SaaS platform and local service security communication method and system without public network IP

Abstract

The invention relates to the technical field of secure communication between a cloud SaaS service and a local tenant service, in particular to a secure communication method and system for an SaaS platform and a local service without a public network IP, the method comprises the SaaS service of the cloud SaaS platform and the local service of a tenant end, and the method comprises the following steps: adding a cloud communication transmission unit on the cloud SaaS platform; and adding a local end communication transmission unit at a tenant end, and on this basis, the method comprises the following steps: S1, sending an HTTP request by SaaS service; s2, after receiving the HTTP request of the SaaS service, the cloud communication transmission unit packages and forwards the HTTP request; s3, the local end communication transmission unit calls a local service interface in an HTTP (Hyper Text Transport Protocol) mode after decapsulation; s4, the local service returns an HTTP response to the local end communication transmission unit; and S5, the cloud communication transmission unit obtains the response result and returns the response result to the SaaS service. The method does not need to depend on a public network IP, the network configuration cost is effectively reduced, and the safety and usability are improved.

Description

A method and system for secure communication between a SaaS platform and local services without requiring a public IP address. Technical Field

[0001] This invention relates to the field of secure communication technology between cloud-based SaaS services and local tenant services, specifically to a method and system for secure communication between a SaaS platform and local services without requiring a public IP address. Background Technology

[0002] In the internet industry, when cloud-based SaaS services need to call interfaces deployed locally on the tenant's end, traditional HTTP communication methods typically require customers to have a public IP address or domain name to support external access. This not only increases network configuration costs and operational burdens but also places higher demands on system security and stability. Summary of the Invention

[0003] To address the technical challenge of traditional HTTP communication methods requiring customers to have a public IP address or domain name when cloud-based SaaS services need to call interfaces deployed locally on the tenant's end, this invention provides a secure communication method and system between a SaaS platform and local services that does not require a public IP address. This method effectively reduces network configuration costs and improves security and ease of use by eliminating the need for a public IP address.

[0004] The technical solution adopted in this invention is to provide a secure communication method between a SaaS platform and a local service without requiring a public IP address. This method includes a SaaS service on a cloud-based SaaS platform and a local service on the tenant's end. The secure communication method includes adding a cloud communication transmission unit to the cloud-based SaaS platform and adding a local communication transmission unit on the tenant's end. Based on this, the method includes the following steps:

[0005] S1 and SaaS services send HTTP requests;

[0006] S2, after receiving the HTTP request from the SaaS service, the cloud communication transmission unit encapsulates it into message queue data and forwards it;

[0007] S3. The local end communication transmission unit subscribes to messages from the cloud communication transmission unit. The local end communication transmission unit obtains message queue data containing HTTP requests, decapsulates it, and calls the local service interface in HTTP mode.

[0008] S4. The local service returns an HTTP response to the local communication transmission unit, which encapsulates the response result into message queue data and forwards it.

[0009] S5, the cloud communication transmission unit subscribes to messages from the local communication transmission unit, obtains message queue data containing response results, and returns it to the SaaS service after unblocking.

[0010] It also includes defining a unified message queue transmission topic and data structure.

[0011] It also includes setting up a data security transmission mechanism.

[0012] A system for secure communication between a SaaS platform and local services without requiring a public IP address includes a cloud-based SaaS platform, a cloud-based communication transmission module, a local communication transmission module, and a tenant-side local service module.

[0013] The cloud-based SaaS platform is used to provide SaaS services;

[0014] The cloud communication transmission module is used to encapsulate the HTTP requests sent by the SaaS service into message queue data and forward them, and to receive the messages responded by the local communication transmission module through subscription, and return them to the SaaS service after decapsulation.

[0015] The local communication transmission module is used to receive message queue data generated by the cloud communication transmission module through subscription, and after decapsulation, call the tenant-side local service module interface. After receiving the response result from the tenant-side local service module, the response result is encapsulated into message queue data and returned to the cloud communication transmission module.

[0016] The tenant-side local service module is used to respond to the call request from the local communication transmission module and return the response result.

[0017] The beneficial effects of this invention are that it provides a secure communication method and system between a SaaS platform and local services without the need for a public IP address. By adding a cloud communication transmission unit and a local communication transmission unit, it enables HTTP communication between SaaS services and tenant-side local services without relying on a public IP address, effectively reducing network configuration costs and further improving security and ease of use. Attached Figure Description

[0018] Figure 1 is a flowchart of the method of the present invention;

[0019] Figure 2 is a system block diagram of the present invention. Detailed Implementation

[0020] As shown in Figure 1, this invention provides a secure communication method between a SaaS platform and a local service without requiring a public IP address. The method includes a SaaS service on a cloud-based SaaS platform and a local service on the tenant's end. The secure communication method includes adding a cloud communication transmission unit to the cloud-based SaaS platform and adding a local communication transmission unit on the tenant's end; defining a unified message queue transmission topic and data structure to ensure the standardization and efficiency of data transmission; and setting a data security transmission mechanism to ensure the confidentiality and integrity of data during communication.

[0021] Based on this, the following steps are included:

[0022] S1 and SaaS services send HTTP requests;

[0023] S2, after receiving the HTTP request from the SaaS service, the cloud communication transmission unit encapsulates it into message queue data and forwards it;

[0024] S3. The local end communication transmission unit subscribes to messages from the cloud communication transmission unit. The local end communication transmission unit obtains message queue data containing HTTP requests, decapsulates it, and calls the local service interface in HTTP mode.

[0025] S4. The local service returns an HTTP response to the local communication transmission unit, which encapsulates the response result into message queue data and forwards it.

[0026] S5, the cloud communication transmission unit subscribes to messages from the local communication transmission unit, obtains message queue data containing response results, and returns it to the SaaS service after unblocking.

[0027] A cloud communication transmission unit is a set of instructions that can be recognized and executed by a computer. It is written in a programming language and has the functions of request brokering, message encapsulation, message publishing, and response subscription and return.

[0028] Request Proxy: Receives standard HTTP requests from the SaaS business logic layer, but does not directly initiate connections to the tenant's local network.

[0029] Message encapsulation: Serializes standard HTTP requests into a structured message format and adds metadata such as tenant identifier and request ID; standard HTTP requests include method, URL path, header, and body, and message formats include JSON or Protobuf.

[0030] Message publishing: Publishes the encapsulated standard HTTP request message to a tenant-isolated message queue topic, such as EMQX.

[0031] Response Subscription and Return: Simultaneously subscribe to the response topic of the corresponding tenant. Once the response message returned by the local end is received, it is deserialized and unencapsulated, and the HTTP response body, status code, etc. are restored and returned to the original SaaS service caller.

[0032] The local communication transmission unit is a set of instructions that can be recognized and executed by a computer. It is written in a programming language and has the functions of actively connecting to the cloud message queue, message subscription, local call, response encapsulation and return.

[0033] Actively connect to cloud message queues: This unit actively initiates connections to cloud-based message queue services, such as EMQX, thereby establishing a communication channel from the intranet to the cloud.

[0034] Message Subscription: Subscribe to a dedicated request topic belonging to this tenant and listen for encapsulated HTTP request messages from the cloud.

[0035] Local call: After receiving the message, the original HTTP request content is parsed and the tenant's own local service interface is called in the local network in the manner of a standard HTTP client.

[0036] Response encapsulation and postback: The HTTP response returned by the local service is encapsulated again into a message format, and the response message is published to the specified response topic on the cloud side through the established outbound connection.

[0037] For message queue definitions, please refer to Tables 1, 2, and 3 below:

[0038] Table 1 Message Queue Transmission Topics

[0039] Topic Publisher Subscribers Notes dashpay / [tenant] / edge Penetration Program - Cloud Penetration Program - Edge End dashpay / [tenant] / edge / response Penetration Program - Edge Penetration Program - Cloud dashpay / [tenant] / file / edge Penetration Program - Edge Penetration Program - Cloud File Transfer dashpay / [tenant] / file / edge / response Penetration Program - Cloud Penetration Program - Edge File Transfer surface

[0040] Table 2 Message Queue Transmission Presentation Layer Definition

[0041] Parameter Type | Required | Description payload (string): HTTP packet data (encrypted string) url (string): Request URL id (string): Message ID tenantCode (string): Tenant ID timestamp (string): Timestamp (milliseconds) sign (string): Data signature version (string): Version, currently defaults to v1.0 surface

[0042] Table 3 Plaintext Data Structure of Payload in Message Queue Transport Layer

[0043] Parameter Type | Required | Description url (string) | Relative URL path method (string) | HTTP request method: POST, GET headers (string) | HTTP request headers (JSON string of the field) body (string) | HTTP request body extensions (string) | Extensions, optional surface

[0044] Data security transmission mechanism: The same symmetric key is configured on both the penetration program-cloud and penetration program-edge terminals. One key corresponds to one tenant terminal. The payload is encrypted with AES, the digest (hash) is SHA256, and the digital signature sign=SHA256(secretKey+payload+tenantCode+timestamp).

[0045] This invention also provides a system for secure communication between a SaaS platform and a local service without the need for a public IP address, comprising a cloud-based SaaS platform, a cloud-based communication transmission module, a local communication transmission module, and a tenant-side local service module;

[0046] The cloud-based SaaS platform is used to provide SaaS services; the cloud-based communication transmission module is used to encapsulate HTTP requests sent by the SaaS service into message queue data and forward them, and to receive messages from the local communication transmission module via subscription, and return them to the SaaS service after decapsulation; the local communication transmission module is used to receive message queue data from the cloud-based communication transmission module via subscription, and after decapsulation, call the tenant-side local service module interface, and after receiving the response result from the tenant-side local service module, encapsulate the response result into message queue data and return it to the cloud-based communication transmission module; the tenant-side local service module is used to respond to the call request from the local communication transmission module and return the response result.

Claims

1. A method for secure communication between a SaaS platform and a local service without requiring a public IP address, comprising a SaaS service on a cloud-based SaaS platform and a local service on the tenant's end, characterized in that: The secure communication method includes adding a cloud communication transmission unit to the cloud-based SaaS platform and a local communication transmission unit to the tenant's end. Based on this, it includes the following steps: S1, the SaaS service sends an HTTP request; S2, after receiving the HTTP request from the SaaS service, the cloud communication transmission unit encapsulates it into message queue data and forwards it; S3, the local communication transmission unit subscribes to messages from the cloud communication transmission unit, obtains the message queue data containing the HTTP request, decapsulates it, and calls the local service interface via HTTP; S4, the local service returns an HTTP response to the local communication transmission unit, and the local communication transmission unit encapsulates the response result into message queue data and forwards it; S5, the cloud communication transmission unit subscribes to messages from the local communication transmission unit, obtains the message queue data containing the response result, and returns it to the SaaS service after decapsulation.

2. The method for secure communication between a SaaS platform and a local service without requiring a public IP address, as described in claim 1, is characterized in that: It also includes defining a unified message queue transmission topic and data structure.

3. The method for secure communication between a SaaS platform and a local service without requiring a public IP address, as described in claim 1, is characterized in that: It also includes setting up a data security transmission mechanism.

4. A system for secure communication between a SaaS platform and a local service without requiring a public IP address, as described in claims 1-3, characterized in that: The system includes a cloud-based SaaS platform, a cloud-based communication and transmission module, a local communication and transmission module, and a tenant-side local service module. The cloud-based SaaS platform provides SaaS services. The cloud-based communication and transmission module encapsulates HTTP requests from the SaaS service into message queue data and forwards them. It also receives messages from the local communication and transmission module via subscription and returns them to the SaaS service after decapsulation. The local communication and transmission module receives message queue data from the cloud-based communication and transmission module via subscription, calls the tenant-side local service module interface after decapsulation, and encapsulates the response from the tenant-side local service module into message queue data and returns it to the cloud-based communication and transmission module. The tenant-side local service module responds to calls from the local communication and transmission module and returns response results.

Images