet device Web service provided in an embodiment of the present application.

[0045] The method, apparatus and equipment for accessing the Web service of an intranet device from a public cloud provided in the embodiments of the present application realize a dynamic, secure and controllable access mechanism for devices in a NAT-isolated local area network; there is no need to open different ports for the cloud platform or temporarily change the firewall policy, and only one port is needed to complete the access of different customers to different devices; there is no need to occupy extra external ports, and the virtual network card technology within the Linux system can be used to break through the maximum limit on the number of concurrent devices imposed by the theoretical maximum number of ports (65535 minus the system reserved ports).

[0046] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A flowchart of a method for a public cloud to access an intranet device Web service according to an embodiment of the present application;

[0049] Figure 2 This is an architecture diagram of a public cloud accessing an intranet device Web service according to an embodiment of the present application;

[0050] Figure 3 A detailed flow chart of a method for a public cloud to access an intranet device Web service according to an embodiment of the present application;

[0051] Figure 4 A detailed flow chart of a method for accessing an intranet device Web service from a public cloud according to an example of an embodiment of the present application;

[0052] Figure 5 A diagram of a device for a public cloud serving as a cloud service platform to access an intranet device Web service according to an embodiment of the present application;

[0053] Figure 6 A diagram of a device for accessing an intranet device Web service from a public cloud as a user device according to an embodiment of the present application;

[0054] Figure 7 This is a device structure diagram of a public cloud accessing an intranet device Web service according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method can be executed in the order of the method shown in the embodiment or drawings or in parallel during the actual processing process or when the control device is executed.

[0056] When the cloud network management platform accesses the self-owned and third-party network devices in the LAN isolated by NAT (Network Address Translation), it faces the problem of limited access caused by the NAT mechanism. The solutions in the related technology include fixed port mapping rules and preset HTTP routing rules.

[0057] For fixed port mapping rules, in most cloud platforms that can send configurations to devices, tunneling technology is usually used to map the web port of the device to be accessed to a fixed port on the cloud IP, thereby achieving remote access to the device. However, this method has the following disadvantages:

[0058] This method requires each device to temporarily occupy a fixed cloud port when establishing a mapping, which makes port security policy management difficult when there are a large number of devices. In addition, the security policy management authority of the cloud platform IaaS provider is usually not given to third-party service control as an API.

[0059] This method will occupy too many external port resources, and the theoretical maximum upper limit of available external ports for a single public IP is (65535-1024);

[0060] This method requires the cloud platform's firewall policy to develop the same number of ports for the minimum number of concurrent devices, which will increase the security risk of the network;

[0061] Due to the direct port mapping mechanism of this method, the HTTP request of the client browser directly accesses the port, and it is difficult for the cloud platform to effectively control the HTTP connection. Usually, a strategy of pre-setting the expiration time is adopted. Since the network information carried in the HTTP connection cannot be identified, it is impossible to formulate targeted security policies and flexible expiration policies based on this.

[0062] For the preset HTTP routing rules, this method means that the unique identification of the device and the HTTP routing rules are pre-set after the device leaves the factory, and then the device and the platform maintain a long connection forwarding tunnel, so that when the user accesses the device through the browser, the cloud platform can forward the request to the correct device according to the identification information in the HTTP request. However, this preset routing rule lacks flexibility and cannot adapt to the dynamic addition and change of devices (each time a device is added or changed, the HTTP routing rules need to be added or modified in the persistent file), and because the rules are static, once the device is illegally tampered with or counterfeited, the preset routing rules cannot provide an effective defense mechanism, which may cause security vulnerabilities.

[0063] In view of the problems of high security risk, inflexible management and control, and limited number of external ports in the port mapping method in the related art, the present application proposes a method, apparatus and device for a public cloud to access an intranet device Web service.

[0064] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

[0065] The following is a detailed description of the method, device and equipment for the public cloud to access the intranet device Web service in the embodiment of the present application in conjunction with the accompanying drawings.

[0066] like Figure 1 As shown, the embodiment of the present application provides a safe, flexible and concise method for a public cloud to access an intranet device Web service. By adopting a non-configured HTTP routing processor and a virtual network card technology, the problems of high security risks, inflexible management and control, and limited number of external ports in the traditional port mapping method are effectively solved. The embodiment of the present application provides a method for a public cloud to access an intranet device Web service, which is applied to a cloud service platform, and the method includes:

[0067] Step 101, receiving an HTTP request from a public network user device to access an intranet device, parsing the HTTP request to determine SSH session information for establishing an SSH session connection between the cloud service platform and the intranet device;

[0068] In the embodiment of the present application, the user device cannot access the intranet device under the cloud service platform due to NAT. In the embodiment of the present application, the cloud service platform establishes an SSH session connection with the intranet device. Establishing an SSH session connection is equivalent to establishing an SSH tunnel. Then the user device on the public network can communicate with the intranet device through the SSH tunnel. The cloud service platform sends the SSH session information of the SSH session connection to the public network user device. When the user device receives the SSH session information, it operates the intranet device through the Web page and sends an HTTP request to the cloud service platform carrying the SSH session information.

[0069] Step 102, determining the logical IP address of the virtual network card according to the parsing result of the SSH session information;

[0070] In the embodiment of the present application, different SSH session connections are established through a virtual network card. A cloud platform server may include multiple virtual network cards, and a virtual network card may be assigned multiple logical IP addresses, wherein one SSH session connection uses a logical IP address, and the assigned logical IP address is determined by the process of establishing the SSH session connection. The parsing result of the SSH session information includes relevant information of the SSH session connection used to map the logical IP address.

[0071] Step 103: Transmit the HTTP request to the virtual network card through the logical IP address, and the virtual network card transmits the HTTP request to the intranet device through the SSH session connection corresponding to the logical IP address.

[0072] The method, apparatus and equipment for accessing the Web service of an intranet device from a public cloud provided in the embodiments of the present application realize a dynamic, secure and controllable access mechanism for devices in a NAT-isolated local area network; there is no need to open different ports for the cloud platform or temporarily change the firewall policy, and only one port is needed to complete the access of different customers to different devices; there is no need to occupy extra external ports, and the virtual network card technology within the Linux system can be used to break through the maximum limit on the number of concurrent devices imposed by the theoretical maximum number of ports (65535 minus the system reserved ports).

[0073] In some possible embodiments, the method further includes:

[0074] Parsing the HTTP request to determine that no SSH session information is carried;

[0075] If the cloud service platform has established an SSH session connection with the intranet device, obtain the corresponding SSH session information; otherwise, execute the SSH session connection establishment process with the intranet device and obtain the corresponding SSH session information;

[0076] The corresponding SSH session information is returned to the user equipment, so that the HTTP request subsequently initiated by the user equipment carries the SSH session information.

[0077] If the user device has not initiated an HTTP request, it means that the user device has not initiated an HTTP request to the cloud service platform. When an HTTP request is received, if an SSH session connection has been established with the intranet device, the corresponding SSH session information will be sent to the user device. One possible situation is that when the intranet device is first accessed by a user device, the cloud service platform collaborates with the intranet device to establish an SSH session connection, and then when other user devices initiate HTTP requests for the first time, the corresponding SSH session information will be sent to other user devices.

[0078] In some possible embodiments, when the HTTP request carries SSH session information, it also carries user device information; the SSH session information includes at least one of the following: SSH session ID, Socket endpoint, expiration time of the SSH session; the user device information includes at least one of the following: source IP address, verification information for verifying the legitimacy of the browser.

[0079] The above-mentioned SSH session information and user device information can be encrypted into a string, and the expiration time of the SSH session represents the validity time of the SSH session connection. In some possible embodiments, the method further includes: when it is determined that the expiration time of the SSH session has been reached, if there is data transmission in the corresponding SSH session connection, the SSH session connection is disconnected after the data transmission is completed, otherwise the connection of the SSH session is directly disconnected.

[0080] In some possible embodiments, the corresponding SSH session information is returned to the user device so that the HTTP request subsequently initiated by the user device carries the SSH session information, including: encrypting the corresponding SSH session information and user device information using AES256 and encoding them into a string using Base64; encrypting the string and returning it to the user device so that the user device subsequently initiates an HTTP request when accessing a wildcard domain name with the encrypted string. Using the user device information and the SSH session in the form of an encrypted string can ensure the information security of the intranet device.

[0081] In some possible embodiments, the source IP address in the character string is parsed to see whether it is consistent with the source IP address of the user device, and if not, the HTTP request is rejected.

[0082] In the embodiment of the present application, the HTTP request initiated by each user device will be coordinated by the cloud service platform and the intranet device in the local area network to build an SSH tunnel. The source IP address of the user device, the tunnel endpoint address (Socket port), the expiration time of the SSH session, the SSH session ID and other information will be encrypted using AES256 and Base64 encoded into a string and returned to the user device. The user device only needs to access the wildcard domain name with the string. The HTTP request of each user device will go to the same public network external port of the cloud platform. When the cloud service platform parses the HTTP request, it decrypts the string, then verifies the source IP address and identifies the target, and dynamically forwards each HTTP request through the HTTP processing module, thereby achieving accurate access to different devices.

[0083] One SSH session connection corresponds to one SSH tunnel, and one SSH tunnel corresponds to one Socket endpoint, where the Socket endpoint includes a virtual network card and a port number.

[0084] like Figure 2 As shown, in the embodiment of the present application, the cloud service platform includes an HTTP processing module, multiple virtual network cards and a tunnel management module from the software function module, each virtual network card provides multiple ports,

[0085] The HTTP processing module can identify HTTP requests from different user devices to the same external port (such as 443), parse HTTP requests and cooperate with the SSH tunnel management module to obtain the logical IP address of the corresponding SSH session connection and forward it to the Socket endpoint on the virtual network card. At the same time, the module can also provide TLS (Transport Layer Security) / SSL (Secure Socket Layer) encryption capabilities to enable HTTP connections to support HTTPS. SSL / TLS is a cryptographic communication framework, and HTTPS refers to HTTP communication over a secure connection provided by the SSL / TLS protocol.

[0086] The virtual network card is a virtual device located in the network management server that can mount a Socket endpoint. By mapping the local Socket endpoint forwarded by the SSH port to the logical IP of the virtual network card, kernel routing forwarding is performed by accessing the logical IP address, without occupying the port resources on the physical network card (such as the loopback interface lo), and the Socket endpoint can also be provided within the system for the HTTP processing module to establish HTTP communication.

[0087] SSH tunnel management module: This module is responsible for maintaining the ID of the SSH session, providing an interface for the HTTP processing module to query, implementing the reuse mechanism of the SSH tunnel, maintaining the relationship between the port forwarding capability carried by the SSH tunnel and the logical IP of the virtual network card, and maintaining the life cycle of the SSH tunnel. Specifically, it can maintain the mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card.

[0088] In some possible embodiments, determining the logical IP address of the virtual network card according to the parsing result of the SSH session information includes:

[0089] Sending the parsed result of the SSH session information to the tunnel management module through the HTTP processing module, wherein the parsed result of the SSH session information includes at least one of an SSH session ID and a Socket endpoint;

[0090] The tunnel management module determines the logical IP address corresponding to the resolved SSH session ID / Socket endpoint according to the pre-established mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card, and returns it to the HTTP processing module.

[0091] In the embodiment of the present application, the tunnel management module is responsible for determining whether an SSH session connection is currently established with the intranet device based on the analysis result of the SSH session information by the HTTP processing module. If an SSH session connection is established with the intranet device, the mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card is stored locally. If no connection is established locally, an SSH command is sent to the intranet device to establish an SSH session connection. After the SSH session connection is established, the mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card is stored.

[0092] In some possible embodiments, the cloud service platform of the embodiment of the present application establishes an SSH session connection with the intranet device in the following manner:

[0093] Sending the HTTP request to the SSH tunnel management module through the HTTP processing module;

[0094] When notifying the SSH tunnel management module to determine that no SSH session connection is established with the intranet device, an SSH command is issued to the intranet device;

[0095] The Web service port returned by the user device is received through the tunnel management module, the Web port is forwarded to a port of one of the virtual network cards, the logical IP address of the virtual network card and the port mapping is determined, and an SSH session connection using the logical IP address is established.

[0096] like Figure 3 The flowchart of the method for accessing the intranet device Web service from the public cloud provided by the embodiment of the present application mainly includes:

[0097] Step 301: After logging into the cloud service platform through a user device, the user selects an intranet device that needs to access the Web interface in the device list, generates an HTTP request and sends it to the cloud service platform;

[0098] The above HTTP request is first sent to the HTTP processing module of the cloud service platform.

[0099] Step 302, the cloud service platform determines whether the terminal has established an SSH session connection based on an SSH tunnel with the intranet device. If yes, execute step 305, otherwise execute step 303;

[0100] The HTTP processing module sends the parsing result of the corresponding HTTP request to the SSH tunnel management module. When the SSH tunnel management module determines that the HTTP request does not contain an encrypted string and that no process connection has been established with the intranet device before, step 303 is executed. If an SSH session connection has been established with the intranet device before, step 305 is executed.

[0101] Step 303: The cloud service platform generates an SSH command and sends it to the intranet device via the NETCONF protocol.

[0102] Step 304: The intranet device calls the built-in SSH client to establish an SSH port forwarding tunnel according to the SSH command information issued by the cloud service platform, and forwards its own Web service port to a virtual network card of the cloud service platform;

[0103] Step 305: The cloud service platform encrypts the user device IP address, virtual network card endpoint address (Socket port), SSH session expiration time, SSH session ID and other information using AES256, and Base64 encodes it into a string and sends it to the user device;

[0104] In implementation, the SSH tunnel management module specifically generates a character string and sends the character string to the HTTP processing module, which then sends the character string to the user device through a public port.

[0105] Step 306: The user device accesses the wildcard domain name with the encrypted string and initiates an HTTP request;

[0106] Step 307, the cloud service platform identifies the source IP address in the string and determines whether it is consistent with the IP address of the user device. If the IP addresses are consistent, the HTTP request is forwarded to the intranet device through the pre-established SSH connection; otherwise, the HTTP request is rejected.

[0107] In the embodiment of the present application, the HTTP processing module parses the HTTP request, decrypts it if it carries an encrypted string, determines whether the source IP address is consistent with the IP address of the user device, and if they are consistent, sends the parsed result to the SSH tunnel management module, obtains the logical IP address of the virtual network card from the SSH tunnel management module, and forwards the HTTP request to the intranet device through a pre-established SSH connection based on the logical IP address.

[0108] Step 308, when the cloud service platform determines that the expiration time of the SSH session has been reached, if there is data transmission in the corresponding SSH session connection, the SSH session connection is disconnected after the data transmission is completed, otherwise the SSH session connection is directly disconnected.

[0109] The method for accessing the intranet device Web service from the public cloud provided in the embodiment of the present application has the following features:

[0110] Beneficial effects:

[0111] 1) There is no need to open different ports for the cloud service platform or temporarily change the firewall policy. Only one port is needed to enable different user devices to access different intranet devices;

[0112] 2) No need to occupy extra external ports. By using the virtual network card technology inside the Linux system, the maximum limit on the number of concurrent devices set by the theoretical maximum number of ports (65535 minus the system reserved ports) can be broken;

[0113] 3) Using an agreed implementation mechanism, the request routing information is implicit in the string and is only temporary, so the HTTP routing processor of the cloud service platform does not need to maintain the routing information in the persistent configuration;

[0114] 4) Since each user device generates a unique string for accessing each intranet device, and the cloud service platform can identify the visitor's network information in each request, it blocks abnormal connections such as source IP inconsistent with the IP implied in the string, expired requests, etc., and even if the access link generated by a customer is leaked to others, it can still be identified, thereby improving the security of the system;

[0115] 5) SSH construction parameters are programmable by the cloud service platform, so it is also possible to forward third-party devices in the same LAN based on your own devices.

[0116] The following is a detailed description of the method for accessing the intranet device Web service from the public cloud provided in the embodiment of the present application with reference to an example. Figure 4 As shown, it mainly includes the following processes:

[0117] Step 1: User device 1 requests to access the Web network element of intranet device 1 and sends a corresponding access request to the cloud service platform;

[0118] Step 2: The cloud service platform sends an SSH command to the intranet device 1 through the NETCONF protocol. The SSH command carries SSH connection parameters.

[0119] Step 3: The intranet device 1 establishes an SSH session connection with the cloud service platform according to the SSH connection parameters. The specific establishment process parameters are described in the above embodiment and will not be described in detail here.

[0120] Step 4: The cloud service platform generates an encrypted string containing user device information and SSH session information;

[0121] Step 5: User device 1 accesses the wildcard domain name carrying the encrypted string to generate an HTTP request, which is sent to the cloud service platform;

[0122] Step 6: The cloud service platform parses the string information and forwards the HTTP request to the intranet device 1 through the pre-established SSH session connection;

[0123] Step 7, the intranet device 1 responds to the HTTP request of the user device 1;

[0124] Step 8: User device 2 requests to access the Web network element of intranet device 1 and sends a corresponding access request to the cloud service platform;

[0125] Step 9: The cloud service platform reuses the previously established SSH session connection;

[0126] Step 10: The cloud service platform generates an encrypted string containing user device information and SSH session information;

[0127] Step 11, user device 2 accesses the wildcard domain name carrying the encrypted string to generate an HTTP request, and sends it to the cloud service platform;

[0128] Step 12, the cloud service platform parses the string information and forwards the HTTP request to the intranet device 2 through the pre-established SSH session connection;

[0129] Step 13, the intranet device 1 responds to the HTTP request of the user device 2;

[0130] Step 14, user device 2 requests to access the Web network element of intranet device 2, and sends a corresponding access request to the cloud service platform;

[0131] Step 15: The cloud service platform sends an SSH command to the intranet device 2 through the NETCONF protocol. The SSH command carries SSH connection parameters.

[0132] Step 16: The intranet device 2 establishes an SSH session connection with the cloud service platform according to the SSH connection parameters. The specific establishment process parameters are described in the above embodiment and will not be described in detail here.

[0133] Step 17, the cloud service platform generates an encrypted string containing user device information and SSH session information;

[0134] Step 18: User device 2 accesses the wildcard domain name carrying the encrypted string to generate an HTTP request, and sends it to the cloud service platform;

[0135] Step 19, the cloud service platform parses the string information and forwards the HTTP request to the intranet device 2 through the pre-established SSH session connection;

[0136] Step 20, the intranet device 2 responds to the HTTP request of the user device 2;

[0137] Step 20: When the expiration time of the SSH session established with the intranet device 1 is reached, the SSH session connection is directly closed if there is no data transmission, otherwise the SSH session connection is closed after the data transmission is completed;

[0138] Step 21, when the expiration time of the SSH session established with the intranet device 2 is reached, if there is no data transmission, the SSH session connection is directly closed, otherwise the SSH session connection is closed after the data transmission is completed.

[0139] Based on the same inventive concept, the present application also provides a device for accessing the Web service of an intranet device from a public cloud, such as Figure 5 As shown, the device comprises:

[0140] The HTTP request receiving module 501 is used to receive an HTTP request from a public network user device to access an intranet device, and parse the HTTP request to determine the SSH session information that carries the SSH session information for establishing an SSH session connection between the cloud service platform and the intranet device;

[0141] Socket endpoint determination module 502, used to determine the logical IP address of the virtual network card according to the parsing result of the SSH session information;

[0142] The HTTP request transmission module 503 is used to transmit the HTTP request to the virtual network card through the logical IP address, and the virtual network card transmits the HTTP request to the intranet device through the SSH session connection corresponding to the logical IP address.

[0143] In some possible embodiments, it further includes:

[0144] The SSH connection establishment module is used to parse the HTTP request to determine whether it carries the SSH session information; if the cloud service platform has established an SSH session connection with the intranet device, obtain the corresponding SSH session information; otherwise, execute the SSH session connection establishment process with the intranet device and obtain the corresponding SSH session information; return the corresponding SSH session information to the user device, so that the HTTP request initiated by the user device later carries the SSH session information.

[0145] In some possible embodiments, when the HTTP request carries the SSH session information, it also carries the user device information;

[0146] The SSH session information includes at least one of the following: SSH session ID, Socket endpoint, and expiration time of the SSH session;

[0147] The user device information includes at least one of the following: a source IP address, and verification information for verifying the legitimacy of the browser.

[0148] In some possible embodiments, the Socket endpoint determination module determines the logical IP address of the virtual network card according to the parsing result of the SSH session information, including:

[0149] Sending the parsed result of the SSH session information to the tunnel management module through the HTTP processing module, wherein the parsed result of the SSH session information includes at least one of an SSH session ID and a Socket endpoint;

[0150] The tunnel management module determines the logical IP address corresponding to the resolved SSH session ID / Socket endpoint according to the pre-established mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card, and returns it to the HTTP processing module.

[0151] In some possible embodiments, the cloud service platform establishes an SSH session connection with the intranet device in the following manner:

[0152] Sending the HTTP request to the SSH tunnel management module through the HTTP processing module;

[0153] When notifying the SSH tunnel management module to determine that no SSH session connection is established with the intranet device, an SSH command is issued to the intranet device;

[0154] The Web service port returned by the user device is received through the tunnel management module, the Web port is forwarded to a port of one of the virtual network cards, the logical IP address of the virtual network card and the port mapping is determined, and an SSH session connection using the logical IP address is established.

[0155] In some possible embodiments, the SSH connection establishment module returns the corresponding SSH session information to the user equipment so that an HTTP request subsequently initiated by the user equipment carries the SSH session information, including:

[0156] Encrypt the corresponding SSH session information and user device information using AES256 and encode them into a string using Base64;

[0157] The character string is encrypted and returned to the user device, so that the user device initiates an HTTP request when accessing a wildcard domain name with the encrypted character string later.

[0158] In some possible embodiments, the SSH session information includes an expiration time of the SSH session, and further includes at least one of the following steps:

[0159] The SSH connection termination module is used to determine that when the expiration time of the SSH session is reached, if there is data transmission in the corresponding SSH session connection, disconnect the SSH session connection after the data transmission is completed, otherwise directly disconnect the connection of the SSH session;

[0160] The HTTP request rejection module is used to analyze whether the source IP address in the character string is consistent with the source IP address of the user device, and reject the HTTP request if they are inconsistent.

[0161] Based on the same inventive concept, the embodiment of the present application also provides a device for a public cloud to access an intranet device Web service, such as Figure 6 As shown, the device comprises:

[0162] HTTP request generation module 601, used to generate an HTTP request carrying the SSH session information according to the user's access operation on the intranet device displayed on the web page, if the corresponding SSH session information is obtained from the cloud service platform in advance;

[0163] HTTP request sending module 602, used to send the HTTP request to the cloud service platform;

[0164] The SSH session information is related information of the SSH session connection established between the cloud service platform and the intranet device.

[0165] After introducing the method and apparatus for accessing the Web service of an intranet device from a public cloud according to an exemplary embodiment of the present application, next, an apparatus for accessing the Web service of an intranet device from a public cloud according to another exemplary embodiment of the present application is introduced.

[0166] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0167] In some possible implementations, the device for accessing the intranet device Web service from the public cloud according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps in the method for accessing the intranet device Web service from the public cloud applied to the cloud service platform according to various implementations of the present application, or the steps in the method for accessing the intranet device Web service from the public cloud applied to the user device, as described above in this specification.

[0168] Refer to the following Figure 7 To describe the device 170 for accessing the intranet device Web service from the public cloud according to this embodiment of the present application. Figure 7 The device 170 shown for accessing the intranet device Web service from the public cloud is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0169] like Figure 7 As shown, the device 170 for accessing the web service of an intranet device from a public cloud is presented in the form of a general electronic device. The components of the device 170 for accessing the web service of an intranet device from a public cloud may include, but are not limited to: at least one processor 171, at least one memory 172, and a bus 173 connecting different system components (including the memory 172 and the processor 171).

[0170] Bus 173 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0171] The memory 172 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1721 and / or a cache memory 1722 , and may further include a read-only memory (ROM) 1723 .

[0172] Memory 172 may also include a program / utility 1725 having a set (at least one) of program modules 1724, such program modules 1724 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0173] The device 170 for public cloud access to intranet device web service can also communicate with one or more external devices 174 (e.g., keyboard, pointing device, etc.), and can also communicate with one or more devices that enable users to interact with the device 170 for public cloud access to intranet device web service, and / or communicate with any device (e.g., router, modem, etc.) that enables the device 170 for public cloud access to intranet device web service to communicate with one or more other electronic devices. Such communication can be performed through input / output (I / O) interface 175. In addition, the device 170 for public cloud access to intranet device web service can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through network adapter 176. As shown in the figure, network adapter 176 communicates with other modules of the device 170 for public cloud access to intranet device web service through bus 173. It should be understood that, although not shown in the figure, the device 170 that can access the intranet device Web service in conjunction with the public cloud can use other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0174] In some possible implementations, various aspects of a method for a public cloud to access an intranet device Web service provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for a public cloud to access an intranet device Web service according to various exemplary implementations of the present application described above in this specification.

[0175] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0176] The program product for accessing the intranet device Web service from the public cloud in the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0177] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0178] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0179] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or entirely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0180] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0181] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0182] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0183] The present application is described with reference to the flowcharts and block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and block diagram, as well as the combination of the processes and boxes in the flowchart and block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and block diagram. Figure 1 Process or multiple processes and boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0184] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 Process or multiple processes and boxes Figure 1 A function specified in one or more boxes.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Process or multiple processes and boxes Figure 1 The steps for the functions specified in one or more boxes.

[0186] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0187] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for accessing an intranet device Web service from a public cloud, applied to a cloud service platform, characterized in that: The method comprises: Receiving an HTTP request from a public network user device to access an intranet device, parsing the HTTP request to determine SSH session information that carries an SSH session connection established between the cloud service platform and the intranet device; Determine the logical IP address of the virtual network card according to the parsing result of the SSH session information; The HTTP request is transmitted to the virtual network card via the logical IP address, and the virtual network card transmits the HTTP request to the intranet device via the SSH session connection corresponding to the logical IP address.

2. The method according to claim 1, characterized in that Also includes: Parsing the HTTP request to determine that no SSH session information is carried; If the cloud service platform has established an SSH session connection with the intranet device, obtain the corresponding SSH session information; otherwise, execute the SSH session connection establishment process with the intranet device and obtain the corresponding SSH session information; The corresponding SSH session information is returned to the user equipment, so that the HTTP request subsequently initiated by the user equipment carries the SSH session information.

3. The method according to claim 1, characterized in that When the HTTP request carries the SSH session information, it also carries the user device information; The SSH session information includes at least one of the following: SSH session ID, Socket endpoint, and expiration time of the SSH session; The user device information includes at least one of the following: a source IP address, and verification information for verifying the legitimacy of the browser.

4. The method according to claim 1, characterized in that Determining the logical IP address of the virtual network card according to the parsing result of the SSH session information includes: Sending the parsed result of the SSH session information to the tunnel management module through the HTTP processing module, wherein the parsed result of the SSH session information includes at least one of an SSH session ID and a Socket endpoint; The tunnel management module determines the logical IP address corresponding to the resolved SSH session ID / Socket endpoint according to the pre-established mapping relationship between the SSH session ID / Socket endpoint and the logical IP address of the virtual network card, and returns it to the HTTP processing module.

5. The method according to claim 1, characterized in that The cloud service platform establishes an SSH session connection with the intranet device in the following manner: Sending the HTTP request to the SSH tunnel management module through the HTTP processing module; When notifying the SSH tunnel management module to determine that no SSH session connection is established with the intranet device, an SSH command is issued to the intranet device; The Web service port returned by the user device is received through the tunnel management module, the Web port is forwarded to a port of one of the virtual network cards, the logical IP address of the virtual network card and the port mapping is determined, and an SSH session connection using the logical IP address is established.

6. The method according to claim 2, characterized in that Returning the corresponding SSH session information to the user device so that a subsequent HTTP request initiated by the user device carries the SSH session information, including: Encrypt the corresponding SSH session information and user device information using AES256 and encode them into a string using Base64; The character string is encrypted and returned to the user device, so that the user device initiates an HTTP request when accessing a wildcard domain name with the encrypted character string later.

7. The method according to claim 3 or 6, characterized in that: The SSH session information includes the expiration time of the SSH session, and further includes at least one of the following steps: When it is determined that the expiration time of the SSH session has been reached, if there is data transmission in the corresponding SSH session connection, the SSH session connection is disconnected after the data transmission is completed, otherwise the SSH session connection is directly disconnected; The source IP address in the string is parsed to see whether it is consistent with the source IP address of the user device, and if not, the HTTP request is rejected.

8. A method for a public cloud to access an intranet device Web service, applied to a user device, characterized in that: The method comprises: According to the user's access operation to the intranet device displayed on the web page, if the corresponding SSH session information is obtained from the cloud service platform in advance, an HTTP request carrying the SSH session information is generated; Sending the HTTP request to the cloud service platform; The SSH session information is related information of the SSH session connection established between the cloud service platform and the intranet device.

9. A device for accessing a Web service of an intranet device from a public cloud, characterized in that: The device comprises: An HTTP request receiving module is used to receive an HTTP request from a public network user device to access an intranet device, and parse the HTTP request to determine SSH session information that carries the SSH session information for establishing an SSH session connection between the cloud service platform and the intranet device; A socket endpoint determination module, used to determine the logical IP address of the virtual network card according to the parsing result of the SSH session information; The HTTP request transmission module is used to transmit the HTTP request to the virtual network card through the logical IP address, and the virtual network card transmits the HTTP request to the intranet device through the SSH session connection corresponding to the logical IP address.

10. A device for accessing a Web service of an intranet device from a public cloud, characterized in that: The device comprises: An HTTP request generation module is used to generate an HTTP request carrying the SSH session information according to the user's access operation on the intranet device displayed on the web page, if the corresponding SSH session information is obtained from the cloud service platform in advance; An HTTP request sending module, used to send the HTTP request to the cloud service platform; The SSH session information is related information of the SSH session connection established between the cloud service platform and the intranet device.

11. A device for accessing the Web service of an intranet device from a public cloud, characterized in that: It comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method as described in any one of claims 1 to 7, or execute the method as described in claim 8.

Images