Service request processing method and device for realizing network penetration

Abstract

The invention provides a service request processing method and device for realizing network penetration, and relates to the technical field of data transmission, and the method comprises the steps: obtaining a service request of an Internet terminal; sending the service request to a firewall for preprocessing, and forwarding the service request to a front-end server for judgment based on the preprocessed service request and a first gateway to obtain a judgment result about whether a back-end server needs to be called for interaction; if the judgment result is that a back-end server needs to be called for interaction, sequentially sending a preset authorization certificate and the service request to a second gateway for processing, and forwarding the authorization certificate and the service request to a security platform for authentication through the second gateway to obtain an authenticated service request; and sending the authenticated service request to a third gateway, and sending the authenticated service request to a back-end server through the third gateway for service request processing to obtain a service request processing result. According to the invention, the operation and maintenance cost and resource waste are reduced, and unauthorized external access and potential data leakage risks are prevented.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and more specifically, to a method and apparatus for processing service requests to achieve network traversal. Background Technology

[0002] In some typical industries and enterprises, to prevent unauthorized external access and potential data breaches, and to ensure data security, independent office networks are usually established. These office networks are isolated from the external internet, and direct data exchange and access requests are not permitted. Due to network constraints, application systems requiring high data security are typically deployed privately on the office network. However, in practice, various application systems need to meet the needs of users in different network environments, both internal and external. Therefore, how to achieve seamless interaction and unrestricted access between application systems on internal and external networks while ensuring security has become a pressing issue.

[0003] Currently, in environments with isolated internal and external networks, to meet users' access needs, most business systems adopt a separate deployment for internal and external networks. This means that a separate set of project services, including front-end services, back-end services, and databases, is deployed in the internal and external network environments, with data synchronized between the two via the database. This deployment method has high maintenance costs, redundant deployments lead to resource waste, and database synchronization consumes significant manpower. Furthermore, project deployment and database storage in the external network environment pose certain security risks. Summary of the Invention

[0004] The purpose of this invention is to provide a method and apparatus for processing service requests to achieve network traversal, thereby improving the aforementioned problems. To achieve the above objective, the technical solution adopted by this invention is as follows:

[0005] Firstly, this application provides a method for processing service requests to achieve network traversal, including:

[0006] Obtain the service request from the Internet terminal, wherein the service request includes service request content information, request type information, and request target address information;

[0007] The service request is sent to the firewall for preprocessing, and based on the preprocessed service request and the first gateway, it is forwarded to the front-end server for judgment to obtain a judgment result on whether it is necessary to call the back-end server for interaction.

[0008] If the determination result indicates that an interaction with the backend server is required, the preset authorization credentials and the business request are sent sequentially to the second gateway for processing, and then forwarded to the security platform for authentication through the second gateway to obtain the authenticated business request;

[0009] The authenticated business request is sent to a third gateway, and then sent to a backend server for business request processing to obtain the business request processing result.

[0010] Secondly, this application also provides a service request processing apparatus for implementing network traversal, comprising:

[0011] The acquisition unit is used to acquire the service request of the Internet terminal, wherein the service request includes service request content information, request type information and request target address information;

[0012] The processing unit is used to send the service request to the firewall for preprocessing, and forward it to the front-end server based on the preprocessed service request and the first gateway to determine whether it is necessary to call the back-end server for interaction.

[0013] The authentication unit is used to send the preset authorization credentials and the business request to the second gateway for processing in sequence if the judgment result indicates that the backend server needs to be called for interaction, and then forward the request to the security platform for authentication through the second gateway to obtain the authenticated business request.

[0014] The forwarding unit is used to send the authenticated business request to the third gateway, and then send it to the backend server through the third gateway for business request processing to obtain the business request processing result.

[0015] The beneficial effects of this invention are as follows:

[0016] This invention adopts a front-end and back-end separation deployment. The core business such as back-end applications and databases are deployed on the intranet, while the front-end static files are deployed on the intranet and the extranet respectively, avoiding duplicate deployment and reducing operation and maintenance costs and resource waste.

[0017] This invention enables unified access to internal and external networks through proxy services and dynamic token authentication, eliminating the need for database data synchronization, thus reducing manpower investment. Relying on proxy services and dynamic token authentication, it achieves internal and external network interaction of application systems while ensuring security, meeting the usage needs of users in different network environments.

[0018] This invention deploys core business operations in an intranet environment, while only front-end static files are deployed on the external network. It also relies on proxy services and dynamic token authentication for access control, effectively preventing unauthorized external access and potential data leakage risks, thus enhancing system security.

[0019] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the service request processing method for network traversal as described in an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the service request processing device for network penetration as described in an embodiment of the present invention.

[0023] In the diagram: 701, Acquisition Unit; 702, Processing Unit; 703, Authentication Unit; 704, Forwarding Unit. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0025] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] Example 1:

[0027] This embodiment provides a method for handling service requests to achieve network traversal.

[0028] See Figure 1 The figure shows that the method includes steps S1, S2, S3 and S4.

[0029] Step S1: Obtain the service request from the Internet terminal. The service request includes service request content information, request type information, and request target address information.

[0030] This step first extracts the HTTP Method (GET / POST, etc.) from the message header as request type information, which directly determines the branching logic of subsequent processing paths. Second, it parses the request target address information from the Host and URL paths, where the key business domain names become crucial for service routing. Finally, it extracts the original business content information from the request body, providing a data carrier for subsequent business processing. This invention can adaptively handle different protocol formats, ensuring compatibility with various terminal requests. It lays the data structure foundation for subsequent security detection and business routing, while also providing the initial data source.

[0031] Step S2: Send the service request to the firewall for preprocessing, and forward it to the front-end server based on the preprocessed service request and the first gateway to determine whether it is necessary to call the back-end server for interaction.

[0032] It is understandable that this step eliminates external threats through firewalls, precisely controls intranet access permissions using business-aware decision mechanisms, and finally ensures the confidentiality and integrity of cross-network transmissions through dynamic key technology, establishing a trusted data carrier for subsequent secure network communication. In this step, step S2 includes steps S21, S22, and S23.

[0033] Step S21: Perform traffic parsing and standardization processing based on the business request. Extract the URL, Header, Parameters and Payload information from the business request and perform standardization processing to obtain the standardized business request.

[0034] This step involves accurately extracting URL paths, request header key-value pairs, query string parameters, and request body payloads. Then, it unifies the heterogeneous data processing—including URL parameter normalization (eliminating encoding differences), request header field case normalization, and payload format conversion (converting XML / JSON / form-data to the internal standard JSON format). This achieves a structured transformation of heterogeneous network traffic, converting non-standardized network packets into standard data objects with a unified semantic model. This provides the subsequent security detection engine with structurally consistent and semantically clear processing objects. Simultaneously, data normalization eliminates detection blind spots caused by format differences, significantly improving the accuracy and efficiency of security rule matching.

[0035] Step S22: Perform SQL injection detection, XSS cross-site scripting detection, and preset web attack detection on the standardized business request to obtain the detection results;

[0036] Understandably, this step accurately distinguishes between malicious requests and normal business operations through multi-dimensional attack feature analysis, significantly reducing the false positive rate while maintaining the ability to detect new types of attacks, providing a highly credible basis for threat assessment for subsequent security decisions.

[0037] Step S23: Intercept business requests whose detection results do not meet the preset requirements to obtain preprocessed business requests.

[0038] Understandably, this step minimizes the false positives of legitimate business requests through intelligent interception decisions, while ensuring precise blocking of various attacks, effectively reducing security risks during network traversal. This dynamic interception mechanism not only protects backend business systems from attack interference but also establishes a security defense for the entire network traversal system, ensuring that only compliant traffic can enter subsequent processing flows. This step, following step S23, also includes steps S24, S25, S26, and S27.

[0039] Step S24: Perform load balancing and reverse proxy processing on the preprocessed business requests and the first gateway, and send the load-balanced and reverse-proxyed business requests to the front-end server based on the first gateway;

[0040] It is understandable that this step maximizes the processing capacity of the front-end server cluster through dynamic load balancing, while improving request processing efficiency and system fault tolerance through reverse proxy technology, providing stable and reliable high-performance request delivery services for subsequent business judgment stages. This intelligent scheduling mechanism not only effectively avoids single-point overload but also significantly improves the throughput and availability of the entire system. In this embodiment, the first, second, and third gateways all use Nginx (HTTP and reverse proxy web server) as application gateways for load balancing and reverse proxying. Nginx, acting as a reverse proxy server, receives client requests and forwards them, reducing server load, accelerating response time, and improving application availability and response speed.

[0041] Step S25: Based on the front-end server, identify and judge the business requests after pre-load balancing and reverse proxy processing to obtain the judgment result of whether the business request needs to call the back-end server for interaction;

[0042] Understandably, this step first matches the request path against a pre-defined business rule base to distinguish the servers that need to be called. By accurately differentiating between static resource services and dynamic business processing needs, it effectively reduces the invalid load on backend servers, improves the overall system response efficiency, and ensures that requests requiring business processing are accurately identified and forwarded, establishing a precise traffic filtering mechanism for subsequent network gateway penetration. This intelligent judgment mechanism not only improves resource utilization but also provides differentiated processing path guarantees for requests with different characteristics. In this step, the application's front-end services are deployed on both the intranet and the extranet, while the application's back-end services and database are deployed only in the intranet environment.

[0043] Step S26: If there is no need to call the backend server for interaction, the frontend server identifies, processes, and responds to the business request, and sends the feedback result to the Internet terminal for output.

[0044] Understandably, this step, by identifying and analyzing business requests, allows for direct processing on the front-end server if interaction with the back-end server is not required. This significantly reduces network transmission overhead and back-end load, improves the response speed of static resources and read-only requests, and reduces the frequency of cross-network transmission to mitigate security risks. This localized processing mechanism not only significantly enhances the user experience but also reserves more computing resources for critical back-end business processes.

[0045] Step S3: If the judgment result indicates that it is necessary to call the backend server for interaction, the preset authorization credential and the business request are sent to the second gateway for processing in sequence, and then forwarded to the security platform for authentication through the second gateway to obtain the authenticated business request;

[0046] It is understandable that this step uses multi-dimensional authentication to ensure that only legitimately authorized requests that comply with security standards can obtain secure access credentials to cross network boundaries, establishing a trusted data transmission environment for subsequent network gateway traversal. This authentication mechanism not only prevents unauthorized access by illegal requests but also provides auditable security traceability capabilities for the entire network traversal process. In this step, step S3 includes steps S31 and S32.

[0047] Step S31: Send the preset authorization credential to the security platform for verification and obtain the token information fed back by the security platform;

[0048] It is understood that the network traversal service platform in this step is a Java application. Its function is to periodically access the security platform address, obtain new tokens from the security platform in real time, and send the token information to the second gateway for processing. First, it applies for authorization credentials from the software management department periodically (every 1-5 years). Then, the network traversal service platform periodically (every 10-30 minutes) accesses the security platform carrying the authorization credentials. After the security platform verifies the certificate's validity, it returns a token. The network traversal service platform writes the token information into the Nginx configuration file of the second gateway and sets a restart. When the gateway forwards requests, it adds the latest token to each request (the latest token is added to the cookie in the request header). This way, when a request passes through the security platform, it carries the latest token, preventing expiration issues and allowing the request to be forwarded to the internal network. This security mechanism ensures both the security of credential transmission and real-time updates to the gateway policy, ensuring strict synchronization between security control policies and authentication results.

[0049] Step S32: Send the token information fed back by the security platform to the second gateway for processing. Specifically, the token information is written into the Nginx file of the second gateway to obtain the Nginx file for configuring the token.

[0050] Understandably, this step achieves seamless activation of authentication credentials through a restart mechanism. After restarting, the second gateway uses the updated token rules to security-mark business requests and forwards them to the security platform for authentication and authorization. The security platform performs multi-dimensional verification based on token validity, access permissions, and business policies. Upon successful verification, it authenticates the request and returns the authentication result. This step enables dynamic activation and seamless switching of security authentication rules, ensuring the real-time nature and accuracy of authentication policies and providing continuous and reliable security authentication for subsequent backend business processing.

[0051] Step S4: Send the authenticated business request to the third gateway, and then send it to the backend server through the third gateway for business request processing to obtain the business request processing result.

[0052] Understandably, this step first performs business request parsing on the authenticated request. By parsing the business request content, request type, and target address information, and combining this with the local service discovery component, it determines which backend business cluster (such as a scientific research management system or an expert database system) the request should be routed to. Subsequently, a load balancing decision is executed, selecting the optimal instance from the target cluster based on real-time health check results and server load metrics. This step achieves secure and efficient integration between the authentication request and the backend business system, ensuring that requests are processed quickly and accurately through fine-grained routing and load balancing. In this step, step S4 includes steps S41, S42, and S43.

[0053] Step S41: Parse the authenticated business request to determine the business service address of the backend server that the authenticated business request needs to interact with;

[0054] This step, as we understand it, parses the business request content, request type, and target address information, and combines this with a pre-defined routing rule base to determine the type of backend service the request needs to access. It then obtains a real-time list of all healthy instances of that service type and their metadata (such as version number, load status, and geographical location). This step achieves intelligent discovery and precise location of backend service instances. Dynamic service discovery ensures that requests are always routed to available and suitable backend instances, providing accurate target address information for subsequent load balancing and request forwarding. Simultaneously, business-aware routing decisions improve overall processing efficiency and service quality. This intelligent routing mechanism not only avoids the rigidity of hard-coded addresses but also ensures high availability and business adaptability of service calls.

[0055] Step S42: Based on the third gateway, perform load balancing and backend server access interface selection processing on the service address of the backend server to obtain the access interface of the backend server corresponding to the authenticated service request.

[0056] Understandably, this step utilizes a third-party gateway for load balancing and request forwarding to the selected interfaces, thereby improving system throughput and stability and providing high-performance, highly available service access guarantees for subsequent business processing. This intelligent load balancing mechanism not only maximizes the utilization of cluster resources but also significantly improves the processing efficiency and reliability of business requests.

[0057] Step S43: Based on the access interface of the backend server corresponding to the authenticated business request, forward the authenticated business request to the corresponding backend server for processing to obtain the business request processing result.

[0058] Understandably, after identifying the target access interface, this step efficiently forwards the authenticated business request to the backend server. After the backend server completes its business logic (such as database operations and transaction processing), the gateway receives the processing result through an asynchronous response stream mechanism and automatically performs response data compression and cache marking. This step achieves highly reliable processing and result return of business requests, ultimately generating accurate business processing results and providing a closed-loop output for the entire network traversal process. This reliable transmission mechanism improves overall processing efficiency.

[0059] Example 2:

[0060] like Figure 2 As shown, this embodiment provides a service request processing device for implementing network traversal. See [link to relevant documentation]. Figure 2 The device shown includes an acquisition unit 701, a processing unit 702, an authentication unit 703, and a forwarding unit 704.

[0061] The acquisition unit 701 is used to acquire a service request from an Internet terminal, wherein the service request includes service request content information, request type information, and request target address information.

[0062] The processing unit 702 is used to send the service request to the firewall for preprocessing, and forward it to the front-end server based on the preprocessed service request and the first gateway to obtain a judgment result on whether it is necessary to call the back-end server for interaction.

[0063] The authentication unit 703 is used to send the preset authorization credential and the business request to the second gateway for processing in sequence if the judgment result is that the backend server needs to be called for interaction, and forward the request to the security platform for authentication through the second gateway to obtain the authenticated business request.

[0064] The forwarding unit 704 is used to send the authenticated service request to the third gateway, and then send it to the backend server through the third gateway for service request processing to obtain the service request processing result.

[0065] It should be noted that the specific manner in which each module performs its operation in the apparatus described in the above embodiments has been described in detail in the embodiments of the method, and will not be elaborated here.

[0066] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0067] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for processing service requests to achieve network traversal, characterized in that, include: Obtain the service request from the Internet terminal, wherein the service request includes service request content information, request type information, and request target address information; The service request is sent to the firewall for preprocessing, and based on the preprocessed service request and the first gateway, it is forwarded to the front-end server for judgment to obtain a judgment result on whether it is necessary to call the back-end server for interaction. If the determination result indicates that interaction with the backend server is required, the preset authorization credentials and the business request are sent to the second gateway for processing in sequence, and then forwarded to the security platform for authentication through the second gateway to obtain the authenticated business request; The authenticated business request is sent to a third gateway, and then sent to a backend server for business request processing to obtain the business request processing result.

2. The service request processing method for network traversal according to claim 1, characterized in that... The service request is sent to the firewall for preprocessing, including: Traffic parsing and standardization are performed on the business request. By extracting the URL, Header, Parameters and Payload information from the business request and performing standardization, a standardized business request is obtained. The standardized business requests are then subjected to SQL injection detection, XSS cross-site scripting detection, and preset web attack detection to obtain the detection results. Business requests that do not meet the preset requirements are intercepted, resulting in preprocessed business requests.

3. The service request processing method for network traversal according to claim 1, characterized in that... The service request is sent to the firewall for preprocessing, and then forwarded to the front-end server for judgment based on the preprocessed service request and the first gateway, including: The pre-processed business requests are load-balanced and reverse-proxied with the first gateway, and the load-balanced and reverse-proxied business requests are sent to the front-end server based on the first gateway. Based on the front-end server's identification and judgment of the business requests after pre-load balancing and reverse proxy processing, a judgment result is obtained as to whether the business request needs to call the back-end server for interaction. If no interaction with the backend server is required, the frontend server identifies, processes, and responds to the business request, and then sends the response to the internet terminal for output.

4. The service request processing method for network traversal according to claim 1, characterized in that... If the determination result indicates that interaction with the backend server is required, the preset authorization credentials and the business request are sequentially sent to the second gateway for processing, and then forwarded to the security platform for authentication via the second gateway to obtain the authenticated business request, including: Send the preset authorization credentials to the security platform for verification and receive the token information from the security platform. The token information fed back by the security platform is sent to the second gateway for processing. Specifically, the token information is written into the Nginx file of the second gateway to obtain the Nginx file that configures the token. The second gateway is restarted, and the service request is sent to the restarted second gateway for token configuration. The service request with the configured token is then forwarded to the security platform for authentication to obtain the authenticated service request.

5. The service request processing method for network traversal according to claim 1, characterized in that... The authenticated service request is sent to a third gateway, which then forwards it to a backend server for processing, resulting in a service request processing result, including: The authenticated business request is parsed to determine the business service address of the backend server that the authenticated business request needs to interact with. Based on the third gateway, load balancing and access interface selection of the backend server's service address are performed to obtain the access interface of the backend server corresponding to the authenticated service request. Based on the access interface of the backend server corresponding to the authenticated business request, the authenticated business request is forwarded to the corresponding backend server for processing, and the business request processing result is obtained.

6. A service request processing device for achieving network traversal, characterized in that, include: The acquisition unit is used to acquire the service request of the Internet terminal, wherein the service request includes service request content information, request type information and request target address information; The processing unit is used to send the service request to the firewall for preprocessing, and forward it to the front-end server based on the preprocessed service request and the first gateway to determine whether it is necessary to call the back-end server for interaction. The authentication unit is used to send the preset authorization credentials and the business request to the second gateway for processing in sequence if the judgment result indicates that the backend server needs to be called for interaction, and then forward the request to the security platform for authentication through the second gateway to obtain the authenticated business request. The forwarding unit is used to send the authenticated service request to the third gateway, and then send it to the backend server through the third gateway for service request processing to obtain the service request processing result.

7. The service request processing apparatus for network traversal according to claim 5, characterized in that, The processing unit includes: The first processing subunit is used to perform traffic parsing and standardization processing based on the business request. By extracting the URL, Header, Parameters and Payload information from the business request and performing standardization processing, a standardized business request is obtained. The second processing subunit is used to perform SQL injection detection, XSS cross-site scripting detection, and preset web attack detection on the standardized business request to obtain the detection results; The third processing subunit is used to intercept business requests whose detection results do not meet the preset requirements, and obtain preprocessed business requests.

8. The service request processing apparatus for network traversal according to claim 6, characterized in that, The processing unit further includes: The fourth processing subunit is used to perform load balancing and reverse proxy processing on the pre-processed business requests and the first gateway, and send the load-balanced and reverse-proxyed business requests to the front-end server based on the first gateway. The fifth processing subunit is used to identify and judge the business requests after the pre-load balancing and reverse proxy processing based on the front-end server, and to obtain a judgment result on whether the business request needs to call the back-end server for interaction. The sixth processing subunit is used to identify, process, and provide feedback on the business request through the front-end server if there is no need to call the back-end server for interaction, and then send the feedback result to the Internet terminal for output.

9. The service request processing apparatus for network traversal according to claim 6, characterized in that, The authentication unit includes: The first authentication subunit sends the preset authorization credentials to the security platform for verification and receives the token information from the security platform. The second authentication subunit is used to send the token information fed back by the security platform to the second gateway for processing. The token information is written into the Nginx file of the second gateway to obtain the Nginx file for configuring the token. The third authentication subunit is used to restart the second gateway, send the service request to the restarted second gateway for token configuration, and forward the service request with the configured token to the security platform for authentication to obtain the authenticated service request.

10. The service request processing apparatus for network traversal according to claim 6, characterized in that, The forwarding unit includes: The first forwarding subunit is used to parse the authenticated business request and determine the business service address of the backend server that the authenticated business request needs to interact with. The second forwarding subunit is used to perform load balancing and backend server access interface selection processing on the service address of the backend server based on the third gateway, so as to obtain the access interface of the backend server corresponding to the authenticated service request. The third forwarding subunit is used to forward the authenticated business request to the corresponding backend server for processing based on the access interface of the backend server corresponding to the authenticated business request, and obtain the business request processing result.

Images