Intranet host operation and maintenance method

Abstract

The embodiment of the invention provides an intranet host operation and maintenance method which is used for solving the problems that in the prior art, a normal exposure surface exists, the risk of transversely permeating all resources exists when attacks happen, and severe network security threats exist. The reverse proxy server receives the operation and maintenance request sent by the bastion host, and determines a target port number of the operation and maintenance request received by the reverse proxy server carried in the operation and maintenance request; determining a target reverse proxy agent corresponding to the target port number according to a corresponding relationship between the stored reverse proxy server port number and a reverse proxy agent identifier; the operation and maintenance request is forwarded to the target reverse agent, intranet assets are hidden in a normal state, authority control is refined, the damage radius of a security event can be effectively restrained in an extreme condition, and therefore the overall security and reliability are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method for operating and maintaining intranet hosts. Background Technology

[0002] In complex network environments, bastion hosts serve as the core gatekeeper for operational security. Their necessity stems from fundamentally addressing risks such as uncontrolled access, untraceable operations, and exposure. Specifically, by centrally managing access points to all internal network resources, bastion hosts unify the management of dispersed operational accounts, enforce role-based access control (RBAC), and adhere to the principle of least privilege, thus preventing unauthorized operations and account sharing at the source. Simultaneously, relying on protocol proxy mechanisms, they record commands, file transfers, and graphical operations throughout the entire process, generating tamper-proof audit recordings that meet the requirements of full operation traceability and 180-day traceability under regulations such as the Cybersecurity Law 2.0 or ISO 27001.

[0003] Based on the aforementioned characteristics of bastion hosts, operations and maintenance personnel typically use bastion hosts in public network environments to access internal network hosts, specifically including: Method 1, such as Figure 1 The diagram illustrates a network topology for accessing internal network hosts via a bastion host. A Virtual Private Network (VPN) client and a bastion host client are installed on a cloud host with a public network exposure surface (i.e., the exposure surface of the actual service). A VPN server is installed on the internal network host being maintained on the customer's side, and a bastion host server is installed on the customer's internal network. VPN technology is used to connect the cloud host and the customer's internal network, enabling public network customers to access the customer's internal network host using the bastion host client on the cloud host.

[0004] However, this method needs to deploy a Secure Sockets Layer (SSL) / Internet Protocol Security (IPSec) VPN gateway (such as OpenVPN, Cisco AnyConnect) at the public network boundary, that is, the customer exposure face, and open a fixed port for remote user access, such as User Datagram Protocol (UDP) 500 / 4500 port or Transmission Control Protocol (TCP) 443 port. In order to ensure smooth access to the customer internal network, the firewall needs to explicitly release the VPN port, resulting in the exposure of the public IP and port combination to scanning tools, and the exposure of the port will lead to frequent high-risk vulnerabilities (such as Common Vulnerabilities and Exposures (CVE)-2023-36672). Moreover, after the public customer is authenticated, the customer can access the entire internal network without distinction, and once the account is leaked, the attacker can penetrate all resources horizontally.

[0005] Method two, as shown in Figure 2 The network topology diagram shown in the customized bastion host and reverse proxy component constitutes a network topology diagram, the reverse proxy component logs in to the customized bastion host, and then the public customer initiates an operation and maintenance request to the bastion host existing public exposure face (that is, the exposure face of the real service), the bastion host forwards the TCP connection (that is, the operation and maintenance request) to the reverse proxy component on the customer side, and the reverse proxy component forwards the data of the TCP connection to the real internal host. As shown in Figure 2 The reverse proxy component directly forwards the data of the TCP connection to the cloud platform server in scenario 1, or the reverse proxy component forwards the data of the TCP connection to the cloud platform server 1, the cloud platform server 2 or the cloud platform server 3 through the jump machine in scenario 2.

[0006] However, in this method, the bastion host must open a public network port for the reverse proxy component to connect, that is, the exposure face is transferred from the internal host in method one to the bastion host itself in method two, and the exposure risk of the bastion host is not truly eliminated. Moreover, after the public customer is authenticated, the customer can access the entire internal network without distinction, and once the account is leaked, the attacker can penetrate all resources horizontally.

[0007] In summary, the current technology of using a bastion host to access an internal host in a public network environment has a normal real service exposure face, and when attacked, there is a risk of horizontal penetration of all resources, facing serious network security threats. SUMMARY

[0008] The embodiment of the present application provides an intranet host operation and maintenance method, to solve the problem that the existing technology has a normal exposure surface, and when being attacked, there is a risk of horizontal penetration of all resources, and faces a serious network security threat.

[0009] In a first aspect, the embodiment of the present application provides an intranet host operation and maintenance method, applied to a reverse proxy server deployed in a public network, the reverse proxy server being connected with a bastion host in the public network and any reverse proxy client in the intranet respectively, and the method comprising: receiving an operation and maintenance request sent by the bastion host, and determining a target port number of the reverse proxy server receiving the operation and maintenance request carried in the operation and maintenance request; determining a target reverse proxy client corresponding to the target port number according to a correspondence between the saved reverse proxy server port number and reverse proxy client identifier; forwarding the operation and maintenance request to the target reverse proxy client.

[0010] In a second aspect, the embodiment of the present application also provides an intranet host operation and maintenance method, applied to any reverse proxy client deployed in the intranet, the reverse proxy client being connected with a reverse proxy server in the public network and at least one intranet host in the intranet respectively, and the method comprising: receiving an operation and maintenance request sent by the reverse proxy server, and determining a target port number of the reverse proxy server carried in the operation and maintenance request; determining a target intranet host address and a target intranet host port number corresponding to the target port number according to a correspondence between the saved reverse proxy server port number, intranet host address and port number; forwarding the operation and maintenance request to the target intranet host based on the target intranet host address and the target intranet host port number.

[0011] In a third aspect, the embodiment of the present application also provides an intranet host operation and maintenance device, applied to a reverse proxy server deployed in a public network, the reverse proxy server being connected with a bastion host in the public network and any reverse proxy client in the intranet respectively, and the device comprising: a first receiving module, configured to receive an operation and maintenance request sent by the bastion host, and determine a target port number of the reverse proxy server receiving the operation and maintenance request carried in the operation and maintenance request; a first processing module, configured to determine a target reverse proxy client corresponding to the target port number according to a correspondence between the saved reverse proxy server port number and reverse proxy client identifier; a first forwarding module, configured to forward the operation and maintenance request to the target reverse proxy client.

[0012] In a fourth aspect, the embodiments of the present application further provide an internal network host operation and maintenance device, which is applied to any reverse proxy client agent deployed in an internal network. The reverse proxy client agent is connected with a reverse proxy server in a public network and at least one internal network host in the internal network. The device comprises: a second receiving module, configured to receive an operation and maintenance request sent by the reverse proxy server, and determine a target port number of the reverse proxy server carried in the operation and maintenance request; a second processing module, configured to determine a target internal network host address and a target internal network host port number corresponding to the target port number according to a correspondence between the saved reverse proxy server port number, the internal network host address and the internal network host port number; a second forwarding module, configured to forward the operation and maintenance request to the target internal network host based on the target internal network host address and the target internal network host port number.

[0013] In a fifth aspect, the embodiments of the present application further provide an electronic device, which comprises at least a processor and a memory. The processor is configured to implement the steps of the internal network host operation and maintenance method applied to the reverse proxy server or the internal network host operation and maintenance method applied to the reverse proxy client agent as described in any one of the above aspects when executing a computer program stored in the memory.

[0014] In a sixth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program executable by an electronic device. When the program runs on the electronic device, the electronic device is caused to execute the steps of the internal network host operation and maintenance method applied to the reverse proxy server or the internal network host operation and maintenance method applied to the reverse proxy client agent as described in any one of the above aspects.

[0015] In the embodiment of the present application, the operation and maintenance request sent by the bastion host is received, the target port number of the reverse proxy server receiving the operation and maintenance request is determined from the operation and maintenance request, the target reverse proxy agent corresponding to the target port number is determined according to the correspondence between the saved reverse proxy server port number and the reverse proxy agent identifier, and the operation and maintenance request is forwarded to the target reverse proxy agent. In the embodiment of the present application, the public network operation and maintenance personnel and potential attackers can only obtain the reverse proxy server and the abstract port number allocated by the reverse proxy server, while the real network identity and network topology structure of the intranet host are completely hidden, and the access permission of the operation and maintenance personnel is strictly limited to the pre-authorized specific host and port, rather than the entire intranet segment, so as to eliminate the possibility of intranet horizontal migration. Therefore, the embodiment of the present application hides the intranet assets and refines the permission control in normal state, and can effectively contain the damage radius of security incidents in extreme cases (partial component collapse), thereby improving the overall security and reliability. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 A network topology diagram of a related art based on a bastion host accessing an intranet host; Figure 2 A network topology diagram of a related art based on a bastion host accessing an intranet host; Figure 3 An intranet host operation and maintenance process diagram applied to a reverse proxy server provided by an embodiment of the present application; Figure 4 An intranet host operation and maintenance network topology diagram provided by an embodiment of the present application; Figure 5 An intranet host operation and maintenance process diagram applied to a reverse proxy agent provided by an embodiment of the present application; Figure 6 An intranet host operation and maintenance process diagram provided by an embodiment of the present application; Figure 7 A structure diagram of an intranet host operation and maintenance device applied to a reverse proxy server provided by an embodiment of the present application; Figure 8A structural schematic diagram of an intranet host operation and maintenance device applied to a reverse proxy agent is provided for an embodiment of the present application. Figure 9 An electronic device structural schematic diagram is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose and embodiments of the present application clearer, the following will combine the drawings in the exemplary embodiments of the present application to clearly and completely describe the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application.

[0019] It should be noted that the brief description of the terms in the present application is only for the convenience of understanding the following described embodiments, and is not intended to limit the embodiments of the present application. Unless otherwise specified, these terms should be understood according to their ordinary and general meanings.

[0020] The terms "first", "second", "third", etc. in the specification and claims of the present application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit the specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchanged under appropriate circumstances.

[0021] The terms "include" and "have" and any variations thereof are intended to cover but not exclusive inclusion, for example, a product or device including a series of components does not have to be limited to all components clearly listed, but can include other components not clearly listed or inherent to these products or devices.

[0022] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware or / and software code capable of performing functions associated with the element.

[0023] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0024] For convenience of explanation, the foregoing description has been made in connection with specific embodiments. However, the foregoing exemplary discussion is not intended to be exhaustive or to limit the embodiments to the precise forms disclosed. Various modifications and variations are possible in light of the above teachings. The embodiments were chosen and described in order to provide the best illustration of the principles of the application and its practical application and to enable one of ordinary skill in the art to use the application in various embodiments and with various modifications as are suited to the particular use contemplated.

[0025] The embodiment of the present application provides an intranet host operation and maintenance method, which receives an operation and maintenance request sent by a bastion host, determines a target port number of a reverse proxy server receiving the operation and maintenance request carried in the operation and maintenance request, determines a target reverse proxy agent corresponding to the target port number according to a correspondence between the reverse proxy server port number and the reverse proxy agent identifier, and forwards the operation and maintenance request to the target reverse proxy agent. In the embodiment of the present application, a public network operation and maintenance personnel and a potential attacker can only obtain the reverse proxy server and an abstract port number allocated by the reverse proxy server, and the real network identity (IP address and port) of the intranet host and the network topology structure are completely hidden, and the access permission of the operation and maintenance personnel is strictly limited to the pre-authorized specific host and port, rather than the entire intranet segment, so that the possibility of intranet horizontal migration is eliminated (that is, even if the attacker steals the user credentials, the attack range is strictly restricted, and horizontal migration and penetration cannot be performed). Therefore, the embodiment of the present application hides the intranet assets in normal state, refines the permission control, and can effectively curb the damage radius of a security event in an extreme case (partial component subjugation), thereby improving the overall security and reliability.

[0026] Embodiment 1: Figure 3 The embodiment of the present application provides an intranet host operation and maintenance process applied to a reverse proxy server, and the process includes the following steps. S301: Receiving an operation and maintenance request sent by a bastion host, and determining a target port number of a reverse proxy server receiving the operation and maintenance request carried in the operation and maintenance request.

[0027] The intranet host operation and maintenance method provided by the embodiment of the present application is applied to a reverse proxy server deployed in a public network, the reverse proxy server is connected with a bastion host in the public network and any reverse proxy agent in the intranet respectively, and the reverse proxy server can be installed in a first electronic device, which can be a cloud host and the like, without specific limitation here.

[0028] The reverse proxy server receives the operation and maintenance request sent by the bastion host through a port corresponding to a target port number, analyzes the operation and maintenance request, and determines the target port number corresponding to the port through which the reverse proxy server receives the operation and maintenance request carried in the operation and maintenance request.

[0029] In a possible implementation, the bastion host and the reverse proxy server can be deployed in the same device (for example, the first electronic device), for example, Figure 4 The internal network host operation and maintenance network topology diagram shown in FIG. 1. The bastion host includes a bastion host operation and maintenance interface and a bastion host engine. The bastion host and the reverse proxy server are deployed in the same cloud host in the public network, and the bastion host engine is connected with the reverse proxy server. The reverse proxy server is connected with the reverse proxy agent deployed in the internal network.

[0030] In another possible implementation, the bastion host and the reverse proxy server can be deployed in different devices in the public network, for example, the reverse proxy server is installed in the first electronic device, and the bastion host is deployed in the second electronic device. The second electronic device can be another cloud host other than the first electronic device.

[0031] In addition, it can be understood here that, in order to avoid exposing the real information (including IP address and access port) of the internal network host, in the embodiment of the present application, at least one proxy policy is configured in the reverse proxy server in the proxy policy configuration stage, wherein each proxy policy includes a reverse proxy server port number configured for the real IP address and real port number of the internal network host; and each reverse proxy server port number and the corresponding internal network host proxy service identification information are sent to the bastion host. Therefore, the bastion host only stores the corresponding relationship between the reverse proxy server port number and the internal network host proxy service identification, and displays the corresponding relationship through the bastion host operation and maintenance interface to the operation and maintenance personnel, so as to select the required internal network host proxy service by the operation and maintenance personnel. Since the bastion host does not have information such as real address and port number related to the internal network host, the risk of exposing the real information of the internal network host is reduced.

[0032] The bastion engine encapsulates the target port number in the operation and maintenance request after identifying that the operation and maintenance personnel submits the target port number in the bastion operation and maintenance interface, and sends the operation and maintenance request to the reverse proxy server, so that the reverse proxy server receives the operation and maintenance request through the port corresponding to the target port number. The target port number can be a corresponding port number determined according to the proxy service of the intranet host selected by the operation and maintenance personnel in the bastion operation and maintenance interface, that is, the operation and maintenance personnel clicks Secure Shell (SSH) or Virtual Network Computing (VNC) in the bastion operation and maintenance interface to access the intranet host, and actually accesses the port corresponding to the target port number of the reverse proxy server, thereby hiding the intranet asset.

[0033] For example, if the target port number is 30001, the "server_ip: 30001" is encapsulated in the operation and maintenance request.

[0034] In addition, in the related art, such as the second mode shown in the background, a specific Remote Procedure Call (RPC) based login protocol is required between the bastion and the reverse proxy component, which leads to the need for customized modification of the bastion, and the bastion of other manufacturers cannot be compatible, and only relies on the token mechanism, which is vulnerable to replay attacks. However, in the embodiments of the present application, the bastion only needs to interact with the reverse proxy server through openapi to issue proxy policies, that is, the reverse proxy server sends the reverse proxy server port number and the corresponding intranet host proxy service identification information to the bastion, which can achieve the scene of compatible bastions of various manufacturers.

[0035] S302: According to the correspondence between the saved reverse proxy server port number and the reverse proxy agent identification, determine the target reverse proxy agent corresponding to the target port number.

[0036] The reverse proxy server receives the operation and maintenance request, obtains the correspondence between the reverse proxy server port number and the reverse proxy agent identification saved by itself, and determines whether the corresponding reverse proxy agent identification is saved for the target port number according to the target port number. If yes, it indicates that the proxy service corresponding to the target port number has been configured in the past, and the target reverse proxy agent corresponding to the target port number is determined; if not, it indicates that the proxy service corresponding to the target port number has not been configured in the past, so the subsequent processing process is no longer continued.

[0037] S303: Forward the operation and maintenance request to the target reverse proxy agent.

[0038] After the target reverse proxy agent corresponding to the target port number is determined, the operation and maintenance request is forwarded to the target reverse proxy agent deployed in the intranet.

[0039] In one possible implementation, in view of the manner two shown in the background, the session management is not encrypted, and only the tcp connection 1 of the bastion host to the reverse proxy component and the tcp connection 2 of the reverse proxy component to the intranet host are bridged, without encryption processing, so the tcp connection 1 of the bastion host to the reverse proxy component may be monitored. Therefore, in order to reduce the risk of operation and maintenance request leakage, in the embodiments of the present application, the reverse proxy server stores the correspondence between each reverse proxy agent identifier and public key, so after the target port number corresponding to the target reverse proxy agent identifier is determined, the first public key corresponding to the target reverse proxy agent is determined according to the target reverse proxy agent identifier and the stored correspondence between each reverse proxy agent identifier and public key; the operation and maintenance request is encrypted based on the first public key, and the encrypted operation and maintenance request is forwarded to the target reverse proxy agent.

[0040] In addition, before the operation and maintenance request is forwarded to the target reverse proxy agent, since the reverse proxy server stores the connection state of each reverse proxy agent having a connection relationship with the reverse proxy server and the reverse proxy server, it can be further determined whether the connection state of the target reverse proxy agent and the reverse proxy server is online, if yes, the step of forwarding the operation and maintenance request to the target reverse proxy agent is continued; if not, it is determined that the connection is interrupted, and the connection with the target reverse proxy agent is re-established.

[0041] Since the proxy policy information is stored in the reverse proxy server and the corresponding reverse proxy agent during the proxy policy configuration process, after the operation and maintenance request is forwarded to the target reverse proxy agent, the target reverse proxy agent forwards the operation and maintenance request to the target intranet host according to the stored proxy policy information.

[0042] In the embodiment of the present application, the public network operation personnel and potential attackers can only obtain the reverse proxy server and its assigned abstract port number, while the real network identity (IP address and port) of the intranet host and the network topology structure are completely hidden, and the access permission of the operation personnel is strictly limited to the pre-authorized specific host and port, rather than the entire intranet segment, eliminating the possibility of intranet horizontal movement (that is, even if the attacker steals user credentials, the scope of the attack is strictly restricted, and horizontal movement and penetration cannot be performed). Therefore, the embodiment of the present application integrates the zero trust strategy, realizes that neither the bastion host nor the reverse proxy component server opens any public network port, no service can be scanned, and the risk of vpn horizontal penetration is fundamentally eliminated; in the normal state, the intranet assets are hidden, the permission control is refined, and in the extreme case (part of the components are compromised), the damage radius of the security event can be effectively contained, thereby improving the overall security and reliability.

[0043] Embodiment 2: On the basis of the above-mentioned embodiments, in the embodiment of the present application, before receiving the operation request sent by the bastion host, further comprising: receiving a first configuration request, the first configuration request carrying a to-be-configured reverse proxy agent identifier, an address and a port number of a to-be-proxied intranet host; determining a candidate reverse proxy server port number allocated for the address and the port number; saving the correspondence between the candidate reverse proxy server port number and the to-be-configured reverse proxy agent identifier; sending a second configuration carrying the candidate reverse proxy server port number, the address and the port number of the to-be-proxied intranet host to the to-be-configured reverse proxy agent.

[0044] In the embodiment of the present application, in the proxy strategy configuration stage, the reverse proxy server receives a first configuration request, which carries a to-be-configured reverse proxy agent identifier, an address and a port number of a to-be-proxied intranet host.

[0045] The first configuration request can be a configuration request carrying a to-be-configured reverse proxy agent identifier (i.e. the online reverse proxy agent identifier selected by the administrator in the reverse proxy server background management interface) and an address and a port number of a to-be-proxied intranet host, which is generated after the administrator selects the address and the port number of the to-be-proxied intranet host and the online reverse proxy agent identifier in the reverse proxy server background management interface.

[0046] The reverse proxy server assigns a candidate reverse proxy server port number to the address and port number of the to-be-proxied intranet host after receiving the first configuration request, and saves the correspondence between the candidate reverse proxy server port number, the to-be-configured reverse proxy agent identifier, and the address and port number of the to-be-proxied intranet host in the reverse proxy server. The port corresponding to the candidate reverse proxy server port number is a reverse connection port, that is, a port connected to the bastion host in the reverse proxy server.

[0047] For example, the to-be-proxied intranet host with an IP address of 192.168.1.1 and a port number of tcp3389 is assigned a candidate reverse proxy server 30001 port; and the to-be-proxied intranet host with an IP address of 192.168.1.2 and a port number of tcp5900 is assigned a candidate reverse proxy server 30002 port.

[0048] In order to synchronize the above configuration information to the corresponding reverse proxy agent, so that the reverse proxy agent can forward the request information to the corresponding intranet host according to the configuration information in the actual access / maintenance process, in the embodiments of the present application, the reverse proxy server encapsulates the candidate reverse proxy server port number and the address and port number of the to-be-proxied intranet host in a second configuration according to the to-be-configured reverse proxy agent identifier, and sends the second configuration to the to-be-configured reverse proxy agent, so that the to-be-configured reverse proxy agent saves the correspondence between the candidate reverse proxy server port number and the address and port number of the to-be-proxied intranet host carried in the second configuration.

[0049] In one possible implementation, in order to reduce the risk of leakage of the real information of the intranet host, the reverse proxy server determines the second public key corresponding to the to-be-configured reverse proxy agent according to the correspondence between the reverse proxy agent identifiers and the public keys saved by itself, encrypts the second configuration based on the second public key, and forwards the encrypted second configuration to the to-be-configured reverse proxy agent.

[0050] Embodiment 3: In order to further improve network security, on the basis of the above embodiments, in the embodiments of the present application, before receiving the maintenance request sent by the bastion host, the method further includes: If it is determined that the set sequence UDP knock package sent by the to-be-connected reverse proxy agent is received through the preset first port, the state of the preset second port is updated to open, and the authorization prompt information is sent to the to-be-connected reverse proxy agent through the preset second port; Receive the connection request sent by the reverse proxy agent to be connected, send the server certificate to the reverse proxy agent to be connected, receive the client certificate returned by the reverse proxy agent to be connected, authenticate the reverse proxy agent to be connected based on the client certificate, and if the authentication is successful, establish a connection with the reverse proxy agent to be connected through the preset second port.

[0051] In this embodiment of the application, before configuring the proxy policy, it is necessary to log in and authenticate with the reverse proxy agent, and establish a connection after successful authentication. The following describes the login and authentication process between the reverse proxy server and any reverse proxy agent: If a reverse proxy server receives a UDP knock packet from any pending reverse proxy agent through its preset first port, it determines whether the UDP knock packet follows a predefined sequence. This predefined sequence UDP knock packet can include three distinct UDP knock packets. If so, the server performs a preliminary verification of the pending reverse proxy agent based on this predefined sequence UDP knock packet. If the verification passes, the server updates its preset second port to be open. The reverse proxy server then sends an authorization message to the pending reverse proxy agent through its open preset second port.

[0052] The reverse proxy server's default first port is the authentication gateway port, and this default first port is not the actual service exposure surface, such as UDP port 20000. The default second port of the reverse proxy server is the control port, such as TCP port 11912. Furthermore, in order not to expose any public network ports (i.e., the actual service exposure surface), this default second port is normally closed, and is only briefly opened during the connection establishment process with the reverse proxy agent.

[0053] In addition, the process of performing preliminary verification of the reverse proxy agent to be connected based on the set sequence UDP knock packet is existing technology and will not be described in detail here.

[0054] If the reverse proxy server receives a connection request from the reverse proxy agent to be connected to, it sends a server certificate to the reverse proxy agent to authenticate the reverse proxy server.

[0055] If the reverse proxy server receives the client certificate returned by the reverse proxy agent to be connected, it authenticates the reverse proxy agent based on the client certificate. If the authentication is successful, it sends a connection response to the reverse proxy agent to be connected through its own preset second port, establishes a connection with the reverse proxy agent to be connected through the preset second port, and updates the connection status of the reverse proxy agent to be connected to online in the reverse proxy server. If the authentication fails, it sends a connection failure message to the reverse proxy agent to be connected through its own preset second port.

[0056] It is understood that, in order to improve network security, in this embodiment of the application, the reverse proxy server and the reverse proxy agent use a short-term certificate and session token rotation method to perform the above login authentication process.

[0057] In addition, since certificates carry public key information—for example, the server certificate carries the public key of the reverse proxy server, and the client certificate carries the public key of the reverse proxy agent to be connected—the reverse proxy server, after verifying that the reverse proxy agent to be connected has passed verification, will save the mapping between the public key of the reverse proxy agent to be connected and the identifier of the reverse proxy agent to be connected. This facilitates the subsequent forwarding of maintenance requests to the reverse proxy agent to be connected, and the use of Hypertext Transfer Protocol Secure (HTTPS) encryption for the maintenance request, ensuring that the information in the maintenance request is not leaked and improving communication security.

[0058] In this embodiment of the application, based on zero-trust technology, UDP knock packets are used to ensure that the cloud host does not need to be exposed to the public network normally, thereby further improving network security.

[0059] Example 4: To further enhance network security, based on the above embodiments, the method in this application embodiment further includes: If the preset second port is detected to be open for a set period of time, the status of the preset second port will be updated to closed; and the connection status between the preset second port and the reverse proxy agent to be connected will be determined to be keep-alive.

[0060] If the reverse proxy server detects that its preset second port has been open for a set period of time, it will update the status of the preset second port to closed, thereby ensuring that the preset second port is in a normally closed state and reducing the risk of exposure.

[0061] The set duration can be the time required for the reverse proxy server and the reverse proxy agent to complete the connection establishment process. For example, the set duration can be 5 seconds.

[0062] Before updating the status of the preset second port to closed, the reverse proxy server has already established a connection session with the reverse proxy agent to be connected. Therefore, in order to ensure that the connection between the reverse proxy server and the reverse proxy agent to be connected is always maintained, in this embodiment of the application, the connection session between the reverse proxy server and the reverse proxy agent to be connected is kept alive, so that the connection between the preset second port and the reverse proxy agent to be connected is in a keep-alive state.

[0063] The keep-alive process is as follows: the reverse proxy server and the reverse proxy agent to be connected will periodically send heartbeat packets to each other and determine whether they have received a reply from the other party. If they have, it is determined that the connection session between the two has not been interrupted; if not, it is determined that the connection session has been interrupted and the connection needs to be re-established. The connection status of the reverse proxy agent to be connected will be updated to offline in the reverse proxy server.

[0064] In this embodiment, after recognizing that the preset second port has been open for a set period of time, the status of the preset second port is updated to closed, and the connection status between the preset second port and the reverse proxy agent to be connected is determined to be keep-alive. This achieves the goal of keeping the public network exposed port (i.e. the preset second port) normally closed while maintaining the connection with the reverse proxy agent to be connected, thereby further improving network security.

[0065] Example 5: Based on the above embodiments, in this embodiment, after determining the target reverse proxy agent corresponding to the target port number and before forwarding the operation and maintenance request to the target reverse proxy agent, the method further includes: Send notification information to the target reverse proxy agent through a preset second port, and receive response information from the target reverse proxy agent carrying the target reverse proxy agent's port number; Forward maintenance requests to the target reverse proxy agent, including: Based on the target reverse proxy agent port number carried in the response information, the operation and maintenance request is forwarded to the target reverse proxy agent.

[0066] For any reverse proxy agent that has established a connection with the reverse proxy server, although a connection has been established between the reverse proxy server and the reverse proxy agent, the established connection is a control channel. That is, the preset second port of the reverse proxy server is only used to listen for the heartbeat packets of the reverse proxy agent or to output notification information, and the port of the reverse proxy agent that is connected to the preset second port of the reverse proxy server is also only used to listen for the heartbeat packets of the reverse proxy server or to receive notification information, and will not perform actual data forwarding. Therefore, in this embodiment of the application, in order to establish a data channel between the reverse proxy server and the reverse proxy agent that can forward maintenance requests, after receiving the maintenance request and determining the target reverse proxy agent corresponding to the target port number, the reverse proxy server sends a notification information to the target reverse proxy agent through the preset second port. If it receives a response information carrying the target reverse proxy agent port number from the target reverse proxy agent, then a data channel between the reverse proxy server and the target reverse proxy agent is established based on the target reverse proxy agent port number.

[0067] Specifically, after confirming that the response information carrying the target reverse proxy agent port number has been received from the target reverse proxy agent, the encrypted operation and maintenance request is forwarded to the target reverse proxy agent based on the target reverse proxy agent port number carried in the response information, so that the target reverse proxy agent receives the encrypted operation and maintenance request through the port corresponding to the target reverse proxy agent port number.

[0068] Example 6: Based on the above embodiments, in this embodiment, after receiving the first configuration request sent by any reverse proxy agent, the method further includes: Determine whether a connection has been established with the reverse proxy agent to be configured. If so, continue with the steps to determine the candidate reverse proxy server port number to be assigned to the address and port number.

[0069] In this embodiment of the application, if the reverse proxy server receives a first configuration request sent by any reverse proxy agent, it determines that a proxy policy needs to be configured for the reverse proxy agent. Before configuring the proxy policy, it is also necessary to determine whether the reverse proxy agent has completed login authentication.

[0070] Specifically, after receiving the first configuration request from any reverse proxy agent, the system determines whether a connection has been established with the reverse proxy agent based on the connection status of the reverse proxy agent to be configured stored in the reverse proxy server. If the connection status of the reverse proxy agent to be configured is determined to be online, then a connection has been established with the reverse proxy agent to be configured; if the connection status of the reverse proxy agent to be configured is determined to be offline, then the connection with the reverse proxy agent to be configured has been interrupted.

[0071] After confirming that the reverse proxy server has established a connection with the reverse proxy agent to be configured, the process continues to determine the port number of the candidate reverse proxy server to be assigned the address and port number, that is, to continue the proxy policy configuration process.

[0072] Example 7: In the embodiments of this application, Figure 5 This application provides a schematic diagram of an intranet host operation and maintenance process applied to a reverse proxy agent, which includes: S501: Receives maintenance requests sent by the reverse proxy server and determines the target port number of the reverse proxy server carried in the maintenance request.

[0073] The additional intranet host operation and maintenance method provided in this application embodiment is applied to any reverse proxy agent deployed on the intranet, wherein the reverse proxy agent is connected to a reverse proxy server on the public network and at least one intranet host. Furthermore... Figure 4 Taking this as an example, the reverse proxy agent in the intranet connects to host 1 and host 2, which are also deployed in the intranet; and the reverse proxy agent also connects to the reverse proxy server deployed in the public network.

[0074] The reverse proxy agent can be installed on a third electronic device, such as a Linux device or a Windows device. The intranet host is a host deployed on the customer's intranet, such as an intranet database or an office automation system (OA) website. The intranet host supports SSH login protocol or VNC login protocol, and the remote login protocols used by the hosts in the intranet can be the same or different, without specific restrictions.

[0075] Furthermore, to enable the reverse proxy agent to maintain internal network hosts, in this embodiment, the reverse proxy agent and the internal network host assets requiring maintenance are Layer 3 reachable. Layer 3 reachability means that the reverse proxy agent and the internal network host are in an interconnected IP network, possess network layer addresses that can be mutually addressed through routing mechanisms, and that firewall, security group, or access control list policies on the network path allow IP communication between them.

[0076] The reverse proxy agent receives maintenance requests sent by the reverse proxy server, parses the requests, and determines the target port number of the reverse proxy server carried in the request. This target port number corresponds to the port on the reverse proxy server that receives maintenance requests sent by the bastion host.

[0077] In one possible implementation, to ensure the security of the communication process, the reverse proxy server will use the public key corresponding to this reverse proxy agent to encrypt the operation and maintenance request. Therefore, after receiving the encrypted operation and maintenance request sent by the receiving reverse proxy server, this reverse proxy agent will use its own private key to decrypt the encrypted operation and maintenance request, obtain the decrypted operation and maintenance request, and determine the target port number carried in the operation and maintenance request.

[0078] S502: Based on the saved mapping between the reverse proxy server port number, the internal network host address and port number, determine the target internal network host address and the target internal network host port number corresponding to the target port number.

[0079] Since each reverse proxy agent stores configuration information for its own proxy policies, including the mapping between the reverse proxy server port number, the address of the internal host, and the port number, in order to determine the target proxy policy corresponding to the target port number, the reverse proxy agent determines the target internal host address and the target internal host port number based on the mapping between the reverse proxy server port number, the address of the internal host, and the port number stored in its own database.

[0080] S503: Based on the target internal network host address and the target internal network host port number, forward the operation and maintenance request to the target internal network host.

[0081] After determining the target internal network host address and the target internal network host port number, the reverse proxy agent forwards the maintenance request to the target internal network host corresponding to the target internal network host address, so that the target internal network host receives the maintenance request through the port corresponding to the target internal network host port number.

[0082] It is understandable that, since both the reverse proxy agent and the target internal network host are deployed in an internal network environment, there is no risk of exposure when the reverse proxy agent forwards maintenance requests to the target internal network host. The maintenance requests can be encrypted or not, and no specific restrictions are imposed here.

[0083] Upon receiving an operation and maintenance request, the target internal network host can perform relevant operation and maintenance operations based on the request. The operation and maintenance result, along with the target port number, is encapsulated in an operation and maintenance response message and returned to the reverse proxy agent. Upon receiving this response message, the reverse proxy agent encrypts it using its stored public key and forwards it to the reverse proxy server. The reverse proxy server, upon receiving the encrypted response message, decrypts it using its stored private key, determines the target port number carried in the response message, and forwards the response message to the bastion host via the port corresponding to that target port number. The bastion host then receives the response message and determines the operation and maintenance result.

[0084] In this embodiment, internal network assets are hidden under normal circumstances, access control is refined, and in extreme cases (when some components are compromised), the damage radius of security incidents can be effectively contained, thereby improving the overall security and reliability.

[0085] Example 8: Based on the above embodiments, in this embodiment of the application, before receiving the maintenance request sent by the reverse proxy server, the method further includes: Receive the second configuration sent by the reverse proxy server to the reverse proxy agent, which carries the port number of the candidate reverse proxy server and the address and port number of the internal network host to be proxied; Save the port numbers of candidate reverse proxy servers and the mapping between the addresses and port numbers of the internal network hosts to be proxied.

[0086] In this embodiment of the application, during the proxy policy configuration stage, the reverse proxy agent receives a second configuration sent by the reverse proxy server, which carries the port number of the candidate reverse proxy server and the address and port number of the internal network host to be proxied. The agent parses the second configuration to determine the port number of the candidate reverse proxy server and the address and port number of the internal network host to be proxied.

[0087] In one possible implementation, to reduce the risk of leakage of real information of internal network hosts, the reverse proxy server encrypts the second configuration when sending it to the reverse proxy agent. After receiving the encrypted second configuration, the reverse proxy agent decrypts it using its own private key and determines the candidate reverse proxy server port number, the address and port number of the internal network host to be proxied, and the address of the reverse proxy agent carried in the second configuration.

[0088] This reverse proxy agent stores the port numbers of candidate reverse proxy servers and the mapping between the addresses and port numbers of the internal network hosts to be proxied. This facilitates the determination of the actual internal network hosts that need to be maintained during subsequent operation and maintenance based on the information configured during the proxy policy configuration phase and the target port number of the reverse proxy server carried in the request message.

[0089] Example 9: To further enhance network security, based on the above embodiments, in this embodiment, before receiving the maintenance request sent by the reverse proxy server, the following method is also included: Based on the port number of the preset first port of the saved reverse proxy server, send a set sequence of UDP knock packets to the reverse proxy server; Receive authorization prompt information sent by the reverse proxy server through the preset second port; and send a connection request to the reverse proxy server based on the preset second port of the reverse proxy server; Receive the server certificate returned by the reverse proxy server, authenticate the reverse proxy server, and if the authentication is successful, send the client certificate to the reverse proxy server. Receive the connection response sent by the reverse proxy server through the preset second port and establish a connection with the reverse proxy server.

[0090] In this embodiment of the application, the reverse proxy agent stores the IP address and specified port number of the reverse proxy server; wherein the specified port number includes, but is not limited to, the port number of a preset first port and the port number of a preset second port.

[0091] In order to establish a connection with the reverse proxy server, the reverse proxy agent will send a set sequence of UDP knock packets to the reverse proxy server based on the port number of the default first port of the reverse proxy server stored by itself, so that the default first port of the reverse proxy server can receive the set sequence of UDP knock packets.

[0092] After receiving the authorization prompt message sent by the reverse proxy server through the preset second port after the initial verification of this reverse proxy agent is passed, it is determined that the reverse proxy server has temporarily opened the preset second port to the reverse proxy agent. Therefore, in order to establish a connection session with the reverse proxy server, a connection request is sent to the reverse proxy server based on the saved preset second port of the reverse proxy server, so that the reverse proxy server receives the connection request through the preset second port.

[0093] It is understood that, in order for the reverse proxy agent to access the IP address and the preset second port of the reverse proxy server, in this embodiment of the application, the firewall set up on the intranet egress side will allow the IP address and the port number of the preset second port of the reverse proxy server to pass through, thereby ensuring that the reverse proxy agent can communicate with the preset second port of the reverse proxy server.

[0094] Since the reverse proxy server returns a server certificate to this reverse proxy agent after receiving a connection request through the preset second port, this reverse proxy agent receives the server certificate returned by the reverse proxy server and uses it to authenticate the reverse proxy server. If the authentication is successful, the agent returns the client certificate corresponding to itself to the reverse proxy server through the preset second port, enabling the reverse proxy server to authenticate the agent. If the authentication fails, the agent sends a connection failure message to the reverse proxy server through the preset second port.

[0095] After returning the client certificate corresponding to this reverse proxy agent to the reverse proxy server, if a connection response is received from the reverse proxy server through the preset second port, it is determined that a connection has been successfully established with the reverse proxy server.

[0096] Since the server certificate contains the public key of the reverse proxy server, this reverse proxy agent will save the public key corresponding to the reverse proxy server after confirming that the reverse proxy server has been verified. This will facilitate the subsequent forwarding of maintenance response messages to the reverse proxy server, and ensure that the information in the maintenance response messages is not leaked, thereby improving communication security.

[0097] In this embodiment of the application, based on zero-trust technology, UDP knock packets are used to ensure that the cloud host does not need to be exposed to the public network normally, thereby further improving network security.

[0098] Example 10: Based on the above embodiments, in this embodiment of the application, before receiving the maintenance request sent by the reverse proxy server, the method further includes: Receive notification information sent by the reverse proxy server through the preset second port; Returns a response message to the reverse proxy server, carrying the port number of the target reverse proxy agent.

[0099] Since the port in the reverse proxy agent that establishes a connection with the reverse proxy server through the preset second port is only used to listen for heartbeat packets or receive notification information from the reverse proxy server and does not perform actual data forwarding, in order to provide the reverse proxy server with the port in this reverse proxy agent that actually receives data, after receiving the notification information sent by the reverse proxy server through the preset second port, this reverse proxy agent will encapsulate the target reverse proxy agent port number corresponding to the port in this reverse proxy agent used to establish a data channel with the reverse proxy server into the response information and return the response information to the reverse proxy server. This enables the reverse proxy server to establish a data channel between the reverse proxy server and this reverse proxy agent based on the port corresponding to the target reverse proxy agent port number.

[0100] The above embodiments are described below with a specific example. See [link to example]. Figure 6 The diagram illustrates the intranet host operation and maintenance process, including the following steps: Step 1: The reverse proxy agent sends a UDP knock packet to the reverse proxy server.

[0101] Step two: The reverse proxy server opens a preset second port within a set time period. That is... Figure 6 The image shows a brief opening of a TCP port.

[0102] Step 3: The reverse proxy agent sends a login authentication request to the server with the client's certificate. Once the login authentication is successful, a TCP connection is established.

[0103] Steps one through three involve the reverse proxy agent and the reverse proxy server performing login authentication.

[0104] Step 4: External users access the internal network host by entering the target port number 30001 of the reverse proxy server.

[0105] In other words, an external user uses a device to send the target port number of the reverse proxy server corresponding to the internal network host that they need to access to the bastion host.

[0106] Step 5: The bastion host accesses the reverse proxy server_ip:30001 (i.e., accesses port 30001 of the reverse proxy server) to confirm the establishment of TCP connection 2.

[0107] Step 6: The reverse proxy server sends a notification message to the reverse proxy agent through control channel TCP connection 1.

[0108] Step 7: Initiate a new data channel connection between the reverse proxy agent and the reverse proxy server; this is TCP connection 3. Also, confirm that TCP connection 3 is associated with port 3389 of the internal network host.

[0109] Step 8: Bridge the user connection and data channel, i.e., bridge TCP connection 2 and TCP connection 3.

[0110] Step 9: Based on the saved proxy policy configuration, determine that the host port number corresponding to port 30001 of the reverse proxy server is 3389, and send a request to port 3389 of the host to establish TCP 4.

[0111] The proxy policy configuration stores the mapping between the reverse proxy server port number, the address of the internal host, and the port number.

[0112] Step 10: Bridge the TCP connection and data channel of the intranet host, namely TCP4 and TCP connection 3.

[0113] The above method enables bidirectional forwarding: 1. User traffic → reverse proxy server: 30001 → data channel → reverse proxy agent → internal network host: 3389; 2. Internal network host response → reverse proxy agent → data channel → reverse proxy server → user.

[0114] Additionally, it is understood that the proxy policy configuration process is not shown in the above procedure. This configuration process occurs after step three and before step four, i.e., after login authentication and before actual operation and maintenance. The specific proxy policy configuration process can be found in the above embodiments and will not be repeated here.

[0115] Example 11: Based on the same technical concept and the above embodiments, this application provides an intranet host operation and maintenance device applied to a reverse proxy server, such as... Figure 7 As shown, the device includes: The first receiving module 701 is used to receive the operation and maintenance request sent by the bastion host and determine the target port number of the reverse proxy server to receive the operation and maintenance request carried in the operation and maintenance request. The first processing module 702 is used to determine the target reverse proxy agent corresponding to the target port number based on the stored correspondence between the reverse proxy server port number and the reverse proxy agent identifier. The first forwarding module 703 is used to forward maintenance requests to the target reverse proxy agent.

[0116] In one possible implementation, the device further includes a first configuration module 704, configured to receive a first configuration request before receiving an operation and maintenance request sent by the bastion host. The first configuration request carries a reverse proxy agent identifier to be configured, the address and port number of the internal network host to be proxied; determine a candidate reverse proxy server port number to be assigned to the address and port number; save the correspondence between the candidate reverse proxy server port number and the reverse proxy agent identifier to be configured; and send a second configuration carrying the candidate reverse proxy server port number and the address and port number of the internal network host to be proxied to the reverse proxy agent to be configured.

[0117] In one possible implementation, the device further includes a first login module 705, which, before receiving an operation and maintenance request sent by the bastion host, if it is determined that a set sequence UDP knock packet sent by the reverse proxy agent to be connected has been received through a preset first port, updates the status of a preset second port to open, and sends an authorization prompt message to the reverse proxy agent to be connected through the preset second port; receives a connection request sent by the reverse proxy agent to be connected, sends a server certificate to the reverse proxy agent to be connected, receives a client certificate returned by the reverse proxy agent to be connected, authenticates the reverse proxy agent to be connected based on the client certificate, and if the authentication is successful, establishes a connection with the reverse proxy agent to be connected through the preset second port.

[0118] In one possible implementation, the first login module 705 is further configured to update the status of the preset second port to closed after recognizing that the preset second port has been open for a set period of time; and to determine the connection status between the preset second port and the reverse proxy agent to be connected to as a keep-alive state.

[0119] In one possible implementation, the first processing module 702 is further configured to, after determining the target reverse proxy agent corresponding to the target port number, send notification information to the target reverse proxy agent through a preset second port before forwarding the operation and maintenance request to the target reverse proxy agent, and receive response information returned by the target reverse proxy agent carrying the target reverse proxy agent port number; The first forwarding module 703 is specifically used to forward maintenance requests to the target reverse proxy agent based on the target reverse proxy agent port number carried in the response information.

[0120] In one possible implementation, the first configuration module 704 is further configured to, after receiving a first configuration request sent by any reverse proxy agent, determine whether a connection has been established with the reverse proxy agent to be configured; if so, continue to execute the step of determining the candidate reverse proxy server port number assigned to the address and port number.

[0121] Example 12: Based on the same technical concept and the above embodiments, this application provides an intranet host operation and maintenance device applied to a reverse proxy agent, such as... Figure 8 As shown, the device includes: The second receiving module 801 is used to receive the operation and maintenance request sent by the reverse proxy server and determine the target port number of the reverse proxy server carried in the operation and maintenance request. The second processing module 802 is used to determine the target internal network host address and the target internal network host port number corresponding to the target port number based on the saved mapping relationship between the reverse proxy server port number and the internal network host address and port number. The second forwarding module 803 is used to forward maintenance requests to the target internal network host based on the target internal network host address and the target internal network host port number.

[0122] In one possible implementation, the device further includes a second configuration module 804, which is used to receive a second configuration sent by the reverse proxy server to the reverse proxy agent before receiving the operation and maintenance request sent by the reverse proxy server; and to save the correspondence between the candidate reverse proxy server port number and the address and port number of the internal network host to be proxied.

[0123] In one possible implementation, the device further includes a second login module 805, configured to: send a predefined sequence UDP knock packet to the reverse proxy server based on the port number of a preset first port of the reverse proxy server before receiving an operation and maintenance request from the reverse proxy server; receive an authorization prompt message sent by the reverse proxy server through a preset second port; send a connection request to the reverse proxy server based on the preset second port of the reverse proxy server; receive the server certificate returned by the reverse proxy server, authenticate the reverse proxy server, and if the authentication is successful, send a client certificate to the reverse proxy server; and receive a connection response sent by the reverse proxy server through the preset second port to establish a connection with the reverse proxy server.

[0124] In one possible implementation, the second processing module 802 is further configured to receive notification information sent by the reverse proxy server through a preset second port before receiving the maintenance request sent by the reverse proxy server; and return response information carrying the target reverse proxy agent port number to the reverse proxy server.

[0125] Example 13: Based on the same technical concept, this application also provides an electronic device. Figure 9 This application provides a schematic diagram of an electronic device structure, such as... Figure 9 As shown, it includes: processor 901, communication interface 902, memory 903 and communication bus 904, wherein processor 901, communication interface 902 and memory 903 communicate with each other through communication bus 904. In one embodiment, the electronic device is the first device described above, and the memory 903 stores a computer program. When the program is executed by the processor 901, the processor 901 executes any of the above embodiments of intranet host operation and maintenance applied to the reverse proxy server.

[0126] In yet another embodiment, the electronic device is the second device described above, and the memory 903 stores a computer program. When the program is executed by the processor 901, the processor 901 executes any of the above embodiments of intranet host operation and maintenance applied to the reverse proxy agent.

[0127] The communication bus mentioned in the above-mentioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. The communication interface 902 is used for communication between the above-mentioned electronic device and other devices. The memory can include random access memory (RAM), or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor. The aforementioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processing unit (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0128] Based on the same technical concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by an electronic device. When the program is run on the electronic device, it causes the electronic device to implement any of the above-mentioned embodiments for intranet host operation and maintenance applied to a reverse proxy server, or to implement any of the above-mentioned embodiments for intranet host operation and maintenance applied to a reverse proxy agent.

[0129] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in an electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs), etc.

[0130] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0132] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0133] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0134] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for operating and maintaining an intranet host, characterized in that, A reverse proxy server deployed on the public network is provided, wherein the reverse proxy server is connected to a bastion host on the public network and any reverse proxy client agent on the internal network. The method includes: Receive the maintenance request sent by the bastion host and determine the target port number of the reverse proxy server that receives the maintenance request carried in the maintenance request; Based on the saved correspondence between the reverse proxy server port number and the reverse proxy agent identifier, determine the target reverse proxy agent corresponding to the target port number; The maintenance request is forwarded to the target reverse proxy agent.

2. The method according to claim 1, characterized in that, Before receiving the maintenance request sent by the bastion host, the process also includes: Receive a first configuration request, which carries the reverse proxy agent identifier to be configured, the address and port number of the internal network host to be proxied; Determine the candidate reverse proxy server port number to be assigned to the address and port number; save the correspondence between the candidate reverse proxy server port number and the reverse proxy agent identifier to be configured; The second configuration, which carries the candidate reverse proxy server port number and the address and port number of the intranet host to be proxied, is sent to the reverse proxy agent to be configured.

3. The method according to claim 1, characterized in that, Before receiving the maintenance request sent by the bastion host, the process also includes: If it is determined that a UDP knock packet with a set sequence is received from the reverse proxy agent to be connected through the preset first port, the status of the preset second port is updated to open, and an authorization prompt message is sent to the reverse proxy agent to be connected through the preset second port; The system receives a connection request sent by the reverse proxy agent to be connected, sends a server certificate to the reverse proxy agent to be connected, receives a client certificate returned by the reverse proxy agent to be connected, authenticates the reverse proxy agent to be connected based on the client certificate, and if the authentication is successful, establishes a connection with the reverse proxy agent to be connected through the preset second port.

4. The method according to claim 3, characterized in that, The method further includes: If the preset second port is detected to be open for a set period of time, the status of the preset second port will be updated to closed; and the connection status between the preset second port and the reverse proxy agent to be connected will be determined to be keep-alive.

5. The method according to claim 3 or 4, characterized in that, After determining the target reverse proxy agent corresponding to the target port number, and before forwarding the operation and maintenance request to the target reverse proxy agent, the method further includes: The system sends a notification message to the target reverse proxy agent through the preset second port and receives a response message from the target reverse proxy agent carrying the target reverse proxy agent port number. The step of forwarding the maintenance request to the target reverse proxy agent includes: Based on the target reverse proxy agent port number carried in the response information, the operation and maintenance request is forwarded to the target reverse proxy agent.

6. The method according to claim 2 or 4, characterized in that, After receiving the first configuration request sent by any reverse proxy agent, the process further includes: Determine whether a connection has been established with the reverse proxy agent to be configured. If so, continue with the step of determining the candidate reverse proxy server port number to be assigned to the address and port number.

7. A method for operating and maintaining an intranet host, characterized in that, The method is applied to any reverse proxy client agent deployed on an intranet, wherein the reverse proxy agent connects to a reverse proxy server on the public network and at least one intranet host, and includes: Receive the maintenance request sent by the reverse proxy server and determine the target port number of the reverse proxy server carried in the maintenance request; Based on the saved mapping between the reverse proxy server port number, the address and port number of the internal network host, the target internal network host address and the target internal network host port number corresponding to the target port number are determined. Based on the target intranet host address and the target intranet host port number, the maintenance request is forwarded to the target intranet host.

8. The method according to claim 7, characterized in that, Before receiving the maintenance request sent by the reverse proxy server, the process also includes: Receive the second configuration sent by the reverse proxy server to the reverse proxy agent, which carries the port number of the candidate reverse proxy server and the address and port number of the internal network host to be proxied; Save the correspondence between the port number of the candidate reverse proxy server and the address and port number of the intranet host to be proxied.

9. The method according to claim 7, characterized in that, Before receiving the maintenance request sent by the reverse proxy server, the process also includes: Based on the port number of the preset first port of the saved reverse proxy server, send a set sequence of UDP knock packets to the reverse proxy server; Receive authorization prompt information sent by the reverse proxy server through a preset second port; and send a connection request to the reverse proxy server based on the preset second port of the reverse proxy server; Receive the server certificate returned by the reverse proxy server, authenticate the reverse proxy server, and if the authentication is successful, send the client certificate to the reverse proxy server. Receive the connection response sent by the reverse proxy server through the preset second port, and establish a connection with the reverse proxy server.

10. The method according to claim 9, characterized in that, Before receiving the maintenance request sent by the reverse proxy server, the process also includes: Receive notification information sent by the reverse proxy server through the preset second port; Return a response message carrying the target reverse proxy agent port number to the reverse proxy server.

Images