Intranet access method and system

Abstract

The present application provides an intranet access method and system. The method comprises: on the basis of preset asymmetric keys and a publish-subscribe mode of a database, each HTTP proxy service deployed on an intranet side and an HTTP forwarding service deployed on an extranet side negotiating to obtain symmetric encryption keys for communication data between each HTTP proxy service and the HTTP forwarding service, wherein each HTTP proxy service is preconfigured with a private key in an asymmetric key pair, and the HTTP forwarding service is preconfigured with public keys corresponding to the private keys of all HTTP proxy services; and on the basis of the publish-subscribe mode of the database and the symmetric encryption keys, the HTTP forwarding service and each HTTP proxy service accessing an intranet HTTP service.

Description

Intranet access method and system Technical Field

[0001] This application relates to the field of secure communication technology, and more particularly to a method and system for accessing an intranet. This application references Chinese Patent Application No. 202410097669.0, filed on January 24, 2024, entitled “Method and System for Accessing an Intranet,” which is incorporated herein by reference in its entirety. Background Art

[0002] Currently, servers that provide HTTP (Hypertext Transfer Protocol) access use public IP addresses to expose ports 80 / 443. When a browser / client makes a service request, the server and client establish a connection and can communicate with each other. Technical issues

[0003] Due to security restrictions or the lack of an external IP address, the HTTP server cannot expose port 80 / 443 to the public network, resulting in the inability to call the internal network HTTP service from the outside. Technical Solutions

[0004] The purpose of some embodiments of the present application is to provide an intranet access method and system, which enables external clients to securely access intranet HTTP services through a publish-subscribe model.

[0005] In a first aspect, an embodiment of the present application provides an intranet access method, which is applied to an intranet access system, wherein the intranet access system includes: at least one HTTP proxy service deployed on the intranet, an HTTP forwarding service deployed on the extranet, and a database that supports a publish-subscribe model, wherein the at least one HTTP proxy service and the HTTP forwarding service are both connected to the database; the method includes:

[0006] Each of the HTTP proxy services and the HTTP forwarding service negotiates, based on a preset asymmetric key and the publish-subscribe model of the database, to obtain a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service; wherein each HTTP proxy service is pre-set with a private key in an asymmetric key pair, and the HTTP forwarding service is pre-set with a public key corresponding to the private keys of all HTTP proxy services;

[0007] The HTTP forwarding service and each of the HTTP proxy services access the HTTP service of the intranet based on the publish-subscribe mode of the database and the symmetric encryption key.

[0008] As an embodiment, the database is Redis, and the HTTP forwarding service subscribes to the symmetric key negotiation public channel of Redis;

[0009] Each of the HTTP proxy services and the HTTP forwarding service negotiates based on a preset asymmetric key and the publish-subscribe mode of the database to obtain a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service, including:

[0010] Any HTTP proxy service notifies the database to generate a temporary channel for receiving the negotiated symmetric key, and any HTTP proxy service subscribes to the temporary channel for receiving the negotiated symmetric key and sends a key negotiation request to the symmetric key negotiation public channel;

[0011] The HTTP forwarding service monitors the symmetric key negotiation public channel to obtain the negotiation key request, generates a symmetric encryption key, encrypts the symmetric encryption key using the public key corresponding to the private key of any HTTP proxy service, and publishes the encrypted symmetric encryption key to the temporary channel for receiving the negotiated symmetric key;

[0012] After any HTTP proxy service monitors the encrypted symmetric encryption key through the subscribed temporary channel for receiving the negotiated symmetric key, it uses a preset private key to decrypt it to obtain the symmetric encryption key between any HTTP proxy service and the HTTP forwarding service.

[0013] In one embodiment, each of the HTTP proxy services and the HTTP forwarding service negotiates a symmetric encryption key for communication data between the HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe model of the database, including: each HTTP proxy service negotiates to obtain a corresponding symmetric encryption key according to a preset update period. During communication, the asymmetric key is regularly used to negotiate a symmetric encryption key pair, thereby ensuring the security of data transmission.

[0014] As an embodiment, each of the HTTP proxy services and the HTTP forwarding service negotiates to obtain a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and a publish-subscribe mode of the database, including:

[0015] Each of the HTTP proxy services determines a key update period according to the communication frequency between the HTTP proxy service and the HTTP forwarding service, and obtains a corresponding symmetric encryption key through negotiation according to the key update period.

[0016] As an embodiment, the HTTP forwarding service and the HTTP proxy service access the HTTP service of the intranet based on the publish-subscribe mode of the database and the symmetric encryption key, including:

[0017] After receiving the request from the external network client, the HTTP forwarding service notifies the Redis to generate a temporary communication channel. The HTTP forwarding service subscribes to the temporary communication channel and uses the symmetric encryption key of the target HTTP proxy service to encrypt the request data and the information of the temporary communication channel to obtain an encrypted access request, and publishes the encrypted access request to the data transmission dedicated channel of the Redis.

[0018] After the target HTTP proxy service monitors the subscribed data transmission dedicated channel to obtain the encrypted access request, it uses the symmetric encryption key to decrypt the request to obtain the request data, forwards the request data to the HTTP service on the intranet to obtain a response result, and then encrypts the response result using the symmetric encryption key and publishes it to the temporary communication channel;

[0019] After the HTTP forwarding service obtains the encrypted response result by monitoring the subscribed temporary communication channel, it decrypts the response result using the symmetric encryption key of the target HTTP proxy service and returns the decrypted response result to the client.

[0020] In a second aspect, an embodiment of the present application further provides an intranet access system, comprising: at least one HTTP proxy service deployed on the intranet, an HTTP forwarding service deployed on the extranet, and a database supporting a publish-subscribe model, wherein the at least one HTTP proxy service and the HTTP forwarding service are both connected to the database;

[0021] Each of the HTTP proxy services and the HTTP forwarding service is configured to obtain, based on a preset asymmetric key and the publish-subscribe model of the database, a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service; wherein each HTTP proxy service is pre-set with a private key in an asymmetric key pair, and the HTTP forwarding service is pre-set with a public key corresponding to the private keys of all HTTP proxy services;

[0022] The HTTP forwarding service and each of the HTTP proxy services are used to access the HTTP service of the intranet based on the publish-subscribe mode of the database and the symmetric encryption key.

[0023] As an embodiment, the database is Redis, and the HTTP forwarding service subscribes to the symmetric key negotiation public channel of Redis;

[0024] Any HTTP proxy service is used to notify the database to generate a temporary channel for receiving the negotiated symmetric key, and any HTTP proxy service subscribes to the temporary channel for receiving the negotiated symmetric key and sends a negotiation key request to the symmetric key negotiation public channel;

[0025] The HTTP forwarding service is used to monitor the symmetric key negotiation public channel to obtain the negotiation key request, generate a symmetric encryption key, encrypt the symmetric encryption key using the public key corresponding to the private key of any HTTP proxy service, and publish the encrypted symmetric encryption key to the temporary channel for receiving the negotiated symmetric key;

[0026] The any HTTP proxy service is used to monitor the encrypted symmetric encryption key through the subscribed temporary channel for receiving the negotiated symmetric key, and then decrypt it with a preset private key to obtain the symmetric encryption key between the any HTTP proxy service and the HTTP forwarding service.

[0027] As an embodiment, it includes:

[0028] Each of the HTTP proxy services and the HTTP forwarding service is used to negotiate according to a preset update period to obtain a corresponding symmetric encryption key.

[0029] As an embodiment, it includes: each of the HTTP proxy services is used to determine a key update period according to the communication frequency between the HTTP proxy service and the HTTP forwarding service, and to obtain a corresponding symmetric encryption key through negotiation according to the key update period.

[0030] As an embodiment, it includes:

[0031] The HTTP forwarding service is used to notify the Redis to generate a temporary communication channel after receiving a request from the external network client. The HTTP forwarding service subscribes to the temporary communication channel and uses the symmetric encryption key of the target HTTP proxy service to encrypt the request data and the information of the temporary communication channel to obtain an encrypted access request, and publishes the encrypted access request to the data transmission dedicated channel of the Redis;

[0032] The target HTTP proxy service is further configured to monitor the subscribed data transmission dedicated channel to obtain the encrypted access request, decrypt the request using the symmetric encryption key to obtain the request data, forward the request data to the HTTP service on the intranet to obtain a response result, and then encrypt the response result using the symmetric encryption key and publish it to the temporary communication channel;

[0033] The HTTP forwarding service is further configured to obtain the encrypted response result through monitoring the subscribed temporary communication channel, decrypt the response result using the symmetric encryption key of the target HTTP proxy service, and return the decrypted response result to the client. Beneficial effects

[0034] Compared with the prior art, the technical solution provided by the embodiments of the present application has at least the following positive effects:

[0035] In an embodiment of the present application, an HTTP proxy service is deployed on the intranet side, and an HTTP forwarding service and a database supporting the publish-subscribe mode are deployed on the extranet side. The HTTP proxy service and the HTTP forwarding service negotiate the symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on the publish-subscribe mode of the database and a preset asymmetric key. The HTTP forwarding service and the HTTP proxy service access the HTTP service of the intranet based on the publish-subscribe mode and the symmetric encryption key, thereby realizing external access when the intranet HTTP cannot expose the 80 / 443 ports to the outside world, and encrypting and decrypting data with a symmetric key during the communication process, thereby improving the security and reliability of the network. At the same time, each HTTP proxy service and HTTP forwarding service respectively stores a pair of public and private key certificates of the storage client and the client, thereby ensuring the secure isolation of intranet HTTP services in different areas. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] FIG1 is a flow chart of the intranet access method provided in Example 1 of the present application.

[0038] FIG2 is a schematic diagram of the symmetric encryption key negotiation process of the intranet access method provided in Example 1 of the present application.

[0039] FIG3 is a schematic diagram of the communication flow of the intranet access method provided in Example 1 of the present application. Best Mode for Carrying Out the Invention

[0040] The best implementation mode of the present application may be a preferred embodiment among the following implementation modes, which will not be described in detail here. Modes for Carrying Out the Invention

[0041] In order to make the purpose, technical solutions and advantages of this application more clear, some embodiments of this application are further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain this application and are not used to limit this application.

[0042] Figure 1 is a flow chart of an intranet access method provided in Example 1 of this application, which is applicable to providing secure HTTP access to external networks without public IP addresses. This method is applied to an intranet access system, which includes: at least one HTTP proxy service deployed on the intranet, an HTTP forwarding service deployed on the external network, and a database that supports a publish-subscribe model, with at least one HTTP proxy service and HTTP forwarding service both connected to the database. This embodiment of the application specifically includes the following steps:

[0043] Step 102: Each HTTP proxy service and HTTP forwarding service negotiates based on a preset asymmetric key and the publish-subscribe mode of the database to obtain a symmetric encryption key for communication data between each HTTP proxy service and HTTP forwarding service.

[0044] Each HTTP proxy service is pre-configured with a private key from an asymmetric key pair, and the HTTP forwarding service is pre-configured with the public key corresponding to the private keys of all HTTP proxy services. The asymmetric public key and asymmetric private key are used to negotiate the symmetric encryption key for communication data between the HTTP forwarding service and the HTTP proxy service, effectively preventing data theft and tampering during network transmission. Each HTTP proxy service also maintains a separate private key, ensuring secure isolation of intranet HTTP services in different regions.

[0045] After connecting to the database, the HTTP proxy and HTTP forwarding services negotiate symmetric encryption keys based on the database's publish-subscribe model. During this negotiation, the negotiated symmetric encryption key is encrypted and decrypted using an asymmetric key pair, ensuring its security. It's understood that each HTTP proxy service is pre-installed with the private key from the asymmetric key pair, while the HTTP forwarding service is pre-installed with the public key corresponding to the private keys of all HTTP proxy services.

[0046] Step 104: The HTTP forwarding service and the HTTP proxy service access the HTTP service of the intranet based on the publish-subscribe model of the database and the symmetric encryption key.

[0047] After the symmetric encryption key is negotiated successfully, the HTTP forwarding service notifies the database to generate a temporary communication channel and subscribe to the temporary communication channel. The HTTP forwarding service publishes the client's request through the database's dedicated data transmission channel. The HTTP proxy service can learn about the client's request and the information of the temporary communication channel by monitoring the subscribed dedicated data transmission channel. It then forwards the request to the intranet HTTP service and publishes the response result to the temporary communication channel, so that the HTTP forwarding service can monitor the response result and return it to the client. In addition, the communication data of the HTTP forwarding service and the HTTP proxy service can be encrypted with a symmetric encryption key to ensure the security of intranet access.

[0048] As shown in the flowchart of negotiating the symmetric encryption key in FIG2 , the steps of obtaining the symmetric encryption key for the communication data between any HTTP proxy service and the HTTP forwarding service of each HTTP proxy service in the intranet based on the preset asymmetric key and the publish-subscribe mode of the database include the following:

[0049] Step 210: Any HTTP proxy service notifies the database to generate a temporary channel for receiving the negotiated symmetric key. Any HTTP proxy service subscribes to the temporary channel for receiving the negotiated symmetric key and sends a key negotiation request to the symmetric key negotiation public channel.

[0050] After each HTTP proxy service starts, it establishes a connection with the external Redis server and subscribes to a dedicated data transmission channel (e.g., ChannelHTTPServerA). After the HTTP forwarding service starts, it establishes a connection with the external Redis server and subscribes to a public channel for symmetric key negotiation (e.g., ChannelNegotiateKey). The Redis channel creation method is well-known and will not be detailed here.

[0051] The following is an example of the data packet structure format of the key negotiation request sent by the HTTP proxy service:

[0052] Step 220: The HTTP forwarding service monitors the symmetric key negotiation public channel and generates a symmetric encryption key after receiving a negotiation key request. It encrypts the symmetric encryption key using the public key corresponding to the private key of any HTTP proxy service and publishes the encrypted symmetric encryption key to a temporary channel for receiving the negotiated symmetric key.

[0053] The HTTP forwarding service can generate an AES symmetric encryption key, encrypt the AES symmetric encryption key using the public key corresponding to the PrivateKeyName, and then publish it to the temporary channel used to receive the negotiated symmetric key. The data format of the symmetric encryption key packet is as follows:

[0054] Step 230: After any HTTP proxy service monitors the encrypted symmetric encryption key through the subscribed temporary channel for receiving the negotiated symmetric key, it uses the preset private key to decrypt the encrypted symmetric encryption key and obtains the symmetric encryption key between any HTTP proxy service and the HTTP forwarding service.

[0055] The HTTP proxy service will store the symmetric encryption key decrypted by the locally stored private key in the memory for encryption and decryption of subsequent communication data.

[0056] Through steps 210 to 230, each HTTP proxy service negotiates with the HTTP forwarding service to obtain a corresponding symmetric encryption key.

[0057] To further enhance security, each HTTP proxy service and HTTP forwarding service negotiates a corresponding symmetric encryption key according to a preset update cycle. This means that the symmetric encryption key between the HTTP forwarding server and each HTTP proxy service is regularly updated to prevent data leakage risks caused by key theft. The preset update cycle can be set based on actual security requirements, for example, every 5 minutes or 10 minutes, and there is no specific limit here.

[0058] It should be noted that each HTTP proxy service also determines a rekeying cycle based on the frequency of communication between the HTTP proxy service and the HTTP forwarding service, and negotiates the corresponding symmetric encryption key based on this rekeying cycle. The HTTP proxy service can measure the frequency of communication between it and the HTTP forwarding service and determine the rekeying cycle based on this frequency. A higher frequency results in a shorter rekeying cycle, while a lower frequency results in a longer rekeying cycle. This ensures that the rekeying frequency is consistent with actual encryption needs.

[0059] As shown in Figure 3, the HTTP forwarding service and each HTTP proxy service access the intranet's HTTP service based on the database publish-subscribe model and symmetric encryption keys, including the following operations:

[0060] Step 310: After receiving the request from the external network client, the HTTP forwarding service notifies Redis to generate a temporary communication channel. The HTTP forwarding service subscribes to the temporary communication channel and uses the symmetric encryption key of the target HTTP proxy service to encrypt the request data and the information of the temporary communication channel to obtain an encrypted access request, and then publishes the encrypted access request to the dedicated data transmission channel.

[0061] The HTTP proxy service may send a response result to the corresponding temporary communication channel according to the information of the temporary communication channel.

[0062] The data format of an access request packet is as follows:

[0063] Step 320: After the target HTTP proxy service listens to the subscribed data transmission dedicated channel to obtain the encrypted access request, it uses the symmetric encryption key to decrypt the request to obtain the request data, forwards the request data to the HTTP service in the intranet to obtain the response result, and then encrypts the response result with the symmetric encryption key and publishes it to the temporary communication channel.

[0064] Step 330: After the HTTP forwarding service obtains the encrypted response result through the subscribed temporary communication channel, it decrypts it using the symmetric encryption key of the target HTTP proxy service and returns the decrypted response result to the client. The data format of the response result packet is as follows:

[0065] Through steps 310 to 330, the client accesses the intranet HTTP service.

[0066] Compared with the prior art, the intranet access method of the embodiment of the present application obtains a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service through the HTTP proxy service deployed on the intranet side and the HTTP forwarding service deployed on the external network side based on the publish-subscribe mode of the database and the preset asymmetric key negotiation; the HTTP forwarding service and the HTTP proxy service access the intranet HTTP service based on the publish-subscribe mode and the symmetric encryption key, thereby realizing external access when the intranet HTTP cannot expose the 80 / 443 ports to the outside world, and encrypting and decrypting data by symmetric keys during the communication process, thereby improving the security and reliability of the network; at the same time, each HTTP proxy service and HTTP forwarding service respectively stores a pair of public and private key certificates of the storage client and the client, thereby ensuring the secure isolation of intranet HTTP services in different areas.

[0067] A second embodiment of the present application provides an intranet access system comprising: at least one HTTP proxy service deployed on the intranet, an HTTP forwarding service deployed on the extranet, and a database supporting a publish-subscribe model, wherein both the at least one HTTP proxy service and the HTTP forwarding service are connected to the database.

[0068] Each HTTP proxy service and HTTP forwarding service is used to negotiate the symmetric encryption key for communication data between each HTTP proxy service and HTTP forwarding service based on the preset asymmetric key and the publish-subscribe mode of the database; wherein, each HTTP proxy service is preset with a private key in an asymmetric key pair, and the HTTP forwarding service is preset with a public key corresponding to the private keys of all HTTP proxy services; the HTTP forwarding service and each of the HTTP proxy services are used to access the HTTP service of the intranet based on the publish-subscribe mode of the database and the symmetric encryption key.

[0069] Optionally, the database can be Redis, and the HTTP forwarding service subscribes to the symmetric key negotiation public channel of Redis; any HTTP proxy service is used to notify the database to generate a temporary channel for receiving the negotiated symmetric key, and any HTTP proxy service subscribes to the temporary channel for receiving the negotiated symmetric key and sends a negotiation key request to the symmetric key negotiation public channel; the HTTP forwarding service is used to monitor the symmetric key negotiation public channel and generate a symmetric encryption key after obtaining the negotiation key request, and use the public key corresponding to the private key of any HTTP proxy service to encrypt the symmetric encryption key, and publish the encrypted symmetric encryption key to the temporary channel for receiving the negotiated symmetric key; any HTTP proxy service is used to monitor the encrypted symmetric encryption key through the subscribed temporary channel for receiving the negotiated symmetric key, and then use the preset private key to decrypt it to obtain the symmetric encryption key between any HTTP proxy service and the HTTP forwarding service.

[0070] Optionally, each HTTP proxy service and HTTP forwarding service is used to negotiate according to a preset update period to obtain a corresponding symmetric encryption key.

[0071] Optionally, each of the HTTP proxy services is configured to determine a key update period according to a communication frequency between the HTTP proxy service and the HTTP forwarding service, and to obtain a corresponding symmetric encryption key through negotiation according to the key update period.

[0072] Optionally, the HTTP forwarding service is used to notify Redis to generate a temporary communication channel after receiving a request from an external network client. The HTTP forwarding service subscribes to the temporary communication channel and uses the symmetric encryption key of the target HTTP proxy service to encrypt the request data and the information of the temporary communication channel to obtain an encrypted access request, and publish the encrypted access request to the data transmission dedicated channel of Redis; the target HTTP proxy service is also used to listen to the subscribed data transmission dedicated channel to obtain the encrypted access request, decrypt it using the symmetric encryption key to obtain the request data, forward the request data to the HTTP service of the intranet to obtain a response result, and then encrypt the response result using the symmetric encryption key and publish it to the temporary communication channel; the HTTP forwarding service is also used to listen to the subscribed temporary communication channel to obtain the encrypted response result, decrypt it using the symmetric encryption key of the target HTTP proxy service, and return the decrypted response result to the client.

[0073] Compared with the prior art, the intranet access system of the embodiment of the present application obtains a symmetric encryption key for communication data between each HTTP proxy service and the HTTP forwarding service through an HTTP proxy service deployed on the intranet side and an HTTP forwarding service deployed on the external network side based on the publish-subscribe model of the database and a preset asymmetric key negotiation; the HTTP forwarding service and the HTTP proxy service access the intranet HTTP service based on the publish-subscribe model and the symmetric encryption key, thereby realizing external access when the intranet HTTP cannot expose the 80 / 443 ports to the outside world, and encrypting and decrypting data by symmetric keys during the communication process, thereby improving the security and reliability of the network; at the same time, each HTTP proxy service and HTTP forwarding service respectively stores a pair of public and private key certificates of the storage client and the client, thereby ensuring the secure isolation of intranet HTTP services in different areas. Industrial Applicability

[0074] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present application can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented with hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or grid device, etc.) to execute the methods described in each embodiment of the present application.

[0075] Note that the above are only preferred embodiments of the present application and the technical principles employed. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments and may include many other equivalent embodiments without departing from the scope of the present application. The scope of the present application is determined by the scope of the appended claims. Sequence Listing Free Content

[0076] This application does not involve a sequence listing.

Claims

1. An intranet access method, characterized in that, Applied to an intranet access system, the intranet access system includes: at least one HTTP proxy service deployed on the intranet, an HTTP forwarding service deployed on the extranet, and a database that supports the publish-subscribe mode. The at least one HTTP proxy service and the HTTP forwarding service are both connected to the database; the method includes: Each of the HTTP proxy services and the HTTP forwarding service negotiates a symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe mode of the database. Among them, each HTTP proxy service is preset with the private key in the asymmetric key pair, and the HTTP forwarding service is preset with the public keys corresponding to the private keys of all HTTP proxy services; The HTTP forwarding service and each of the HTTP proxy services access the HTTP service on the intranet based on the publish-subscribe mode of the database and the symmetric encryption key.

2. The intranet access method according to claim 1, wherein The database is Redis, and the HTTP forwarding service subscribes to the symmetric key negotiation public channel of Redis; Each of the HTTP proxy services and the HTTP forwarding service negotiates a symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe mode of the database, including: Any one of the HTTP proxy services notifies the database to generate a temporary channel for receiving the negotiated symmetric key. Any one of the HTTP proxy services subscribes to the temporary channel for receiving the negotiated symmetric key and sends a negotiation key request to the symmetric key negotiation public channel; After the HTTP forwarding service listens to the symmetric key negotiation public channel and obtains the negotiation key request, it generates a symmetric encryption key, encrypts the symmetric encryption key with the public key corresponding to the private key of any one of the HTTP proxy services, and publishes the encrypted symmetric encryption key to the temporary channel for receiving the negotiated symmetric key; After any one of the HTTP proxy services listens to the encrypted symmetric encryption key through the subscribed temporary channel for receiving the negotiated symmetric key, it decrypts it with the preset private key to obtain the symmetric encryption key between any one of the HTTP proxy services and the HTTP forwarding service.

3. The intranet access method according to claim 2, wherein Each of the HTTP proxy services and the HTTP forwarding service negotiates a symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe mode of the database, including: Each of the HTTP proxy services and the HTTP forwarding service negotiates to obtain the corresponding symmetric encryption key according to a preset update period.

4. The intranet access method according to claim 2, wherein Each of the HTTP proxy services and the HTTP forwarding service negotiates a symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe mode of the database, including: Each of the HTTP proxy services determines a key update period according to the communication frequency between the HTTP proxy service and the HTTP forwarding service, and negotiates a corresponding symmetric encryption key according to the key update period.

5. The intranet access method according to claim 2, wherein The HTTP forwarding service and the HTTP proxy service access the HTTP service in the intranet based on the publish-subscribe mode of the database and the symmetric encryption key, including: After receiving a request from an external network client, the HTTP forwarding service notifies Redis to generate a temporary communication channel. The HTTP forwarding service subscribes to the temporary communication channel and encrypts the request data of the request and the information of the temporary communication channel with the symmetric encryption key of the target HTTP proxy service to obtain an encrypted access request, and publishes the encrypted access request to the dedicated data transfer channel of Redis; After the target HTTP proxy service listens to the dedicated data transfer channel subscribed to obtain the encrypted access request, it decrypts it with the symmetric encryption key to obtain the request data of the request, forwards the request data to the HTTP service in the intranet to obtain a response result, and then encrypts the response result with the symmetric encryption key and publishes it to the temporary communication channel; After the HTTP forwarding service listens to the encrypted response result through the subscribed temporary communication channel, it decrypts it with the symmetric encryption key of the target HTTP proxy service and returns the decrypted response result to the client.

6. An intranet access system, characterized in that, Including: At least one HTTP proxy service deployed in the intranet, an HTTP forwarding service deployed in the external network, and a database supporting the publish-subscribe mode, and the at least one HTTP proxy service and the HTTP forwarding service are both connected to the database; Each of the HTTP proxy services and the HTTP forwarding service is used to negotiate a symmetric encryption key for the communication data between each HTTP proxy service and the HTTP forwarding service based on a preset asymmetric key and the publish-subscribe mode of the database; wherein, each HTTP proxy service is preset with a private key in the asymmetric key pair, and the HTTP forwarding service is preset with a public key corresponding to the private key of all HTTP proxy services; The HTTP forwarding service and each of the HTTP proxy services are used to access the HTTP service in the intranet based on the publish-subscribe mode of the database and the symmetric encryption key.

7. The intranet access system according to claim 6, wherein The database is Redis, and the HTTP forwarding service subscribes to the symmetric key negotiation public channel of Redis; Any one of the HTTP proxy services is used to notify the database to generate a temporary channel for receiving the negotiated symmetric key. The any one of the HTTP proxy services subscribes to the temporary channel for receiving the negotiated symmetric key and sends a negotiated key request to the symmetric key negotiation public channel; The HTTP forwarding service is used to generate a symmetric encryption key after listening to the negotiation key request on the symmetric key negotiation public channel, encrypt the symmetric encryption key with the public key corresponding to the private key of any one of the HTTP proxy services, and publish the encrypted symmetric encryption key to the temporary channel for receiving the negotiated symmetric key; Any one of the HTTP proxy services is used to obtain the symmetric encryption key between any one of the HTTP proxy services and the HTTP forwarding service after decrypting the encrypted symmetric encryption key by using a preset private key after listening to the encrypted symmetric encryption key on the temporarily subscribed channel for receiving the negotiated symmetric key.

8. The intranet access system according to claim 7, wherein Each of the HTTP proxy services and the HTTP forwarding service is used to negotiate to obtain the corresponding symmetric encryption key according to a preset update period.

9. The intranet access system according to claim 7, wherein Each of the HTTP proxy services is used to determine the key update period according to the communication frequency between the HTTP proxy service and the HTTP forwarding service, and negotiate to obtain the corresponding symmetric encryption key according to the key update period.

10. The intranet access system according to claim 7, characterized in that, The HTTP forwarding service is used to notify Redis to generate a temporary communication channel after receiving a request from an external network client. The HTTP forwarding service subscribes to the temporary communication channel and encrypts the request data of the request and the information of the temporary communication channel by using the symmetric encryption key of the target HTTP proxy service to obtain an encrypted access request, and publishes the encrypted access request to the dedicated data transmission channel of Redis; The target HTTP proxy service is further used to obtain the request data of the request after decrypting the encrypted access request by listening to the subscribed dedicated data transmission channel, forward the request data to the HTTP service on the internal network to obtain a response result, and then encrypt the response result by using the symmetric encryption key and publish it to the temporary communication channel; The HTTP forwarding service is further used to decrypt the encrypted response result by listening to the temporarily subscribed communication channel by using the symmetric encryption key of the target HTTP proxy service, and return the decrypted response result to the client.

Images